]> git.ipfire.org Git - thirdparty/grsecurity-scrape.git/blame - test/grsecurity-2.2.2-2.6.39.1-201106061957.patch
projects / thirdparty / grsecurity-scrape.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Auto commit, 1 new patch{es}.
[thirdparty/grsecurity-scrape.git] / test / grsecurity-2.2.2-2.6.39.1-201106061957.patch
CommitLineData
5a70c0ed
PK		 1diff -urNp linux-2.6.39.1/arch/alpha/include/asm/dma-mapping.h linux-2.6.39.1/arch/alpha/include/asm/dma-mapping.h
2--- linux-2.6.39.1/arch/alpha/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
3+++ linux-2.6.39.1/arch/alpha/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
4@@ -3,9 +3,9 @@
5
6 #include <linux/dma-attrs.h>
7
8-extern struct dma_map_ops *dma_ops;
9+extern const struct dma_map_ops *dma_ops;
10
11-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
12+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
13 {
14 return dma_ops;
15 }
16diff -urNp linux-2.6.39.1/arch/alpha/include/asm/elf.h linux-2.6.39.1/arch/alpha/include/asm/elf.h
17--- linux-2.6.39.1/arch/alpha/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
18+++ linux-2.6.39.1/arch/alpha/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
19@@ -90,6 +90,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
20
21 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
22
23+#ifdef CONFIG_PAX_ASLR
24+#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
25+
26+#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
27+#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
28+#endif
29+
30 /* $0 is set by ld.so to a pointer to a function which might be
31 registered using atexit. This provides a mean for the dynamic
32 linker to call DT_FINI functions for shared libraries that have
33diff -urNp linux-2.6.39.1/arch/alpha/include/asm/pgtable.h linux-2.6.39.1/arch/alpha/include/asm/pgtable.h
34--- linux-2.6.39.1/arch/alpha/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
35+++ linux-2.6.39.1/arch/alpha/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
36@@ -101,6 +101,17 @@ struct vm_area_struct;
37 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
38 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
39 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
40+
41+#ifdef CONFIG_PAX_PAGEEXEC
42+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
43+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
44+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
45+#else
46+# define PAGE_SHARED_NOEXEC PAGE_SHARED
47+# define PAGE_COPY_NOEXEC PAGE_COPY
48+# define PAGE_READONLY_NOEXEC PAGE_READONLY
49+#endif
50+
51 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
52
53 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
54diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_apecs.c linux-2.6.39.1/arch/alpha/kernel/core_apecs.c
55--- linux-2.6.39.1/arch/alpha/kernel/core_apecs.c 2011-05-19 00:06:34.000000000 -0400
56+++ linux-2.6.39.1/arch/alpha/kernel/core_apecs.c 2011-05-22 19:36:30.000000000 -0400
57@@ -305,7 +305,7 @@ apecs_write_config(struct pci_bus *bus,
58 return PCIBIOS_SUCCESSFUL;
59 }
60
61-struct pci_ops apecs_pci_ops =
62+const struct pci_ops apecs_pci_ops =
63 {
64 .read = apecs_read_config,
65 .write = apecs_write_config,
66diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_cia.c linux-2.6.39.1/arch/alpha/kernel/core_cia.c
67--- linux-2.6.39.1/arch/alpha/kernel/core_cia.c 2011-05-19 00:06:34.000000000 -0400
68+++ linux-2.6.39.1/arch/alpha/kernel/core_cia.c 2011-05-22 19:36:30.000000000 -0400
69@@ -239,7 +239,7 @@ cia_write_config(struct pci_bus *bus, un
70 return PCIBIOS_SUCCESSFUL;
71 }
72
73-struct pci_ops cia_pci_ops =
74+const struct pci_ops cia_pci_ops =
75 {
76 .read = cia_read_config,
77 .write = cia_write_config,
78diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_irongate.c linux-2.6.39.1/arch/alpha/kernel/core_irongate.c
79--- linux-2.6.39.1/arch/alpha/kernel/core_irongate.c 2011-05-19 00:06:34.000000000 -0400
80+++ linux-2.6.39.1/arch/alpha/kernel/core_irongate.c 2011-05-22 19:36:30.000000000 -0400
81@@ -155,7 +155,7 @@ irongate_write_config(struct pci_bus *bu
82 return PCIBIOS_SUCCESSFUL;
83 }
84
85-struct pci_ops irongate_pci_ops =
86+const struct pci_ops irongate_pci_ops =
87 {
88 .read = irongate_read_config,
89 .write = irongate_write_config,
90diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_lca.c linux-2.6.39.1/arch/alpha/kernel/core_lca.c
91--- linux-2.6.39.1/arch/alpha/kernel/core_lca.c 2011-05-19 00:06:34.000000000 -0400
92+++ linux-2.6.39.1/arch/alpha/kernel/core_lca.c 2011-05-22 19:36:30.000000000 -0400
93@@ -231,7 +231,7 @@ lca_write_config(struct pci_bus *bus, un
94 return PCIBIOS_SUCCESSFUL;
95 }
96
97-struct pci_ops lca_pci_ops =
98+const struct pci_ops lca_pci_ops =
99 {
100 .read = lca_read_config,
101 .write = lca_write_config,
102diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_marvel.c linux-2.6.39.1/arch/alpha/kernel/core_marvel.c
103--- linux-2.6.39.1/arch/alpha/kernel/core_marvel.c 2011-05-19 00:06:34.000000000 -0400
104+++ linux-2.6.39.1/arch/alpha/kernel/core_marvel.c 2011-05-22 19:36:30.000000000 -0400
105@@ -588,7 +588,7 @@ marvel_write_config(struct pci_bus *bus,
106 return PCIBIOS_SUCCESSFUL;
107 }
108
109-struct pci_ops marvel_pci_ops =
110+const struct pci_ops marvel_pci_ops =
111 {
112 .read = marvel_read_config,
113 .write = marvel_write_config,
114diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_mcpcia.c linux-2.6.39.1/arch/alpha/kernel/core_mcpcia.c
115--- linux-2.6.39.1/arch/alpha/kernel/core_mcpcia.c 2011-05-19 00:06:34.000000000 -0400
116+++ linux-2.6.39.1/arch/alpha/kernel/core_mcpcia.c 2011-05-22 19:36:30.000000000 -0400
117@@ -235,7 +235,7 @@ mcpcia_write_config(struct pci_bus *bus,
118 return PCIBIOS_SUCCESSFUL;
119 }
120
121-struct pci_ops mcpcia_pci_ops =
122+const struct pci_ops mcpcia_pci_ops =
123 {
124 .read = mcpcia_read_config,
125 .write = mcpcia_write_config,
126diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_polaris.c linux-2.6.39.1/arch/alpha/kernel/core_polaris.c
127--- linux-2.6.39.1/arch/alpha/kernel/core_polaris.c 2011-05-19 00:06:34.000000000 -0400
128+++ linux-2.6.39.1/arch/alpha/kernel/core_polaris.c 2011-05-22 19:36:30.000000000 -0400
129@@ -136,7 +136,7 @@ polaris_write_config(struct pci_bus *bus
130 return PCIBIOS_SUCCESSFUL;
131 }
132
133-struct pci_ops polaris_pci_ops =
134+const struct pci_ops polaris_pci_ops =
135 {
136 .read = polaris_read_config,
137 .write = polaris_write_config,
138diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_t2.c linux-2.6.39.1/arch/alpha/kernel/core_t2.c
139--- linux-2.6.39.1/arch/alpha/kernel/core_t2.c 2011-05-19 00:06:34.000000000 -0400
140+++ linux-2.6.39.1/arch/alpha/kernel/core_t2.c 2011-05-22 19:36:30.000000000 -0400
141@@ -314,7 +314,7 @@ t2_write_config(struct pci_bus *bus, uns
142 return PCIBIOS_SUCCESSFUL;
143 }
144
145-struct pci_ops t2_pci_ops =
146+const struct pci_ops t2_pci_ops =
147 {
148 .read = t2_read_config,
149 .write = t2_write_config,
150diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_titan.c linux-2.6.39.1/arch/alpha/kernel/core_titan.c
151--- linux-2.6.39.1/arch/alpha/kernel/core_titan.c 2011-05-19 00:06:34.000000000 -0400
152+++ linux-2.6.39.1/arch/alpha/kernel/core_titan.c 2011-05-22 19:36:30.000000000 -0400
153@@ -191,7 +191,7 @@ titan_write_config(struct pci_bus *bus,
154 return PCIBIOS_SUCCESSFUL;
155 }
156
157-struct pci_ops titan_pci_ops =
158+const struct pci_ops titan_pci_ops =
159 {
160 .read = titan_read_config,
161 .write = titan_write_config,
162diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_tsunami.c linux-2.6.39.1/arch/alpha/kernel/core_tsunami.c
163--- linux-2.6.39.1/arch/alpha/kernel/core_tsunami.c 2011-05-19 00:06:34.000000000 -0400
164+++ linux-2.6.39.1/arch/alpha/kernel/core_tsunami.c 2011-05-22 19:36:30.000000000 -0400
165@@ -166,7 +166,7 @@ tsunami_write_config(struct pci_bus *bus
166 return PCIBIOS_SUCCESSFUL;
167 }
168
169-struct pci_ops tsunami_pci_ops =
170+const struct pci_ops tsunami_pci_ops =
171 {
172 .read = tsunami_read_config,
173 .write = tsunami_write_config,
174diff -urNp linux-2.6.39.1/arch/alpha/kernel/core_wildfire.c linux-2.6.39.1/arch/alpha/kernel/core_wildfire.c
175--- linux-2.6.39.1/arch/alpha/kernel/core_wildfire.c 2011-05-19 00:06:34.000000000 -0400
176+++ linux-2.6.39.1/arch/alpha/kernel/core_wildfire.c 2011-05-22 19:36:30.000000000 -0400
177@@ -431,7 +431,7 @@ wildfire_write_config(struct pci_bus *bu
178 return PCIBIOS_SUCCESSFUL;
179 }
180
181-struct pci_ops wildfire_pci_ops =
182+const struct pci_ops wildfire_pci_ops =
183 {
184 .read = wildfire_read_config,
185 .write = wildfire_write_config,
186diff -urNp linux-2.6.39.1/arch/alpha/kernel/module.c linux-2.6.39.1/arch/alpha/kernel/module.c
187--- linux-2.6.39.1/arch/alpha/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
188+++ linux-2.6.39.1/arch/alpha/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
189@@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs,
190
191 /* The small sections were sorted to the end of the segment.
192 The following should definitely cover them. */
193- gp = (u64)me->module_core + me->core_size - 0x8000;
194+ gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
195 got = sechdrs[me->arch.gotsecindex].sh_addr;
196
197 for (i = 0; i < n; i++) {
198diff -urNp linux-2.6.39.1/arch/alpha/kernel/osf_sys.c linux-2.6.39.1/arch/alpha/kernel/osf_sys.c
199--- linux-2.6.39.1/arch/alpha/kernel/osf_sys.c 2011-05-19 00:06:34.000000000 -0400
200+++ linux-2.6.39.1/arch/alpha/kernel/osf_sys.c 2011-05-22 19:36:30.000000000 -0400
201@@ -1142,7 +1142,7 @@ arch_get_unmapped_area_1(unsigned long a
202 /* At this point: (!vma || addr < vma->vm_end). */
203 if (limit - len < addr)
204 return -ENOMEM;
205- if (!vma || addr + len <= vma->vm_start)
206+ if (check_heap_stack_gap(vma, addr, len))
207 return addr;
208 addr = vma->vm_end;
209 vma = vma->vm_next;
210@@ -1178,6 +1178,10 @@ arch_get_unmapped_area(struct file *filp
211 merely specific addresses, but regions of memory -- perhaps
212 this feature should be incorporated into all ports? */
213
214+#ifdef CONFIG_PAX_RANDMMAP
215+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
216+#endif
217+
218 if (addr) {
219 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
220 if (addr != (unsigned long) -ENOMEM)
221@@ -1185,8 +1189,8 @@ arch_get_unmapped_area(struct file *filp
222 }
223
224 /* Next, try allocating at TASK_UNMAPPED_BASE. */
225- addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
226- len, limit);
227+ addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
228+
229 if (addr != (unsigned long) -ENOMEM)
230 return addr;
231
232diff -urNp linux-2.6.39.1/arch/alpha/kernel/pci_iommu.c linux-2.6.39.1/arch/alpha/kernel/pci_iommu.c
233--- linux-2.6.39.1/arch/alpha/kernel/pci_iommu.c 2011-05-19 00:06:34.000000000 -0400
234+++ linux-2.6.39.1/arch/alpha/kernel/pci_iommu.c 2011-05-22 19:36:30.000000000 -0400
235@@ -950,7 +950,7 @@ static int alpha_pci_set_mask(struct dev
236 return 0;
237 }
238
239-struct dma_map_ops alpha_pci_ops = {
240+const struct dma_map_ops alpha_pci_ops = {
241 .alloc_coherent = alpha_pci_alloc_coherent,
242 .free_coherent = alpha_pci_free_coherent,
243 .map_page = alpha_pci_map_page,
244@@ -962,5 +962,5 @@ struct dma_map_ops alpha_pci_ops = {
245 .set_dma_mask = alpha_pci_set_mask,
246 };
247
248-struct dma_map_ops *dma_ops = &alpha_pci_ops;
249+const struct dma_map_ops *dma_ops = &alpha_pci_ops;
250 EXPORT_SYMBOL(dma_ops);
251diff -urNp linux-2.6.39.1/arch/alpha/kernel/pci-noop.c linux-2.6.39.1/arch/alpha/kernel/pci-noop.c
252--- linux-2.6.39.1/arch/alpha/kernel/pci-noop.c 2011-05-19 00:06:34.000000000 -0400
253+++ linux-2.6.39.1/arch/alpha/kernel/pci-noop.c 2011-05-22 19:36:30.000000000 -0400
254@@ -173,7 +173,7 @@ static int alpha_noop_set_mask(struct de
255 return 0;
256 }
257
258-struct dma_map_ops alpha_noop_ops = {
259+const struct dma_map_ops alpha_noop_ops = {
260 .alloc_coherent = alpha_noop_alloc_coherent,
261 .free_coherent = alpha_noop_free_coherent,
262 .map_page = alpha_noop_map_page,
263@@ -183,7 +183,7 @@ struct dma_map_ops alpha_noop_ops = {
264 .set_dma_mask = alpha_noop_set_mask,
265 };
266
267-struct dma_map_ops *dma_ops = &alpha_noop_ops;
268+const struct dma_map_ops *dma_ops = &alpha_noop_ops;
269 EXPORT_SYMBOL(dma_ops);
270
271 void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long maxlen)
272diff -urNp linux-2.6.39.1/arch/alpha/kernel/proto.h linux-2.6.39.1/arch/alpha/kernel/proto.h
273--- linux-2.6.39.1/arch/alpha/kernel/proto.h 2011-05-19 00:06:34.000000000 -0400
274+++ linux-2.6.39.1/arch/alpha/kernel/proto.h 2011-05-22 19:36:30.000000000 -0400
275@@ -17,14 +17,14 @@ struct pci_dev;
276 struct pci_controller;
277
278 /* core_apecs.c */
279-extern struct pci_ops apecs_pci_ops;
280+extern const struct pci_ops apecs_pci_ops;
281 extern void apecs_init_arch(void);
282 extern void apecs_pci_clr_err(void);
283 extern void apecs_machine_check(unsigned long vector, unsigned long la_ptr);
284 extern void apecs_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
285
286 /* core_cia.c */
287-extern struct pci_ops cia_pci_ops;
288+extern const struct pci_ops cia_pci_ops;
289 extern void cia_init_pci(void);
290 extern void cia_init_arch(void);
291 extern void pyxis_init_arch(void);
292@@ -33,19 +33,19 @@ extern void cia_machine_check(unsigned l
293 extern void cia_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
294
295 /* core_irongate.c */
296-extern struct pci_ops irongate_pci_ops;
297+extern const struct pci_ops irongate_pci_ops;
298 extern int irongate_pci_clr_err(void);
299 extern void irongate_init_arch(void);
300 #define irongate_pci_tbi ((void *)0)
301
302 /* core_lca.c */
303-extern struct pci_ops lca_pci_ops;
304+extern const struct pci_ops lca_pci_ops;
305 extern void lca_init_arch(void);
306 extern void lca_machine_check(unsigned long vector, unsigned long la_ptr);
307 extern void lca_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
308
309 /* core_marvel.c */
310-extern struct pci_ops marvel_pci_ops;
311+extern const struct pci_ops marvel_pci_ops;
312 extern void marvel_init_arch(void);
313 extern void marvel_kill_arch(int);
314 extern void marvel_machine_check(unsigned long, unsigned long);
315@@ -60,14 +60,14 @@ struct io7 *marvel_next_io7(struct io7 *
316 void io7_clear_errors(struct io7 *io7);
317
318 /* core_mcpcia.c */
319-extern struct pci_ops mcpcia_pci_ops;
320+extern const struct pci_ops mcpcia_pci_ops;
321 extern void mcpcia_init_arch(void);
322 extern void mcpcia_init_hoses(void);
323 extern void mcpcia_machine_check(unsigned long vector, unsigned long la_ptr);
324 extern void mcpcia_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
325
326 /* core_polaris.c */
327-extern struct pci_ops polaris_pci_ops;
328+extern const struct pci_ops polaris_pci_ops;
329 extern int polaris_read_config_dword(struct pci_dev *, int, u32 *);
330 extern int polaris_write_config_dword(struct pci_dev *, int, u32);
331 extern void polaris_init_arch(void);
332@@ -75,14 +75,14 @@ extern void polaris_machine_check(unsign
333 #define polaris_pci_tbi ((void *)0)
334
335 /* core_t2.c */
336-extern struct pci_ops t2_pci_ops;
337+extern const struct pci_ops t2_pci_ops;
338 extern void t2_init_arch(void);
339 extern void t2_kill_arch(int);
340 extern void t2_machine_check(unsigned long vector, unsigned long la_ptr);
341 extern void t2_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
342
343 /* core_titan.c */
344-extern struct pci_ops titan_pci_ops;
345+extern const struct pci_ops titan_pci_ops;
346 extern void titan_init_arch(void);
347 extern void titan_kill_arch(int);
348 extern void titan_machine_check(unsigned long, unsigned long);
349@@ -90,14 +90,14 @@ extern void titan_pci_tbi(struct pci_con
350 extern struct _alpha_agp_info *titan_agp_info(void);
351
352 /* core_tsunami.c */
353-extern struct pci_ops tsunami_pci_ops;
354+extern const struct pci_ops tsunami_pci_ops;
355 extern void tsunami_init_arch(void);
356 extern void tsunami_kill_arch(int);
357 extern void tsunami_machine_check(unsigned long vector, unsigned long la_ptr);
358 extern void tsunami_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
359
360 /* core_wildfire.c */
361-extern struct pci_ops wildfire_pci_ops;
362+extern const struct pci_ops wildfire_pci_ops;
363 extern void wildfire_init_arch(void);
364 extern void wildfire_kill_arch(int);
365 extern void wildfire_machine_check(unsigned long vector, unsigned long la_ptr);
366diff -urNp linux-2.6.39.1/arch/alpha/mm/fault.c linux-2.6.39.1/arch/alpha/mm/fault.c
367--- linux-2.6.39.1/arch/alpha/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
368+++ linux-2.6.39.1/arch/alpha/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
369@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
370 __reload_thread(pcb);
371 }
372
373+#ifdef CONFIG_PAX_PAGEEXEC
374+/*
375+ * PaX: decide what to do with offenders (regs->pc = fault address)
376+ *
377+ * returns 1 when task should be killed
378+ * 2 when patched PLT trampoline was detected
379+ * 3 when unpatched PLT trampoline was detected
380+ */
381+static int pax_handle_fetch_fault(struct pt_regs *regs)
382+{
383+
384+#ifdef CONFIG_PAX_EMUPLT
385+ int err;
386+
387+ do { /* PaX: patched PLT emulation #1 */
388+ unsigned int ldah, ldq, jmp;
389+
390+ err = get_user(ldah, (unsigned int *)regs->pc);
391+ err |= get_user(ldq, (unsigned int *)(regs->pc+4));
392+ err |= get_user(jmp, (unsigned int *)(regs->pc+8));
393+
394+ if (err)
395+ break;
396+
397+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
398+ (ldq & 0xFFFF0000U) == 0xA77B0000U &&
399+ jmp == 0x6BFB0000U)
400+ {
401+ unsigned long r27, addr;
402+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
403+ unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
404+
405+ addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
406+ err = get_user(r27, (unsigned long *)addr);
407+ if (err)
408+ break;
409+
410+ regs->r27 = r27;
411+ regs->pc = r27;
412+ return 2;
413+ }
414+ } while (0);
415+
416+ do { /* PaX: patched PLT emulation #2 */
417+ unsigned int ldah, lda, br;
418+
419+ err = get_user(ldah, (unsigned int *)regs->pc);
420+ err |= get_user(lda, (unsigned int *)(regs->pc+4));
421+ err |= get_user(br, (unsigned int *)(regs->pc+8));
422+
423+ if (err)
424+ break;
425+
426+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
427+ (lda & 0xFFFF0000U) == 0xA77B0000U &&
428+ (br & 0xFFE00000U) == 0xC3E00000U)
429+ {
430+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
431+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
432+ unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
433+
434+ regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
435+ regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
436+ return 2;
437+ }
438+ } while (0);
439+
440+ do { /* PaX: unpatched PLT emulation */
441+ unsigned int br;
442+
443+ err = get_user(br, (unsigned int *)regs->pc);
444+
445+ if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
446+ unsigned int br2, ldq, nop, jmp;
447+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
448+
449+ addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
450+ err = get_user(br2, (unsigned int *)addr);
451+ err |= get_user(ldq, (unsigned int *)(addr+4));
452+ err |= get_user(nop, (unsigned int *)(addr+8));
453+ err |= get_user(jmp, (unsigned int *)(addr+12));
454+ err |= get_user(resolver, (unsigned long *)(addr+16));
455+
456+ if (err)
457+ break;
458+
459+ if (br2 == 0xC3600000U &&
460+ ldq == 0xA77B000CU &&
461+ nop == 0x47FF041FU &&
462+ jmp == 0x6B7B0000U)
463+ {
464+ regs->r28 = regs->pc+4;
465+ regs->r27 = addr+16;
466+ regs->pc = resolver;
467+ return 3;
468+ }
469+ }
470+ } while (0);
471+#endif
472+
473+ return 1;
474+}
475+
476+void pax_report_insns(void *pc, void *sp)
477+{
478+ unsigned long i;
479+
480+ printk(KERN_ERR "PAX: bytes at PC: ");
481+ for (i = 0; i < 5; i++) {
482+ unsigned int c;
483+ if (get_user(c, (unsigned int *)pc+i))
484+ printk(KERN_CONT "???????? ");
485+ else
486+ printk(KERN_CONT "%08x ", c);
487+ }
488+ printk("\n");
489+}
490+#endif
491
492 /*
493 * This routine handles page faults. It determines the address,
494@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
495 good_area:
496 si_code = SEGV_ACCERR;
497 if (cause < 0) {
498- if (!(vma->vm_flags & VM_EXEC))
499+ if (!(vma->vm_flags & VM_EXEC)) {
500+
501+#ifdef CONFIG_PAX_PAGEEXEC
502+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
503+ goto bad_area;
504+
505+ up_read(&mm->mmap_sem);
506+ switch (pax_handle_fetch_fault(regs)) {
507+
508+#ifdef CONFIG_PAX_EMUPLT
509+ case 2:
510+ case 3:
511+ return;
512+#endif
513+
514+ }
515+ pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
516+ do_group_exit(SIGKILL);
517+#else
518 goto bad_area;
519+#endif
520+
521+ }
522 } else if (!cause) {
523 /* Allow reads even for write-only mappings */
524 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
525diff -urNp linux-2.6.39.1/arch/arm/common/it8152.c linux-2.6.39.1/arch/arm/common/it8152.c
526--- linux-2.6.39.1/arch/arm/common/it8152.c 2011-05-19 00:06:34.000000000 -0400
527+++ linux-2.6.39.1/arch/arm/common/it8152.c 2011-05-22 19:36:30.000000000 -0400
528@@ -221,7 +221,7 @@ static int it8152_pci_write_config(struc
529 return PCIBIOS_SUCCESSFUL;
530 }
531
532-static struct pci_ops it8152_ops = {
533+static const struct pci_ops it8152_ops = {
534 .read = it8152_pci_read_config,
535 .write = it8152_pci_write_config,
536 };
537diff -urNp linux-2.6.39.1/arch/arm/common/via82c505.c linux-2.6.39.1/arch/arm/common/via82c505.c
538--- linux-2.6.39.1/arch/arm/common/via82c505.c 2011-05-19 00:06:34.000000000 -0400
539+++ linux-2.6.39.1/arch/arm/common/via82c505.c 2011-05-22 19:36:30.000000000 -0400
540@@ -52,7 +52,7 @@ via82c505_write_config(struct pci_bus *b
541 return PCIBIOS_SUCCESSFUL;
542 }
543
544-static struct pci_ops via82c505_ops = {
545+static const struct pci_ops via82c505_ops = {
546 .read = via82c505_read_config,
547 .write = via82c505_write_config,
548 };
549diff -urNp linux-2.6.39.1/arch/arm/include/asm/cacheflush.h linux-2.6.39.1/arch/arm/include/asm/cacheflush.h
550--- linux-2.6.39.1/arch/arm/include/asm/cacheflush.h 2011-05-19 00:06:34.000000000 -0400
551+++ linux-2.6.39.1/arch/arm/include/asm/cacheflush.h 2011-05-22 19:36:30.000000000 -0400
552@@ -115,7 +115,7 @@ struct cpu_cache_fns {
553 */
554 #ifdef MULTI_CACHE
555
556-extern struct cpu_cache_fns cpu_cache;
557+extern const struct cpu_cache_fns cpu_cache;
558
559 #define __cpuc_flush_icache_all cpu_cache.flush_icache_all
560 #define __cpuc_flush_kern_all cpu_cache.flush_kern_all
561diff -urNp linux-2.6.39.1/arch/arm/include/asm/elf.h linux-2.6.39.1/arch/arm/include/asm/elf.h
562--- linux-2.6.39.1/arch/arm/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
563+++ linux-2.6.39.1/arch/arm/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
564@@ -115,7 +115,14 @@ int dump_task_regs(struct task_struct *t
565 the loader. We need to make sure that it is out of the way of the program
566 that it will "exec", and that there is sufficient room for the brk. */
567
568-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
569+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
570+
571+#ifdef CONFIG_PAX_ASLR
572+#define PAX_ELF_ET_DYN_BASE 0x00008000UL
573+
574+#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
575+#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
576+#endif
577
578 /* When the program starts, a1 contains a pointer to a function to be
579 registered with atexit, as per the SVR4 ABI. A value of 0 means we
580@@ -125,10 +132,6 @@ int dump_task_regs(struct task_struct *t
581 extern void elf_set_personality(const struct elf32_hdr *);
582 #define SET_PERSONALITY(ex) elf_set_personality(&(ex))
583
584-struct mm_struct;
585-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
586-#define arch_randomize_brk arch_randomize_brk
587-
588 extern int vectors_user_mapping(void);
589 #define arch_setup_additional_pages(bprm, uses_interp) vectors_user_mapping()
590 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES
591diff -urNp linux-2.6.39.1/arch/arm/include/asm/kmap_types.h linux-2.6.39.1/arch/arm/include/asm/kmap_types.h
592--- linux-2.6.39.1/arch/arm/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
593+++ linux-2.6.39.1/arch/arm/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
594@@ -21,6 +21,7 @@ enum km_type {
595 KM_L1_CACHE,
596 KM_L2_CACHE,
597 KM_KDB,
598+ KM_CLEARPAGE,
599 KM_TYPE_NR
600 };
601
602diff -urNp linux-2.6.39.1/arch/arm/include/asm/outercache.h linux-2.6.39.1/arch/arm/include/asm/outercache.h
603--- linux-2.6.39.1/arch/arm/include/asm/outercache.h 2011-05-19 00:06:34.000000000 -0400
604+++ linux-2.6.39.1/arch/arm/include/asm/outercache.h 2011-05-22 19:36:30.000000000 -0400
605@@ -38,7 +38,7 @@ struct outer_cache_fns {
606
607 #ifdef CONFIG_OUTER_CACHE
608
609-extern struct outer_cache_fns outer_cache;
610+extern const struct outer_cache_fns outer_cache;
611
612 static inline void outer_inv_range(phys_addr_t start, phys_addr_t end)
613 {
614diff -urNp linux-2.6.39.1/arch/arm/include/asm/page.h linux-2.6.39.1/arch/arm/include/asm/page.h
615--- linux-2.6.39.1/arch/arm/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
616+++ linux-2.6.39.1/arch/arm/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
617@@ -126,7 +126,7 @@ struct cpu_user_fns {
618 };
619
620 #ifdef MULTI_USER
621-extern struct cpu_user_fns cpu_user;
622+extern const struct cpu_user_fns cpu_user;
623
624 #define __cpu_clear_user_highpage cpu_user.cpu_clear_user_highpage
625 #define __cpu_copy_user_highpage cpu_user.cpu_copy_user_highpage
626diff -urNp linux-2.6.39.1/arch/arm/include/asm/uaccess.h linux-2.6.39.1/arch/arm/include/asm/uaccess.h
627--- linux-2.6.39.1/arch/arm/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
628+++ linux-2.6.39.1/arch/arm/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
629@@ -403,6 +403,9 @@ extern unsigned long __must_check __strn
630
631 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
632 {
633+ if ((long)n < 0)
634+ return n;
635+
636 if (access_ok(VERIFY_READ, from, n))
637 n = __copy_from_user(to, from, n);
638 else /* security hole - plug it */
639@@ -412,6 +415,9 @@ static inline unsigned long __must_check
640
641 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
642 {
643+ if ((long)n < 0)
644+ return n;
645+
646 if (access_ok(VERIFY_WRITE, to, n))
647 n = __copy_to_user(to, from, n);
648 return n;
649diff -urNp linux-2.6.39.1/arch/arm/kernel/kgdb.c linux-2.6.39.1/arch/arm/kernel/kgdb.c
650--- linux-2.6.39.1/arch/arm/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
651+++ linux-2.6.39.1/arch/arm/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
652@@ -246,7 +246,7 @@ void kgdb_arch_exit(void)
653 * and we handle the normal undef case within the do_undefinstr
654 * handler.
655 */
656-struct kgdb_arch arch_kgdb_ops = {
657+const struct kgdb_arch arch_kgdb_ops = {
658 #ifndef __ARMEB__
659 .gdb_bpt_instr = {0xfe, 0xde, 0xff, 0xe7}
660 #else /* ! __ARMEB__ */
661diff -urNp linux-2.6.39.1/arch/arm/kernel/process.c linux-2.6.39.1/arch/arm/kernel/process.c
662--- linux-2.6.39.1/arch/arm/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
663+++ linux-2.6.39.1/arch/arm/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
664@@ -28,7 +28,6 @@
665 #include <linux/tick.h>
666 #include <linux/utsname.h>
667 #include <linux/uaccess.h>
668-#include <linux/random.h>
669 #include <linux/hw_breakpoint.h>
670
671 #include <asm/cacheflush.h>
672@@ -479,12 +478,6 @@ unsigned long get_wchan(struct task_stru
673 return 0;
674 }
675
676-unsigned long arch_randomize_brk(struct mm_struct *mm)
677-{
678- unsigned long range_end = mm->brk + 0x02000000;
679- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
680-}
681-
682 #ifdef CONFIG_MMU
683 /*
684 * The vectors page is always readable from user space for the
685diff -urNp linux-2.6.39.1/arch/arm/mach-cns3xxx/pcie.c linux-2.6.39.1/arch/arm/mach-cns3xxx/pcie.c
686--- linux-2.6.39.1/arch/arm/mach-cns3xxx/pcie.c 2011-05-19 00:06:34.000000000 -0400
687+++ linux-2.6.39.1/arch/arm/mach-cns3xxx/pcie.c 2011-05-22 19:36:30.000000000 -0400
688@@ -162,7 +162,7 @@ static int cns3xxx_pci_setup(int nr, str
689 return 1;
690 }
691
692-static struct pci_ops cns3xxx_pcie_ops = {
693+static const struct pci_ops cns3xxx_pcie_ops = {
694 .read = cns3xxx_pci_read_config,
695 .write = cns3xxx_pci_write_config,
696 };
697diff -urNp linux-2.6.39.1/arch/arm/mach-dove/pcie.c linux-2.6.39.1/arch/arm/mach-dove/pcie.c
698--- linux-2.6.39.1/arch/arm/mach-dove/pcie.c 2011-05-19 00:06:34.000000000 -0400
699+++ linux-2.6.39.1/arch/arm/mach-dove/pcie.c 2011-05-22 19:36:30.000000000 -0400
700@@ -155,7 +155,7 @@ static int pcie_wr_conf(struct pci_bus *
701 return ret;
702 }
703
704-static struct pci_ops pcie_ops = {
705+static const struct pci_ops pcie_ops = {
706 .read = pcie_rd_conf,
707 .write = pcie_wr_conf,
708 };
709diff -urNp linux-2.6.39.1/arch/arm/mach-footbridge/dc21285.c linux-2.6.39.1/arch/arm/mach-footbridge/dc21285.c
710--- linux-2.6.39.1/arch/arm/mach-footbridge/dc21285.c 2011-05-19 00:06:34.000000000 -0400
711+++ linux-2.6.39.1/arch/arm/mach-footbridge/dc21285.c 2011-05-22 19:36:30.000000000 -0400
712@@ -129,7 +129,7 @@ dc21285_write_config(struct pci_bus *bus
713 return PCIBIOS_SUCCESSFUL;
714 }
715
716-static struct pci_ops dc21285_ops = {
717+static const struct pci_ops dc21285_ops = {
718 .read = dc21285_read_config,
719 .write = dc21285_write_config,
720 };
721diff -urNp linux-2.6.39.1/arch/arm/mach-integrator/pci_v3.c linux-2.6.39.1/arch/arm/mach-integrator/pci_v3.c
722--- linux-2.6.39.1/arch/arm/mach-integrator/pci_v3.c 2011-05-19 00:06:34.000000000 -0400
723+++ linux-2.6.39.1/arch/arm/mach-integrator/pci_v3.c 2011-05-22 19:36:30.000000000 -0400
724@@ -340,7 +340,7 @@ static int v3_write_config(struct pci_bu
725 return PCIBIOS_SUCCESSFUL;
726 }
727
728-static struct pci_ops pci_v3_ops = {
729+static const struct pci_ops pci_v3_ops = {
730 .read = v3_read_config,
731 .write = v3_write_config,
732 };
733diff -urNp linux-2.6.39.1/arch/arm/mach-iop13xx/pci.c linux-2.6.39.1/arch/arm/mach-iop13xx/pci.c
734--- linux-2.6.39.1/arch/arm/mach-iop13xx/pci.c 2011-05-19 00:06:34.000000000 -0400
735+++ linux-2.6.39.1/arch/arm/mach-iop13xx/pci.c 2011-05-22 19:36:30.000000000 -0400
736@@ -324,7 +324,7 @@ iop13xx_atux_write_config(struct pci_bus
737 return PCIBIOS_SUCCESSFUL;
738 }
739
740-static struct pci_ops iop13xx_atux_ops = {
741+static const struct pci_ops iop13xx_atux_ops = {
742 .read = iop13xx_atux_read_config,
743 .write = iop13xx_atux_write_config,
744 };
745@@ -471,7 +471,7 @@ iop13xx_atue_write_config(struct pci_bus
746 return PCIBIOS_SUCCESSFUL;
747 }
748
749-static struct pci_ops iop13xx_atue_ops = {
750+static const struct pci_ops iop13xx_atue_ops = {
751 .read = iop13xx_atue_read_config,
752 .write = iop13xx_atue_write_config,
753 };
754diff -urNp linux-2.6.39.1/arch/arm/mach-ixp2000/enp2611.c linux-2.6.39.1/arch/arm/mach-ixp2000/enp2611.c
755--- linux-2.6.39.1/arch/arm/mach-ixp2000/enp2611.c 2011-05-19 00:06:34.000000000 -0400
756+++ linux-2.6.39.1/arch/arm/mach-ixp2000/enp2611.c 2011-05-22 19:36:30.000000000 -0400
757@@ -137,7 +137,7 @@ static int enp2611_pci_write_config(stru
758 return PCIBIOS_DEVICE_NOT_FOUND;
759 }
760
761-static struct pci_ops enp2611_pci_ops = {
762+static const struct pci_ops enp2611_pci_ops = {
763 .read = enp2611_pci_read_config,
764 .write = enp2611_pci_write_config
765 };
766diff -urNp linux-2.6.39.1/arch/arm/mach-ixp2000/pci.c linux-2.6.39.1/arch/arm/mach-ixp2000/pci.c
767--- linux-2.6.39.1/arch/arm/mach-ixp2000/pci.c 2011-05-19 00:06:34.000000000 -0400
768+++ linux-2.6.39.1/arch/arm/mach-ixp2000/pci.c 2011-05-22 19:36:30.000000000 -0400
769@@ -125,7 +125,7 @@ int ixp2000_pci_write_config(struct pci_
770 }
771
772
773-static struct pci_ops ixp2000_pci_ops = {
774+static const struct pci_ops ixp2000_pci_ops = {
775 .read = ixp2000_pci_read_config,
776 .write = ixp2000_pci_write_config
777 };
778diff -urNp linux-2.6.39.1/arch/arm/mach-ixp23xx/pci.c linux-2.6.39.1/arch/arm/mach-ixp23xx/pci.c
779--- linux-2.6.39.1/arch/arm/mach-ixp23xx/pci.c 2011-05-19 00:06:34.000000000 -0400
780+++ linux-2.6.39.1/arch/arm/mach-ixp23xx/pci.c 2011-05-22 19:36:30.000000000 -0400
781@@ -136,7 +136,7 @@ static int ixp23xx_pci_write_config(stru
782 return PCIBIOS_SUCCESSFUL;
783 }
784
785-struct pci_ops ixp23xx_pci_ops = {
786+const struct pci_ops ixp23xx_pci_ops = {
787 .read = ixp23xx_pci_read_config,
788 .write = ixp23xx_pci_write_config,
789 };
790diff -urNp linux-2.6.39.1/arch/arm/mach-ixp4xx/common-pci.c linux-2.6.39.1/arch/arm/mach-ixp4xx/common-pci.c
791--- linux-2.6.39.1/arch/arm/mach-ixp4xx/common-pci.c 2011-05-19 00:06:34.000000000 -0400
792+++ linux-2.6.39.1/arch/arm/mach-ixp4xx/common-pci.c 2011-05-22 19:36:30.000000000 -0400
793@@ -283,7 +283,7 @@ static int ixp4xx_pci_write_config(struc
794 return PCIBIOS_SUCCESSFUL;
795 }
796
797-struct pci_ops ixp4xx_ops = {
798+const struct pci_ops ixp4xx_ops = {
799 .read = ixp4xx_pci_read_config,
800 .write = ixp4xx_pci_write_config,
801 };
802diff -urNp linux-2.6.39.1/arch/arm/mach-kirkwood/pcie.c linux-2.6.39.1/arch/arm/mach-kirkwood/pcie.c
803--- linux-2.6.39.1/arch/arm/mach-kirkwood/pcie.c 2011-05-19 00:06:34.000000000 -0400
804+++ linux-2.6.39.1/arch/arm/mach-kirkwood/pcie.c 2011-05-22 19:36:30.000000000 -0400
805@@ -111,7 +111,7 @@ static int pcie_wr_conf(struct pci_bus *
806 return ret;
807 }
808
809-static struct pci_ops pcie_ops = {
810+static const struct pci_ops pcie_ops = {
811 .read = pcie_rd_conf,
812 .write = pcie_wr_conf,
813 };
814diff -urNp linux-2.6.39.1/arch/arm/mach-ks8695/pci.c linux-2.6.39.1/arch/arm/mach-ks8695/pci.c
815--- linux-2.6.39.1/arch/arm/mach-ks8695/pci.c 2011-05-19 00:06:34.000000000 -0400
816+++ linux-2.6.39.1/arch/arm/mach-ks8695/pci.c 2011-05-22 19:36:30.000000000 -0400
817@@ -136,7 +136,7 @@ static void ks8695_local_writeconfig(int
818 __raw_writel(value, KS8695_PCI_VA + KS8695_PBCD);
819 }
820
821-static struct pci_ops ks8695_pci_ops = {
822+static const struct pci_ops ks8695_pci_ops = {
823 .read = ks8695_pci_readconfig,
824 .write = ks8695_pci_writeconfig,
825 };
826diff -urNp linux-2.6.39.1/arch/arm/mach-mmp/clock.c linux-2.6.39.1/arch/arm/mach-mmp/clock.c
827--- linux-2.6.39.1/arch/arm/mach-mmp/clock.c 2011-05-19 00:06:34.000000000 -0400
828+++ linux-2.6.39.1/arch/arm/mach-mmp/clock.c 2011-05-22 19:36:30.000000000 -0400
829@@ -29,7 +29,7 @@ static void apbc_clk_disable(struct clk
830 __raw_writel(0, clk->clk_rst);
831 }
832
833-struct clkops apbc_clk_ops = {
834+const struct clkops apbc_clk_ops = {
835 .enable = apbc_clk_enable,
836 .disable = apbc_clk_disable,
837 };
838@@ -44,7 +44,7 @@ static void apmu_clk_disable(struct clk
839 __raw_writel(0, clk->clk_rst);
840 }
841
842-struct clkops apmu_clk_ops = {
843+const struct clkops apmu_clk_ops = {
844 .enable = apmu_clk_enable,
845 .disable = apmu_clk_disable,
846 };
847diff -urNp linux-2.6.39.1/arch/arm/mach-msm/iommu.c linux-2.6.39.1/arch/arm/mach-msm/iommu.c
848--- linux-2.6.39.1/arch/arm/mach-msm/iommu.c 2011-05-19 00:06:34.000000000 -0400
849+++ linux-2.6.39.1/arch/arm/mach-msm/iommu.c 2011-05-22 19:36:30.000000000 -0400
850@@ -669,7 +669,7 @@ fail:
851 return 0;
852 }
853
854-static struct iommu_ops msm_iommu_ops = {
855+static const struct iommu_ops msm_iommu_ops = {
856 .domain_init = msm_iommu_domain_init,
857 .domain_destroy = msm_iommu_domain_destroy,
858 .attach_dev = msm_iommu_attach_dev,
859diff -urNp linux-2.6.39.1/arch/arm/mach-msm/last_radio_log.c linux-2.6.39.1/arch/arm/mach-msm/last_radio_log.c
860--- linux-2.6.39.1/arch/arm/mach-msm/last_radio_log.c 2011-05-19 00:06:34.000000000 -0400
861+++ linux-2.6.39.1/arch/arm/mach-msm/last_radio_log.c 2011-05-22 19:36:30.000000000 -0400
862@@ -48,6 +48,7 @@ static ssize_t last_radio_log_read(struc
863 }
864
865 static struct file_operations last_radio_log_fops = {
866+ /* cannot be const, see msm_init_last_radio_log */
867 .read = last_radio_log_read,
868 .llseek = default_llseek,
869 };
870diff -urNp linux-2.6.39.1/arch/arm/mach-mv78xx0/pcie.c linux-2.6.39.1/arch/arm/mach-mv78xx0/pcie.c
871--- linux-2.6.39.1/arch/arm/mach-mv78xx0/pcie.c 2011-05-19 00:06:34.000000000 -0400
872+++ linux-2.6.39.1/arch/arm/mach-mv78xx0/pcie.c 2011-05-22 19:36:30.000000000 -0400
873@@ -222,7 +222,7 @@ static int pcie_wr_conf(struct pci_bus *
874 return ret;
875 }
876
877-static struct pci_ops pcie_ops = {
878+static const struct pci_ops pcie_ops = {
879 .read = pcie_rd_conf,
880 .write = pcie_wr_conf,
881 };
882diff -urNp linux-2.6.39.1/arch/arm/mach-orion5x/pci.c linux-2.6.39.1/arch/arm/mach-orion5x/pci.c
883--- linux-2.6.39.1/arch/arm/mach-orion5x/pci.c 2011-05-19 00:06:34.000000000 -0400
884+++ linux-2.6.39.1/arch/arm/mach-orion5x/pci.c 2011-05-22 19:36:30.000000000 -0400
885@@ -130,7 +130,7 @@ static int pcie_wr_conf(struct pci_bus *
886 return ret;
887 }
888
889-static struct pci_ops pcie_ops = {
890+static const struct pci_ops pcie_ops = {
891 .read = pcie_rd_conf,
892 .write = pcie_wr_conf,
893 };
894@@ -368,7 +368,7 @@ static int orion5x_pci_wr_conf(struct pc
895 PCI_FUNC(devfn), where, size, val);
896 }
897
898-static struct pci_ops pci_ops = {
899+static const struct pci_ops pci_ops = {
900 .read = orion5x_pci_rd_conf,
901 .write = orion5x_pci_wr_conf,
902 };
903diff -urNp linux-2.6.39.1/arch/arm/mach-sa1100/pci-nanoengine.c linux-2.6.39.1/arch/arm/mach-sa1100/pci-nanoengine.c
904--- linux-2.6.39.1/arch/arm/mach-sa1100/pci-nanoengine.c 2011-05-19 00:06:34.000000000 -0400
905+++ linux-2.6.39.1/arch/arm/mach-sa1100/pci-nanoengine.c 2011-05-22 19:36:30.000000000 -0400
906@@ -117,7 +117,7 @@ static int nanoengine_write_config(struc
907 return PCIBIOS_SUCCESSFUL;
908 }
909
910-static struct pci_ops pci_nano_ops = {
911+static const struct pci_ops pci_nano_ops = {
912 .read = nanoengine_read_config,
913 .write = nanoengine_write_config,
914 };
915diff -urNp linux-2.6.39.1/arch/arm/mach-tegra/pcie.c linux-2.6.39.1/arch/arm/mach-tegra/pcie.c
916--- linux-2.6.39.1/arch/arm/mach-tegra/pcie.c 2011-05-19 00:06:34.000000000 -0400
917+++ linux-2.6.39.1/arch/arm/mach-tegra/pcie.c 2011-05-22 19:36:30.000000000 -0400
918@@ -336,7 +336,7 @@ static int tegra_pcie_write_conf(struct
919 return PCIBIOS_SUCCESSFUL;
920 }
921
922-static struct pci_ops tegra_pcie_ops = {
923+static const struct pci_ops tegra_pcie_ops = {
924 .read = tegra_pcie_read_conf,
925 .write = tegra_pcie_write_conf,
926 };
927diff -urNp linux-2.6.39.1/arch/arm/mach-ux500/mbox-db5500.c linux-2.6.39.1/arch/arm/mach-ux500/mbox-db5500.c
928--- linux-2.6.39.1/arch/arm/mach-ux500/mbox-db5500.c 2011-05-19 00:06:34.000000000 -0400
929+++ linux-2.6.39.1/arch/arm/mach-ux500/mbox-db5500.c 2011-05-22 19:41:32.000000000 -0400
930@@ -168,7 +168,7 @@ static ssize_t mbox_read_fifo(struct dev
931 return sprintf(buf, "0x%X\n", mbox_value);
932 }
933
934-static DEVICE_ATTR(fifo, S_IWUGO | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
935+static DEVICE_ATTR(fifo, S_IWUSR | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
936
937 static int mbox_show(struct seq_file *s, void *data)
938 {
939diff -urNp linux-2.6.39.1/arch/arm/mach-versatile/pci.c linux-2.6.39.1/arch/arm/mach-versatile/pci.c
940--- linux-2.6.39.1/arch/arm/mach-versatile/pci.c 2011-05-19 00:06:34.000000000 -0400
941+++ linux-2.6.39.1/arch/arm/mach-versatile/pci.c 2011-05-22 19:36:30.000000000 -0400
942@@ -165,7 +165,7 @@ static int versatile_write_config(struct
943 return PCIBIOS_SUCCESSFUL;
944 }
945
946-static struct pci_ops pci_versatile_ops = {
947+static const struct pci_ops pci_versatile_ops = {
948 .read = versatile_read_config,
949 .write = versatile_write_config,
950 };
951diff -urNp linux-2.6.39.1/arch/arm/mm/fault.c linux-2.6.39.1/arch/arm/mm/fault.c
952--- linux-2.6.39.1/arch/arm/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
953+++ linux-2.6.39.1/arch/arm/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
954@@ -182,6 +182,13 @@ __do_user_fault(struct task_struct *tsk,
955 }
956 #endif
957
958+#ifdef CONFIG_PAX_PAGEEXEC
959+ if (fsr & FSR_LNX_PF) {
960+ pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
961+ do_group_exit(SIGKILL);
962+ }
963+#endif
964+
965 tsk->thread.address = addr;
966 tsk->thread.error_code = fsr;
967 tsk->thread.trap_no = 14;
968@@ -379,6 +386,33 @@ do_page_fault(unsigned long addr, unsign
969 }
970 #endif /* CONFIG_MMU */
971
972+#ifdef CONFIG_PAX_PAGEEXEC
973+void pax_report_insns(void *pc, void *sp)
974+{
975+ long i;
976+
977+ printk(KERN_ERR "PAX: bytes at PC: ");
978+ for (i = 0; i < 20; i++) {
979+ unsigned char c;
980+ if (get_user(c, (__force unsigned char __user *)pc+i))
981+ printk(KERN_CONT "?? ");
982+ else
983+ printk(KERN_CONT "%02x ", c);
984+ }
985+ printk("\n");
986+
987+ printk(KERN_ERR "PAX: bytes at SP-4: ");
988+ for (i = -1; i < 20; i++) {
989+ unsigned long c;
990+ if (get_user(c, (__force unsigned long __user *)sp+i))
991+ printk(KERN_CONT "???????? ");
992+ else
993+ printk(KERN_CONT "%08lx ", c);
994+ }
995+ printk("\n");
996+}
997+#endif
998+
999 /*
1000 * First Level Translation Fault Handler
1001 *
1002diff -urNp linux-2.6.39.1/arch/arm/mm/mmap.c linux-2.6.39.1/arch/arm/mm/mmap.c
1003--- linux-2.6.39.1/arch/arm/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
1004+++ linux-2.6.39.1/arch/arm/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
1005@@ -65,6 +65,10 @@ arch_get_unmapped_area(struct file *filp
1006 if (len > TASK_SIZE)
1007 return -ENOMEM;
1008
1009+#ifdef CONFIG_PAX_RANDMMAP
1010+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
1011+#endif
1012+
1013 if (addr) {
1014 if (do_align)
1015 addr = COLOUR_ALIGN(addr, pgoff);
1016@@ -72,15 +76,14 @@ arch_get_unmapped_area(struct file *filp
1017 addr = PAGE_ALIGN(addr);
1018
1019 vma = find_vma(mm, addr);
1020- if (TASK_SIZE - len >= addr &&
1021- (!vma || addr + len <= vma->vm_start))
1022+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1023 return addr;
1024 }
1025 if (len > mm->cached_hole_size) {
1026- start_addr = addr = mm->free_area_cache;
1027+ start_addr = addr = mm->free_area_cache;
1028 } else {
1029- start_addr = addr = TASK_UNMAPPED_BASE;
1030- mm->cached_hole_size = 0;
1031+ start_addr = addr = mm->mmap_base;
1032+ mm->cached_hole_size = 0;
1033 }
1034 /* 8 bits of randomness in 20 address space bits */
1035 if ((current->flags & PF_RANDOMIZE) &&
1036@@ -100,14 +103,14 @@ full_search:
1037 * Start a new search - just in case we missed
1038 * some holes.
1039 */
1040- if (start_addr != TASK_UNMAPPED_BASE) {
1041- start_addr = addr = TASK_UNMAPPED_BASE;
1042+ if (start_addr != mm->mmap_base) {
1043+ start_addr = addr = mm->mmap_base;
1044 mm->cached_hole_size = 0;
1045 goto full_search;
1046 }
1047 return -ENOMEM;
1048 }
1049- if (!vma || addr + len <= vma->vm_start) {
1050+ if (check_heap_stack_gap(vma, addr, len)) {
1051 /*
1052 * Remember the place where we stopped the search:
1053 */
1054diff -urNp linux-2.6.39.1/arch/arm/plat-iop/pci.c linux-2.6.39.1/arch/arm/plat-iop/pci.c
1055--- linux-2.6.39.1/arch/arm/plat-iop/pci.c 2011-05-19 00:06:34.000000000 -0400
1056+++ linux-2.6.39.1/arch/arm/plat-iop/pci.c 2011-05-22 19:36:30.000000000 -0400
1057@@ -161,7 +161,7 @@ iop3xx_write_config(struct pci_bus *bus,
1058 return PCIBIOS_SUCCESSFUL;
1059 }
1060
1061-static struct pci_ops iop3xx_ops = {
1062+static const struct pci_ops iop3xx_ops = {
1063 .read = iop3xx_read_config,
1064 .write = iop3xx_write_config,
1065 };
1066diff -urNp linux-2.6.39.1/arch/avr32/include/asm/elf.h linux-2.6.39.1/arch/avr32/include/asm/elf.h
1067--- linux-2.6.39.1/arch/avr32/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
1068+++ linux-2.6.39.1/arch/avr32/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
1069@@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpreg
1070 the loader. We need to make sure that it is out of the way of the program
1071 that it will "exec", and that there is sufficient room for the brk. */
1072
1073-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
1074+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1075
1076+#ifdef CONFIG_PAX_ASLR
1077+#define PAX_ELF_ET_DYN_BASE 0x00001000UL
1078+
1079+#define PAX_DELTA_MMAP_LEN 15
1080+#define PAX_DELTA_STACK_LEN 15
1081+#endif
1082
1083 /* This yields a mask that user programs can use to figure out what
1084 instruction set this CPU supports. This could be done in user space,
1085diff -urNp linux-2.6.39.1/arch/avr32/include/asm/kmap_types.h linux-2.6.39.1/arch/avr32/include/asm/kmap_types.h
1086--- linux-2.6.39.1/arch/avr32/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
1087+++ linux-2.6.39.1/arch/avr32/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
1088@@ -22,7 +22,8 @@ D(10) KM_IRQ0,
1089 D(11) KM_IRQ1,
1090 D(12) KM_SOFTIRQ0,
1091 D(13) KM_SOFTIRQ1,
1092-D(14) KM_TYPE_NR
1093+D(14) KM_CLEARPAGE,
1094+D(15) KM_TYPE_NR
1095 };
1096
1097 #undef D
1098diff -urNp linux-2.6.39.1/arch/avr32/mm/fault.c linux-2.6.39.1/arch/avr32/mm/fault.c
1099--- linux-2.6.39.1/arch/avr32/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
1100+++ linux-2.6.39.1/arch/avr32/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
1101@@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
1102
1103 int exception_trace = 1;
1104
1105+#ifdef CONFIG_PAX_PAGEEXEC
1106+void pax_report_insns(void *pc, void *sp)
1107+{
1108+ unsigned long i;
1109+
1110+ printk(KERN_ERR "PAX: bytes at PC: ");
1111+ for (i = 0; i < 20; i++) {
1112+ unsigned char c;
1113+ if (get_user(c, (unsigned char *)pc+i))
1114+ printk(KERN_CONT "???????? ");
1115+ else
1116+ printk(KERN_CONT "%02x ", c);
1117+ }
1118+ printk("\n");
1119+}
1120+#endif
1121+
1122 /*
1123 * This routine handles page faults. It determines the address and the
1124 * problem, and then passes it off to one of the appropriate routines.
1125@@ -156,6 +173,16 @@ bad_area:
1126 up_read(&mm->mmap_sem);
1127
1128 if (user_mode(regs)) {
1129+
1130+#ifdef CONFIG_PAX_PAGEEXEC
1131+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
1132+ if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
1133+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
1134+ do_group_exit(SIGKILL);
1135+ }
1136+ }
1137+#endif
1138+
1139 if (exception_trace && printk_ratelimit())
1140 printk("%s%s[%d]: segfault at %08lx pc %08lx "
1141 "sp %08lx ecr %lu\n",
1142diff -urNp linux-2.6.39.1/arch/blackfin/kernel/kgdb.c linux-2.6.39.1/arch/blackfin/kernel/kgdb.c
1143--- linux-2.6.39.1/arch/blackfin/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
1144+++ linux-2.6.39.1/arch/blackfin/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
1145@@ -420,7 +420,7 @@ int kgdb_arch_handle_exception(int vecto
1146 return -1; /* this means that we do not want to exit from the handler */
1147 }
1148
1149-struct kgdb_arch arch_kgdb_ops = {
1150+const struct kgdb_arch arch_kgdb_ops = {
1151 .gdb_bpt_instr = {0xa1},
1152 .flags = KGDB_HW_BREAKPOINT,
1153 .set_hw_breakpoint = bfin_set_hw_break,
1154diff -urNp linux-2.6.39.1/arch/blackfin/mm/maccess.c linux-2.6.39.1/arch/blackfin/mm/maccess.c
1155--- linux-2.6.39.1/arch/blackfin/mm/maccess.c 2011-05-19 00:06:34.000000000 -0400
1156+++ linux-2.6.39.1/arch/blackfin/mm/maccess.c 2011-05-22 19:36:30.000000000 -0400
1157@@ -16,7 +16,7 @@ static int validate_memory_access_addres
1158 return bfin_mem_access_type(addr, size);
1159 }
1160
1161-long probe_kernel_read(void *dst, void *src, size_t size)
1162+long probe_kernel_read(void *dst, const void *src, size_t size)
1163 {
1164 unsigned long lsrc = (unsigned long)src;
1165 int mem_type;
1166@@ -55,7 +55,7 @@ long probe_kernel_read(void *dst, void *
1167 return -EFAULT;
1168 }
1169
1170-long probe_kernel_write(void *dst, void *src, size_t size)
1171+long probe_kernel_write(void *dst, const void *src, size_t size)
1172 {
1173 unsigned long ldst = (unsigned long)dst;
1174 int mem_type;
1175diff -urNp linux-2.6.39.1/arch/frv/include/asm/kmap_types.h linux-2.6.39.1/arch/frv/include/asm/kmap_types.h
1176--- linux-2.6.39.1/arch/frv/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
1177+++ linux-2.6.39.1/arch/frv/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
1178@@ -23,6 +23,7 @@ enum km_type {
1179 KM_IRQ1,
1180 KM_SOFTIRQ0,
1181 KM_SOFTIRQ1,
1182+ KM_CLEARPAGE,
1183 KM_TYPE_NR
1184 };
1185
1186diff -urNp linux-2.6.39.1/arch/frv/mb93090-mb00/pci-frv.h linux-2.6.39.1/arch/frv/mb93090-mb00/pci-frv.h
1187--- linux-2.6.39.1/arch/frv/mb93090-mb00/pci-frv.h 2011-05-19 00:06:34.000000000 -0400
1188+++ linux-2.6.39.1/arch/frv/mb93090-mb00/pci-frv.h 2011-05-22 19:36:30.000000000 -0400
1189@@ -34,7 +34,7 @@ void pcibios_resource_survey(void);
1190
1191 extern int __nongpreldata pcibios_last_bus;
1192 extern struct pci_bus *__nongpreldata pci_root_bus;
1193-extern struct pci_ops *__nongpreldata pci_root_ops;
1194+extern const struct pci_ops *__nongpreldata pci_root_ops;
1195
1196 /* pci-irq.c */
1197 extern unsigned int pcibios_irq_mask;
1198diff -urNp linux-2.6.39.1/arch/frv/mb93090-mb00/pci-vdk.c linux-2.6.39.1/arch/frv/mb93090-mb00/pci-vdk.c
1199--- linux-2.6.39.1/arch/frv/mb93090-mb00/pci-vdk.c 2011-05-19 00:06:34.000000000 -0400
1200+++ linux-2.6.39.1/arch/frv/mb93090-mb00/pci-vdk.c 2011-05-22 19:36:30.000000000 -0400
1201@@ -27,7 +27,7 @@ unsigned int __nongpreldata pci_probe =
1202
1203 int __nongpreldata pcibios_last_bus = -1;
1204 struct pci_bus *__nongpreldata pci_root_bus;
1205-struct pci_ops *__nongpreldata pci_root_ops;
1206+const struct pci_ops *__nongpreldata pci_root_ops;
1207
1208 /*
1209 * The accessible PCI window does not cover the entire CPU address space, but
1210@@ -169,7 +169,7 @@ static int pci_frv_write_config(struct p
1211 return PCIBIOS_SUCCESSFUL;
1212 }
1213
1214-static struct pci_ops pci_direct_frv = {
1215+static const struct pci_ops pci_direct_frv = {
1216 pci_frv_read_config,
1217 pci_frv_write_config,
1218 };
1219@@ -356,7 +356,7 @@ void __init pcibios_fixup_bus(struct pci
1220
1221 int __init pcibios_init(void)
1222 {
1223- struct pci_ops *dir = NULL;
1224+ const struct pci_ops *dir = NULL;
1225
1226 if (!mb93090_mb00_detected)
1227 return -ENXIO;
1228diff -urNp linux-2.6.39.1/arch/frv/mm/elf-fdpic.c linux-2.6.39.1/arch/frv/mm/elf-fdpic.c
1229--- linux-2.6.39.1/arch/frv/mm/elf-fdpic.c 2011-05-19 00:06:34.000000000 -0400
1230+++ linux-2.6.39.1/arch/frv/mm/elf-fdpic.c 2011-05-22 19:36:30.000000000 -0400
1231@@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(str
1232 if (addr) {
1233 addr = PAGE_ALIGN(addr);
1234 vma = find_vma(current->mm, addr);
1235- if (TASK_SIZE - len >= addr &&
1236- (!vma || addr + len <= vma->vm_start))
1237+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1238 goto success;
1239 }
1240
1241@@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(str
1242 for (; vma; vma = vma->vm_next) {
1243 if (addr > limit)
1244 break;
1245- if (addr + len <= vma->vm_start)
1246+ if (check_heap_stack_gap(vma, addr, len))
1247 goto success;
1248 addr = vma->vm_end;
1249 }
1250@@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(str
1251 for (; vma; vma = vma->vm_next) {
1252 if (addr > limit)
1253 break;
1254- if (addr + len <= vma->vm_start)
1255+ if (check_heap_stack_gap(vma, addr, len))
1256 goto success;
1257 addr = vma->vm_end;
1258 }
1259diff -urNp linux-2.6.39.1/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.39.1/arch/ia64/hp/common/hwsw_iommu.c
1260--- linux-2.6.39.1/arch/ia64/hp/common/hwsw_iommu.c 2011-05-19 00:06:34.000000000 -0400
1261+++ linux-2.6.39.1/arch/ia64/hp/common/hwsw_iommu.c 2011-05-22 19:36:30.000000000 -0400
1262@@ -17,7 +17,7 @@
1263 #include <linux/swiotlb.h>
1264 #include <asm/machvec.h>
1265
1266-extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
1267+extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
1268
1269 /* swiotlb declarations & definitions: */
1270 extern int swiotlb_late_init_with_default_size (size_t size);
1271@@ -33,7 +33,7 @@ static inline int use_swiotlb(struct dev
1272 !sba_dma_ops.dma_supported(dev, *dev->dma_mask);
1273 }
1274
1275-struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
1276+const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
1277 {
1278 if (use_swiotlb(dev))
1279 return &swiotlb_dma_ops;
1280diff -urNp linux-2.6.39.1/arch/ia64/hp/common/sba_iommu.c linux-2.6.39.1/arch/ia64/hp/common/sba_iommu.c
1281--- linux-2.6.39.1/arch/ia64/hp/common/sba_iommu.c 2011-05-19 00:06:34.000000000 -0400
1282+++ linux-2.6.39.1/arch/ia64/hp/common/sba_iommu.c 2011-05-22 19:36:30.000000000 -0400
1283@@ -2097,7 +2097,7 @@ static struct acpi_driver acpi_sba_ioc_d
1284 },
1285 };
1286
1287-extern struct dma_map_ops swiotlb_dma_ops;
1288+extern const struct dma_map_ops swiotlb_dma_ops;
1289
1290 static int __init
1291 sba_init(void)
1292@@ -2211,7 +2211,7 @@ sba_page_override(char *str)
1293
1294 __setup("sbapagesize=",sba_page_override);
1295
1296-struct dma_map_ops sba_dma_ops = {
1297+const struct dma_map_ops sba_dma_ops = {
1298 .alloc_coherent = sba_alloc_coherent,
1299 .free_coherent = sba_free_coherent,
1300 .map_page = sba_map_page,
1301diff -urNp linux-2.6.39.1/arch/ia64/include/asm/dma-mapping.h linux-2.6.39.1/arch/ia64/include/asm/dma-mapping.h
1302--- linux-2.6.39.1/arch/ia64/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
1303+++ linux-2.6.39.1/arch/ia64/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
1304@@ -14,7 +14,7 @@
1305
1306 #define DMA_ERROR_CODE 0
1307
1308-extern struct dma_map_ops *dma_ops;
1309+extern const struct dma_map_ops *dma_ops;
1310 extern struct ia64_machine_vector ia64_mv;
1311 extern void set_iommu_machvec(void);
1312
1313@@ -26,7 +26,7 @@ extern void machvec_dma_sync_sg(struct d
1314 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
1315 dma_addr_t *daddr, gfp_t gfp)
1316 {
1317- struct dma_map_ops *ops = platform_dma_get_ops(dev);
1318+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1319 void *caddr;
1320
1321 caddr = ops->alloc_coherent(dev, size, daddr, gfp);
1322@@ -37,7 +37,7 @@ static inline void *dma_alloc_coherent(s
1323 static inline void dma_free_coherent(struct device *dev, size_t size,
1324 void *caddr, dma_addr_t daddr)
1325 {
1326- struct dma_map_ops *ops = platform_dma_get_ops(dev);
1327+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1328 debug_dma_free_coherent(dev, size, caddr, daddr);
1329 ops->free_coherent(dev, size, caddr, daddr);
1330 }
1331@@ -51,13 +51,13 @@ static inline void dma_free_coherent(str
1332
1333 static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
1334 {
1335- struct dma_map_ops *ops = platform_dma_get_ops(dev);
1336+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1337 return ops->mapping_error(dev, daddr);
1338 }
1339
1340 static inline int dma_supported(struct device *dev, u64 mask)
1341 {
1342- struct dma_map_ops *ops = platform_dma_get_ops(dev);
1343+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1344 return ops->dma_supported(dev, mask);
1345 }
1346
1347diff -urNp linux-2.6.39.1/arch/ia64/include/asm/elf.h linux-2.6.39.1/arch/ia64/include/asm/elf.h
1348--- linux-2.6.39.1/arch/ia64/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
1349+++ linux-2.6.39.1/arch/ia64/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
1350@@ -42,6 +42,13 @@
1351 */
1352 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
1353
1354+#ifdef CONFIG_PAX_ASLR
1355+#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
1356+
1357+#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1358+#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1359+#endif
1360+
1361 #define PT_IA_64_UNWIND 0x70000001
1362
1363 /* IA-64 relocations: */
1364diff -urNp linux-2.6.39.1/arch/ia64/include/asm/machvec.h linux-2.6.39.1/arch/ia64/include/asm/machvec.h
1365--- linux-2.6.39.1/arch/ia64/include/asm/machvec.h 2011-05-19 00:06:34.000000000 -0400
1366+++ linux-2.6.39.1/arch/ia64/include/asm/machvec.h 2011-05-22 19:36:30.000000000 -0400
1367@@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
1368 /* DMA-mapping interface: */
1369 typedef void ia64_mv_dma_init (void);
1370 typedef u64 ia64_mv_dma_get_required_mask (struct device *);
1371-typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
1372+typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
1373
1374 /*
1375 * WARNING: The legacy I/O space is _architected_. Platforms are
1376@@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(co
1377 # endif /* CONFIG_IA64_GENERIC */
1378
1379 extern void swiotlb_dma_init(void);
1380-extern struct dma_map_ops *dma_get_ops(struct device *);
1381+extern const struct dma_map_ops *dma_get_ops(struct device *);
1382
1383 /*
1384 * Define default versions so we can extend machvec for new platforms without having
1385diff -urNp linux-2.6.39.1/arch/ia64/include/asm/pgtable.h linux-2.6.39.1/arch/ia64/include/asm/pgtable.h
1386--- linux-2.6.39.1/arch/ia64/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
1387+++ linux-2.6.39.1/arch/ia64/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
1388@@ -12,7 +12,7 @@
1389 * David Mosberger-Tang <davidm@hpl.hp.com>
1390 */
1391
1392-
1393+#include <linux/const.h>
1394 #include <asm/mman.h>
1395 #include <asm/page.h>
1396 #include <asm/processor.h>
1397@@ -143,6 +143,17 @@
1398 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1399 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1400 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
1401+
1402+#ifdef CONFIG_PAX_PAGEEXEC
1403+# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
1404+# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1405+# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1406+#else
1407+# define PAGE_SHARED_NOEXEC PAGE_SHARED
1408+# define PAGE_READONLY_NOEXEC PAGE_READONLY
1409+# define PAGE_COPY_NOEXEC PAGE_COPY
1410+#endif
1411+
1412 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
1413 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
1414 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
1415diff -urNp linux-2.6.39.1/arch/ia64/include/asm/spinlock.h linux-2.6.39.1/arch/ia64/include/asm/spinlock.h
1416--- linux-2.6.39.1/arch/ia64/include/asm/spinlock.h 2011-05-19 00:06:34.000000000 -0400
1417+++ linux-2.6.39.1/arch/ia64/include/asm/spinlock.h 2011-05-22 19:36:30.000000000 -0400
1418@@ -72,7 +72,7 @@ static __always_inline void __ticket_spi
1419 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
1420
1421 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
1422- ACCESS_ONCE(*p) = (tmp + 2) & ~1;
1423+ ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
1424 }
1425
1426 static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
1427diff -urNp linux-2.6.39.1/arch/ia64/include/asm/uaccess.h linux-2.6.39.1/arch/ia64/include/asm/uaccess.h
1428--- linux-2.6.39.1/arch/ia64/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
1429+++ linux-2.6.39.1/arch/ia64/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
1430@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
1431 const void *__cu_from = (from); \
1432 long __cu_len = (n); \
1433 \
1434- if (__access_ok(__cu_to, __cu_len, get_fs())) \
1435+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \
1436 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
1437 __cu_len; \
1438 })
1439@@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
1440 long __cu_len = (n); \
1441 \
1442 __chk_user_ptr(__cu_from); \
1443- if (__access_ok(__cu_from, __cu_len, get_fs())) \
1444+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \
1445 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
1446 __cu_len; \
1447 })
1448diff -urNp linux-2.6.39.1/arch/ia64/kernel/dma-mapping.c linux-2.6.39.1/arch/ia64/kernel/dma-mapping.c
1449--- linux-2.6.39.1/arch/ia64/kernel/dma-mapping.c 2011-05-19 00:06:34.000000000 -0400
1450+++ linux-2.6.39.1/arch/ia64/kernel/dma-mapping.c 2011-05-22 19:36:30.000000000 -0400
1451@@ -3,7 +3,7 @@
1452 /* Set this to 1 if there is a HW IOMMU in the system */
1453 int iommu_detected __read_mostly;
1454
1455-struct dma_map_ops *dma_ops;
1456+const struct dma_map_ops *dma_ops;
1457 EXPORT_SYMBOL(dma_ops);
1458
1459 #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
1460@@ -16,7 +16,7 @@ static int __init dma_init(void)
1461 }
1462 fs_initcall(dma_init);
1463
1464-struct dma_map_ops *dma_get_ops(struct device *dev)
1465+const struct dma_map_ops *dma_get_ops(struct device *dev)
1466 {
1467 return dma_ops;
1468 }
1469diff -urNp linux-2.6.39.1/arch/ia64/kernel/module.c linux-2.6.39.1/arch/ia64/kernel/module.c
1470--- linux-2.6.39.1/arch/ia64/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
1471+++ linux-2.6.39.1/arch/ia64/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
1472@@ -315,8 +315,7 @@ module_alloc (unsigned long size)
1473 void
1474 module_free (struct module *mod, void *module_region)
1475 {
1476- if (mod && mod->arch.init_unw_table &&
1477- module_region == mod->module_init) {
1478+ if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
1479 unw_remove_unwind_table(mod->arch.init_unw_table);
1480 mod->arch.init_unw_table = NULL;
1481 }
1482@@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
1483 }
1484
1485 static inline int
1486+in_init_rx (const struct module *mod, uint64_t addr)
1487+{
1488+ return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
1489+}
1490+
1491+static inline int
1492+in_init_rw (const struct module *mod, uint64_t addr)
1493+{
1494+ return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
1495+}
1496+
1497+static inline int
1498 in_init (const struct module *mod, uint64_t addr)
1499 {
1500- return addr - (uint64_t) mod->module_init < mod->init_size;
1501+ return in_init_rx(mod, addr) || in_init_rw(mod, addr);
1502+}
1503+
1504+static inline int
1505+in_core_rx (const struct module *mod, uint64_t addr)
1506+{
1507+ return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
1508+}
1509+
1510+static inline int
1511+in_core_rw (const struct module *mod, uint64_t addr)
1512+{
1513+ return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
1514 }
1515
1516 static inline int
1517 in_core (const struct module *mod, uint64_t addr)
1518 {
1519- return addr - (uint64_t) mod->module_core < mod->core_size;
1520+ return in_core_rx(mod, addr) || in_core_rw(mod, addr);
1521 }
1522
1523 static inline int
1524@@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
1525 break;
1526
1527 case RV_BDREL:
1528- val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
1529+ if (in_init_rx(mod, val))
1530+ val -= (uint64_t) mod->module_init_rx;
1531+ else if (in_init_rw(mod, val))
1532+ val -= (uint64_t) mod->module_init_rw;
1533+ else if (in_core_rx(mod, val))
1534+ val -= (uint64_t) mod->module_core_rx;
1535+ else if (in_core_rw(mod, val))
1536+ val -= (uint64_t) mod->module_core_rw;
1537 break;
1538
1539 case RV_LTV:
1540@@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
1541 * addresses have been selected...
1542 */
1543 uint64_t gp;
1544- if (mod->core_size > MAX_LTOFF)
1545+ if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
1546 /*
1547 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
1548 * at the end of the module.
1549 */
1550- gp = mod->core_size - MAX_LTOFF / 2;
1551+ gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
1552 else
1553- gp = mod->core_size / 2;
1554- gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
1555+ gp = (mod->core_size_rx + mod->core_size_rw) / 2;
1556+ gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
1557 mod->arch.gp = gp;
1558 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
1559 }
1560diff -urNp linux-2.6.39.1/arch/ia64/kernel/pci-dma.c linux-2.6.39.1/arch/ia64/kernel/pci-dma.c
1561--- linux-2.6.39.1/arch/ia64/kernel/pci-dma.c 2011-05-19 00:06:34.000000000 -0400
1562+++ linux-2.6.39.1/arch/ia64/kernel/pci-dma.c 2011-05-22 19:36:30.000000000 -0400
1563@@ -43,7 +43,7 @@ struct device fallback_dev = {
1564 .dma_mask = &fallback_dev.coherent_dma_mask,
1565 };
1566
1567-extern struct dma_map_ops intel_dma_ops;
1568+extern const struct dma_map_ops intel_dma_ops;
1569
1570 static int __init pci_iommu_init(void)
1571 {
1572diff -urNp linux-2.6.39.1/arch/ia64/kernel/pci-swiotlb.c linux-2.6.39.1/arch/ia64/kernel/pci-swiotlb.c
1573--- linux-2.6.39.1/arch/ia64/kernel/pci-swiotlb.c 2011-05-19 00:06:34.000000000 -0400
1574+++ linux-2.6.39.1/arch/ia64/kernel/pci-swiotlb.c 2011-05-22 19:36:30.000000000 -0400
1575@@ -22,7 +22,7 @@ static void *ia64_swiotlb_alloc_coherent
1576 return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
1577 }
1578
1579-struct dma_map_ops swiotlb_dma_ops = {
1580+const struct dma_map_ops swiotlb_dma_ops = {
1581 .alloc_coherent = ia64_swiotlb_alloc_coherent,
1582 .free_coherent = swiotlb_free_coherent,
1583 .map_page = swiotlb_map_page,
1584diff -urNp linux-2.6.39.1/arch/ia64/kernel/sys_ia64.c linux-2.6.39.1/arch/ia64/kernel/sys_ia64.c
1585--- linux-2.6.39.1/arch/ia64/kernel/sys_ia64.c 2011-05-19 00:06:34.000000000 -0400
1586+++ linux-2.6.39.1/arch/ia64/kernel/sys_ia64.c 2011-05-22 19:36:30.000000000 -0400
1587@@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
1588 if (REGION_NUMBER(addr) == RGN_HPAGE)
1589 addr = 0;
1590 #endif
1591+
1592+#ifdef CONFIG_PAX_RANDMMAP
1593+ if (mm->pax_flags & MF_PAX_RANDMMAP)
1594+ addr = mm->free_area_cache;
1595+ else
1596+#endif
1597+
1598 if (!addr)
1599 addr = mm->free_area_cache;
1600
1601@@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *fil
1602 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
1603 /* At this point: (!vma || addr < vma->vm_end). */
1604 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
1605- if (start_addr != TASK_UNMAPPED_BASE) {
1606+ if (start_addr != mm->mmap_base) {
1607 /* Start a new search --- just in case we missed some holes. */
1608- addr = TASK_UNMAPPED_BASE;
1609+ addr = mm->mmap_base;
1610 goto full_search;
1611 }
1612 return -ENOMEM;
1613 }
1614- if (!vma || addr + len <= vma->vm_start) {
1615+ if (check_heap_stack_gap(vma, addr, len)) {
1616 /* Remember the address where we stopped this search: */
1617 mm->free_area_cache = addr + len;
1618 return addr;
1619diff -urNp linux-2.6.39.1/arch/ia64/kernel/vmlinux.lds.S linux-2.6.39.1/arch/ia64/kernel/vmlinux.lds.S
1620--- linux-2.6.39.1/arch/ia64/kernel/vmlinux.lds.S 2011-05-19 00:06:34.000000000 -0400
1621+++ linux-2.6.39.1/arch/ia64/kernel/vmlinux.lds.S 2011-05-22 19:36:30.000000000 -0400
1622@@ -199,7 +199,7 @@ SECTIONS {
1623 /* Per-cpu data: */
1624 . = ALIGN(PERCPU_PAGE_SIZE);
1625 PERCPU_VADDR(SMP_CACHE_BYTES, PERCPU_ADDR, :percpu)
1626- __phys_per_cpu_start = __per_cpu_load;
1627+ __phys_per_cpu_start = per_cpu_load;
1628 /*
1629 * ensure percpu data fits
1630 * into percpu page size
1631diff -urNp linux-2.6.39.1/arch/ia64/mm/fault.c linux-2.6.39.1/arch/ia64/mm/fault.c
1632--- linux-2.6.39.1/arch/ia64/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
1633+++ linux-2.6.39.1/arch/ia64/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
1634@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned
1635 return pte_present(pte);
1636 }
1637
1638+#ifdef CONFIG_PAX_PAGEEXEC
1639+void pax_report_insns(void *pc, void *sp)
1640+{
1641+ unsigned long i;
1642+
1643+ printk(KERN_ERR "PAX: bytes at PC: ");
1644+ for (i = 0; i < 8; i++) {
1645+ unsigned int c;
1646+ if (get_user(c, (unsigned int *)pc+i))
1647+ printk(KERN_CONT "???????? ");
1648+ else
1649+ printk(KERN_CONT "%08x ", c);
1650+ }
1651+ printk("\n");
1652+}
1653+#endif
1654+
1655 void __kprobes
1656 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
1657 {
1658@@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long addres
1659 mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
1660 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
1661
1662- if ((vma->vm_flags & mask) != mask)
1663+ if ((vma->vm_flags & mask) != mask) {
1664+
1665+#ifdef CONFIG_PAX_PAGEEXEC
1666+ if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
1667+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
1668+ goto bad_area;
1669+
1670+ up_read(&mm->mmap_sem);
1671+ pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
1672+ do_group_exit(SIGKILL);
1673+ }
1674+#endif
1675+
1676 goto bad_area;
1677
1678+ }
1679+
1680 /*
1681 * If for any reason at all we couldn't handle the fault, make
1682 * sure we exit gracefully rather than endlessly redo the
1683diff -urNp linux-2.6.39.1/arch/ia64/mm/hugetlbpage.c linux-2.6.39.1/arch/ia64/mm/hugetlbpage.c
1684--- linux-2.6.39.1/arch/ia64/mm/hugetlbpage.c 2011-05-19 00:06:34.000000000 -0400
1685+++ linux-2.6.39.1/arch/ia64/mm/hugetlbpage.c 2011-05-22 19:36:30.000000000 -0400
1686@@ -171,7 +171,7 @@ unsigned long hugetlb_get_unmapped_area(
1687 /* At this point: (!vmm || addr < vmm->vm_end). */
1688 if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
1689 return -ENOMEM;
1690- if (!vmm || (addr + len) <= vmm->vm_start)
1691+ if (check_heap_stack_gap(vmm, addr, len))
1692 return addr;
1693 addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
1694 }
1695diff -urNp linux-2.6.39.1/arch/ia64/mm/init.c linux-2.6.39.1/arch/ia64/mm/init.c
1696--- linux-2.6.39.1/arch/ia64/mm/init.c 2011-05-19 00:06:34.000000000 -0400
1697+++ linux-2.6.39.1/arch/ia64/mm/init.c 2011-05-22 19:36:30.000000000 -0400
1698@@ -122,6 +122,19 @@ ia64_init_addr_space (void)
1699 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
1700 vma->vm_end = vma->vm_start + PAGE_SIZE;
1701 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
1702+
1703+#ifdef CONFIG_PAX_PAGEEXEC
1704+ if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
1705+ vma->vm_flags &= ~VM_EXEC;
1706+
1707+#ifdef CONFIG_PAX_MPROTECT
1708+ if (current->mm->pax_flags & MF_PAX_MPROTECT)
1709+ vma->vm_flags &= ~VM_MAYEXEC;
1710+#endif
1711+
1712+ }
1713+#endif
1714+
1715 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
1716 down_write(&current->mm->mmap_sem);
1717 if (insert_vm_struct(current->mm, vma)) {
1718diff -urNp linux-2.6.39.1/arch/ia64/pci/pci.c linux-2.6.39.1/arch/ia64/pci/pci.c
1719--- linux-2.6.39.1/arch/ia64/pci/pci.c 2011-05-19 00:06:34.000000000 -0400
1720+++ linux-2.6.39.1/arch/ia64/pci/pci.c 2011-05-22 19:36:30.000000000 -0400
1721@@ -109,7 +109,7 @@ static int pci_write(struct pci_bus *bus
1722 devfn, where, size, value);
1723 }
1724
1725-struct pci_ops pci_root_ops = {
1726+const struct pci_ops pci_root_ops = {
1727 .read = pci_read,
1728 .write = pci_write,
1729 };
1730diff -urNp linux-2.6.39.1/arch/ia64/sn/pci/pci_dma.c linux-2.6.39.1/arch/ia64/sn/pci/pci_dma.c
1731--- linux-2.6.39.1/arch/ia64/sn/pci/pci_dma.c 2011-05-19 00:06:34.000000000 -0400
1732+++ linux-2.6.39.1/arch/ia64/sn/pci/pci_dma.c 2011-05-22 19:36:30.000000000 -0400
1733@@ -465,7 +465,7 @@ int sn_pci_legacy_write(struct pci_bus *
1734 return ret;
1735 }
1736
1737-static struct dma_map_ops sn_dma_ops = {
1738+static const struct dma_map_ops sn_dma_ops = {
1739 .alloc_coherent = sn_dma_alloc_coherent,
1740 .free_coherent = sn_dma_free_coherent,
1741 .map_page = sn_dma_map_page,
1742diff -urNp linux-2.6.39.1/arch/m32r/lib/usercopy.c linux-2.6.39.1/arch/m32r/lib/usercopy.c
1743--- linux-2.6.39.1/arch/m32r/lib/usercopy.c 2011-05-19 00:06:34.000000000 -0400
1744+++ linux-2.6.39.1/arch/m32r/lib/usercopy.c 2011-05-22 19:36:30.000000000 -0400
1745@@ -14,6 +14,9 @@
1746 unsigned long
1747 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1748 {
1749+ if ((long)n < 0)
1750+ return n;
1751+
1752 prefetch(from);
1753 if (access_ok(VERIFY_WRITE, to, n))
1754 __copy_user(to,from,n);
1755@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to,
1756 unsigned long
1757 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
1758 {
1759+ if ((long)n < 0)
1760+ return n;
1761+
1762 prefetchw(to);
1763 if (access_ok(VERIFY_READ, from, n))
1764 __copy_user_zeroing(to,from,n);
1765diff -urNp linux-2.6.39.1/arch/microblaze/include/asm/device.h linux-2.6.39.1/arch/microblaze/include/asm/device.h
1766--- linux-2.6.39.1/arch/microblaze/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
1767+++ linux-2.6.39.1/arch/microblaze/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
1768@@ -13,7 +13,7 @@ struct device_node;
1769
1770 struct dev_archdata {
1771 /* DMA operations on that device */
1772- struct dma_map_ops *dma_ops;
1773+ const struct dma_map_ops *dma_ops;
1774 void *dma_data;
1775 };
1776
1777diff -urNp linux-2.6.39.1/arch/microblaze/include/asm/dma-mapping.h linux-2.6.39.1/arch/microblaze/include/asm/dma-mapping.h
1778--- linux-2.6.39.1/arch/microblaze/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
1779+++ linux-2.6.39.1/arch/microblaze/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
1780@@ -43,14 +43,14 @@ static inline unsigned long device_to_ma
1781 return 0xfffffffful;
1782 }
1783
1784-extern struct dma_map_ops *dma_ops;
1785+extern const struct dma_map_ops *dma_ops;
1786
1787 /*
1788 * Available generic sets of operations
1789 */
1790-extern struct dma_map_ops dma_direct_ops;
1791+extern const struct dma_map_ops dma_direct_ops;
1792
1793-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
1794+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
1795 {
1796 /* We don't handle the NULL dev case for ISA for now. We could
1797 * do it via an out of line call but it is not needed for now. The
1798@@ -63,14 +63,14 @@ static inline struct dma_map_ops *get_dm
1799 return dev->archdata.dma_ops;
1800 }
1801
1802-static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
1803+static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
1804 {
1805 dev->archdata.dma_ops = ops;
1806 }
1807
1808 static inline int dma_supported(struct device *dev, u64 mask)
1809 {
1810- struct dma_map_ops *ops = get_dma_ops(dev);
1811+ const struct dma_map_ops *ops = get_dma_ops(dev);
1812
1813 if (unlikely(!ops))
1814 return 0;
1815@@ -81,7 +81,7 @@ static inline int dma_supported(struct d
1816
1817 static inline int dma_set_mask(struct device *dev, u64 dma_mask)
1818 {
1819- struct dma_map_ops *ops = get_dma_ops(dev);
1820+ const struct dma_map_ops *ops = get_dma_ops(dev);
1821
1822 if (unlikely(ops == NULL))
1823 return -EIO;
1824@@ -97,7 +97,7 @@ static inline int dma_set_mask(struct de
1825
1826 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
1827 {
1828- struct dma_map_ops *ops = get_dma_ops(dev);
1829+ const struct dma_map_ops *ops = get_dma_ops(dev);
1830 if (ops->mapping_error)
1831 return ops->mapping_error(dev, dma_addr);
1832
1833@@ -110,7 +110,7 @@ static inline int dma_mapping_error(stru
1834 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
1835 dma_addr_t *dma_handle, gfp_t flag)
1836 {
1837- struct dma_map_ops *ops = get_dma_ops(dev);
1838+ const struct dma_map_ops *ops = get_dma_ops(dev);
1839 void *memory;
1840
1841 BUG_ON(!ops);
1842@@ -124,7 +124,7 @@ static inline void *dma_alloc_coherent(s
1843 static inline void dma_free_coherent(struct device *dev, size_t size,
1844 void *cpu_addr, dma_addr_t dma_handle)
1845 {
1846- struct dma_map_ops *ops = get_dma_ops(dev);
1847+ const struct dma_map_ops *ops = get_dma_ops(dev);
1848
1849 BUG_ON(!ops);
1850 debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
1851diff -urNp linux-2.6.39.1/arch/microblaze/include/asm/pci.h linux-2.6.39.1/arch/microblaze/include/asm/pci.h
1852--- linux-2.6.39.1/arch/microblaze/include/asm/pci.h 2011-05-19 00:06:34.000000000 -0400
1853+++ linux-2.6.39.1/arch/microblaze/include/asm/pci.h 2011-05-22 19:36:30.000000000 -0400
1854@@ -54,8 +54,8 @@ static inline void pcibios_penalize_isa_
1855 }
1856
1857 #ifdef CONFIG_PCI
1858-extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
1859-extern struct dma_map_ops *get_pci_dma_ops(void);
1860+extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
1861+extern const struct dma_map_ops *get_pci_dma_ops(void);
1862 #else /* CONFIG_PCI */
1863 #define set_pci_dma_ops(d)
1864 #define get_pci_dma_ops() NULL
1865diff -urNp linux-2.6.39.1/arch/microblaze/kernel/dma.c linux-2.6.39.1/arch/microblaze/kernel/dma.c
1866--- linux-2.6.39.1/arch/microblaze/kernel/dma.c 2011-05-19 00:06:34.000000000 -0400
1867+++ linux-2.6.39.1/arch/microblaze/kernel/dma.c 2011-05-22 19:36:30.000000000 -0400
1868@@ -134,7 +134,7 @@ static inline void dma_direct_unmap_page
1869 __dma_sync_page(dma_address, 0 , size, direction);
1870 }
1871
1872-struct dma_map_ops dma_direct_ops = {
1873+const struct dma_map_ops dma_direct_ops = {
1874 .alloc_coherent = dma_direct_alloc_coherent,
1875 .free_coherent = dma_direct_free_coherent,
1876 .map_sg = dma_direct_map_sg,
1877diff -urNp linux-2.6.39.1/arch/microblaze/kernel/kgdb.c linux-2.6.39.1/arch/microblaze/kernel/kgdb.c
1878--- linux-2.6.39.1/arch/microblaze/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
1879+++ linux-2.6.39.1/arch/microblaze/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
1880@@ -141,7 +141,7 @@ void kgdb_arch_exit(void)
1881 /*
1882 * Global data
1883 */
1884-struct kgdb_arch arch_kgdb_ops = {
1885+const struct kgdb_arch arch_kgdb_ops = {
1886 #ifdef __MICROBLAZEEL__
1887 .gdb_bpt_instr = {0x18, 0x00, 0x0c, 0xba}, /* brki r16, 0x18 */
1888 #else
1889diff -urNp linux-2.6.39.1/arch/microblaze/pci/indirect_pci.c linux-2.6.39.1/arch/microblaze/pci/indirect_pci.c
1890--- linux-2.6.39.1/arch/microblaze/pci/indirect_pci.c 2011-05-19 00:06:34.000000000 -0400
1891+++ linux-2.6.39.1/arch/microblaze/pci/indirect_pci.c 2011-05-22 19:36:30.000000000 -0400
1892@@ -140,7 +140,7 @@ indirect_write_config(struct pci_bus *bu
1893 return PCIBIOS_SUCCESSFUL;
1894 }
1895
1896-static struct pci_ops indirect_pci_ops = {
1897+static const struct pci_ops indirect_pci_ops = {
1898 .read = indirect_read_config,
1899 .write = indirect_write_config,
1900 };
1901diff -urNp linux-2.6.39.1/arch/microblaze/pci/pci-common.c linux-2.6.39.1/arch/microblaze/pci/pci-common.c
1902--- linux-2.6.39.1/arch/microblaze/pci/pci-common.c 2011-05-19 00:06:34.000000000 -0400
1903+++ linux-2.6.39.1/arch/microblaze/pci/pci-common.c 2011-05-22 19:36:30.000000000 -0400
1904@@ -48,14 +48,14 @@ resource_size_t isa_mem_base;
1905 /* Default PCI flags is 0 on ppc32, modified at boot on ppc64 */
1906 unsigned int pci_flags;
1907
1908-static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
1909+static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
1910
1911-void set_pci_dma_ops(struct dma_map_ops *dma_ops)
1912+void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
1913 {
1914 pci_dma_ops = dma_ops;
1915 }
1916
1917-struct dma_map_ops *get_pci_dma_ops(void)
1918+const struct dma_map_ops *get_pci_dma_ops(void)
1919 {
1920 return pci_dma_ops;
1921 }
1922@@ -1583,7 +1583,7 @@ null_write_config(struct pci_bus *bus, u
1923 return PCIBIOS_DEVICE_NOT_FOUND;
1924 }
1925
1926-static struct pci_ops null_pci_ops = {
1927+static const struct pci_ops null_pci_ops = {
1928 .read = null_read_config,
1929 .write = null_write_config,
1930 };
1931diff -urNp linux-2.6.39.1/arch/mips/alchemy/common/pci.c linux-2.6.39.1/arch/mips/alchemy/common/pci.c
1932--- linux-2.6.39.1/arch/mips/alchemy/common/pci.c 2011-05-19 00:06:34.000000000 -0400
1933+++ linux-2.6.39.1/arch/mips/alchemy/common/pci.c 2011-05-22 19:36:30.000000000 -0400
1934@@ -51,7 +51,7 @@ static struct resource pci_mem_resource
1935 .flags = IORESOURCE_MEM
1936 };
1937
1938-extern struct pci_ops au1x_pci_ops;
1939+extern const struct pci_ops au1x_pci_ops;
1940
1941 static struct pci_controller au1x_controller = {
1942 .pci_ops = &au1x_pci_ops,
1943diff -urNp linux-2.6.39.1/arch/mips/cavium-octeon/dma-octeon.c linux-2.6.39.1/arch/mips/cavium-octeon/dma-octeon.c
1944--- linux-2.6.39.1/arch/mips/cavium-octeon/dma-octeon.c 2011-05-19 00:06:34.000000000 -0400
1945+++ linux-2.6.39.1/arch/mips/cavium-octeon/dma-octeon.c 2011-05-22 19:36:30.000000000 -0400
1946@@ -202,7 +202,7 @@ static phys_addr_t octeon_unity_dma_to_p
1947 }
1948
1949 struct octeon_dma_map_ops {
1950- struct dma_map_ops dma_map_ops;
1951+ const struct dma_map_ops dma_map_ops;
1952 dma_addr_t (*phys_to_dma)(struct device *dev, phys_addr_t paddr);
1953 phys_addr_t (*dma_to_phys)(struct device *dev, dma_addr_t daddr);
1954 };
1955@@ -324,7 +324,7 @@ static struct octeon_dma_map_ops _octeon
1956 },
1957 };
1958
1959-struct dma_map_ops *octeon_pci_dma_map_ops;
1960+const struct dma_map_ops *octeon_pci_dma_map_ops;
1961
1962 void __init octeon_pci_dma_init(void)
1963 {
1964diff -urNp linux-2.6.39.1/arch/mips/cobalt/pci.c linux-2.6.39.1/arch/mips/cobalt/pci.c
1965--- linux-2.6.39.1/arch/mips/cobalt/pci.c 2011-05-19 00:06:34.000000000 -0400
1966+++ linux-2.6.39.1/arch/mips/cobalt/pci.c 2011-05-22 19:36:30.000000000 -0400
1967@@ -14,7 +14,7 @@
1968
1969 #include <asm/gt64120.h>
1970
1971-extern struct pci_ops gt64xxx_pci0_ops;
1972+extern const struct pci_ops gt64xxx_pci0_ops;
1973
1974 static struct resource cobalt_mem_resource = {
1975 .start = GT_DEF_PCI0_MEM0_BASE,
1976diff -urNp linux-2.6.39.1/arch/mips/include/asm/device.h linux-2.6.39.1/arch/mips/include/asm/device.h
1977--- linux-2.6.39.1/arch/mips/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
1978+++ linux-2.6.39.1/arch/mips/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
1979@@ -10,7 +10,7 @@ struct dma_map_ops;
1980
1981 struct dev_archdata {
1982 /* DMA operations on that device */
1983- struct dma_map_ops *dma_ops;
1984+ const struct dma_map_ops *dma_ops;
1985 };
1986
1987 struct pdev_archdata {
1988diff -urNp linux-2.6.39.1/arch/mips/include/asm/dma-mapping.h linux-2.6.39.1/arch/mips/include/asm/dma-mapping.h
1989--- linux-2.6.39.1/arch/mips/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
1990+++ linux-2.6.39.1/arch/mips/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
1991@@ -9,9 +9,9 @@
1992 #include <dma-coherence.h>
1993 #endif
1994
1995-extern struct dma_map_ops *mips_dma_map_ops;
1996+extern const struct dma_map_ops *mips_dma_map_ops;
1997
1998-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
1999+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
2000 {
2001 if (dev && dev->archdata.dma_ops)
2002 return dev->archdata.dma_ops;
2003@@ -33,13 +33,13 @@ static inline void dma_mark_clean(void *
2004
2005 static inline int dma_supported(struct device *dev, u64 mask)
2006 {
2007- struct dma_map_ops *ops = get_dma_ops(dev);
2008+ const struct dma_map_ops *ops = get_dma_ops(dev);
2009 return ops->dma_supported(dev, mask);
2010 }
2011
2012 static inline int dma_mapping_error(struct device *dev, u64 mask)
2013 {
2014- struct dma_map_ops *ops = get_dma_ops(dev);
2015+ const struct dma_map_ops *ops = get_dma_ops(dev);
2016 return ops->mapping_error(dev, mask);
2017 }
2018
2019@@ -61,7 +61,7 @@ static inline void *dma_alloc_coherent(s
2020 dma_addr_t *dma_handle, gfp_t gfp)
2021 {
2022 void *ret;
2023- struct dma_map_ops *ops = get_dma_ops(dev);
2024+ const struct dma_map_ops *ops = get_dma_ops(dev);
2025
2026 ret = ops->alloc_coherent(dev, size, dma_handle, gfp);
2027
2028@@ -73,7 +73,7 @@ static inline void *dma_alloc_coherent(s
2029 static inline void dma_free_coherent(struct device *dev, size_t size,
2030 void *vaddr, dma_addr_t dma_handle)
2031 {
2032- struct dma_map_ops *ops = get_dma_ops(dev);
2033+ const struct dma_map_ops *ops = get_dma_ops(dev);
2034
2035 ops->free_coherent(dev, size, vaddr, dma_handle);
2036
2037diff -urNp linux-2.6.39.1/arch/mips/include/asm/elf.h linux-2.6.39.1/arch/mips/include/asm/elf.h
2038--- linux-2.6.39.1/arch/mips/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
2039+++ linux-2.6.39.1/arch/mips/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
2040@@ -372,13 +372,16 @@ extern const char *__elf_platform;
2041 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
2042 #endif
2043
2044+#ifdef CONFIG_PAX_ASLR
2045+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
2046+
2047+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2048+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2049+#endif
2050+
2051 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
2052 struct linux_binprm;
2053 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
2054 int uses_interp);
2055
2056-struct mm_struct;
2057-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2058-#define arch_randomize_brk arch_randomize_brk
2059-
2060 #endif /* _ASM_ELF_H */
2061diff -urNp linux-2.6.39.1/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h linux-2.6.39.1/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h
2062--- linux-2.6.39.1/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h 2011-05-19 00:06:34.000000000 -0400
2063+++ linux-2.6.39.1/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h 2011-05-22 19:36:30.000000000 -0400
2064@@ -66,7 +66,7 @@ dma_addr_t phys_to_dma(struct device *de
2065 phys_addr_t dma_to_phys(struct device *dev, dma_addr_t daddr);
2066
2067 struct dma_map_ops;
2068-extern struct dma_map_ops *octeon_pci_dma_map_ops;
2069+extern const struct dma_map_ops *octeon_pci_dma_map_ops;
2070 extern char *octeon_swiotlb;
2071
2072 #endif /* __ASM_MACH_CAVIUM_OCTEON_DMA_COHERENCE_H */
2073diff -urNp linux-2.6.39.1/arch/mips/include/asm/page.h linux-2.6.39.1/arch/mips/include/asm/page.h
2074--- linux-2.6.39.1/arch/mips/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
2075+++ linux-2.6.39.1/arch/mips/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
2076@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
2077 #ifdef CONFIG_CPU_MIPS32
2078 typedef struct { unsigned long pte_low, pte_high; } pte_t;
2079 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
2080- #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
2081+ #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
2082 #else
2083 typedef struct { unsigned long long pte; } pte_t;
2084 #define pte_val(x) ((x).pte)
2085diff -urNp linux-2.6.39.1/arch/mips/include/asm/pci/bridge.h linux-2.6.39.1/arch/mips/include/asm/pci/bridge.h
2086--- linux-2.6.39.1/arch/mips/include/asm/pci/bridge.h 2011-05-19 00:06:34.000000000 -0400
2087+++ linux-2.6.39.1/arch/mips/include/asm/pci/bridge.h 2011-05-22 19:36:30.000000000 -0400
2088@@ -849,6 +849,6 @@ struct bridge_controller {
2089 extern void register_bridge_irq(unsigned int irq);
2090 extern int request_bridge_irq(struct bridge_controller *bc);
2091
2092-extern struct pci_ops bridge_pci_ops;
2093+extern const struct pci_ops bridge_pci_ops;
2094
2095 #endif /* _ASM_PCI_BRIDGE_H */
2096diff -urNp linux-2.6.39.1/arch/mips/include/asm/system.h linux-2.6.39.1/arch/mips/include/asm/system.h
2097--- linux-2.6.39.1/arch/mips/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
2098+++ linux-2.6.39.1/arch/mips/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
2099@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
2100 */
2101 #define __ARCH_WANT_UNLOCKED_CTXSW
2102
2103-extern unsigned long arch_align_stack(unsigned long sp);
2104+#define arch_align_stack(x) ((x) & ~0xfUL)
2105
2106 #endif /* _ASM_SYSTEM_H */
2107diff -urNp linux-2.6.39.1/arch/mips/kernel/binfmt_elfn32.c linux-2.6.39.1/arch/mips/kernel/binfmt_elfn32.c
2108--- linux-2.6.39.1/arch/mips/kernel/binfmt_elfn32.c 2011-05-19 00:06:34.000000000 -0400
2109+++ linux-2.6.39.1/arch/mips/kernel/binfmt_elfn32.c 2011-05-22 19:36:30.000000000 -0400
2110@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
2111 #undef ELF_ET_DYN_BASE
2112 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
2113
2114+#ifdef CONFIG_PAX_ASLR
2115+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
2116+
2117+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2118+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2119+#endif
2120+
2121 #include <asm/processor.h>
2122 #include <linux/module.h>
2123 #include <linux/elfcore.h>
2124diff -urNp linux-2.6.39.1/arch/mips/kernel/binfmt_elfo32.c linux-2.6.39.1/arch/mips/kernel/binfmt_elfo32.c
2125--- linux-2.6.39.1/arch/mips/kernel/binfmt_elfo32.c 2011-05-19 00:06:34.000000000 -0400
2126+++ linux-2.6.39.1/arch/mips/kernel/binfmt_elfo32.c 2011-05-22 19:36:30.000000000 -0400
2127@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
2128 #undef ELF_ET_DYN_BASE
2129 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
2130
2131+#ifdef CONFIG_PAX_ASLR
2132+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
2133+
2134+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2135+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2136+#endif
2137+
2138 #include <asm/processor.h>
2139
2140 /*
2141diff -urNp linux-2.6.39.1/arch/mips/kernel/kgdb.c linux-2.6.39.1/arch/mips/kernel/kgdb.c
2142--- linux-2.6.39.1/arch/mips/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
2143+++ linux-2.6.39.1/arch/mips/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
2144@@ -351,7 +351,7 @@ int kgdb_arch_handle_exception(int vecto
2145 return -1;
2146 }
2147
2148-struct kgdb_arch arch_kgdb_ops;
2149+struct kgdb_arch arch_kgdb_ops; /* cannot be const, see kgdb_arch_init */
2150
2151 /*
2152 * We use kgdb_early_setup so that functions we need to call now don't
2153diff -urNp linux-2.6.39.1/arch/mips/kernel/process.c linux-2.6.39.1/arch/mips/kernel/process.c
2154--- linux-2.6.39.1/arch/mips/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
2155+++ linux-2.6.39.1/arch/mips/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
2156@@ -473,15 +473,3 @@ unsigned long get_wchan(struct task_stru
2157 out:
2158 return pc;
2159 }
2160-
2161-/*
2162- * Don't forget that the stack pointer must be aligned on a 8 bytes
2163- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
2164- */
2165-unsigned long arch_align_stack(unsigned long sp)
2166-{
2167- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2168- sp -= get_random_int() & ~PAGE_MASK;
2169-
2170- return sp & ALMASK;
2171-}
2172diff -urNp linux-2.6.39.1/arch/mips/kernel/syscall.c linux-2.6.39.1/arch/mips/kernel/syscall.c
2173--- linux-2.6.39.1/arch/mips/kernel/syscall.c 2011-05-19 00:06:34.000000000 -0400
2174+++ linux-2.6.39.1/arch/mips/kernel/syscall.c 2011-05-22 19:36:30.000000000 -0400
2175@@ -108,14 +108,18 @@ unsigned long arch_get_unmapped_area(str
2176 do_color_align = 0;
2177 if (filp || (flags & MAP_SHARED))
2178 do_color_align = 1;
2179+
2180+#ifdef CONFIG_PAX_RANDMMAP
2181+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
2182+#endif
2183+
2184 if (addr) {
2185 if (do_color_align)
2186 addr = COLOUR_ALIGN(addr, pgoff);
2187 else
2188 addr = PAGE_ALIGN(addr);
2189 vmm = find_vma(current->mm, addr);
2190- if (task_size - len >= addr &&
2191- (!vmm || addr + len <= vmm->vm_start))
2192+ if (task_size - len >= addr && check_heap_stack_gap(vmm, addr, len))
2193 return addr;
2194 }
2195 addr = current->mm->mmap_base;
2196@@ -128,7 +132,7 @@ unsigned long arch_get_unmapped_area(str
2197 /* At this point: (!vmm || addr < vmm->vm_end). */
2198 if (task_size - len < addr)
2199 return -ENOMEM;
2200- if (!vmm || addr + len <= vmm->vm_start)
2201+ if (check_heap_stack_gap(vmm, addr, len))
2202 return addr;
2203 addr = vmm->vm_end;
2204 if (do_color_align)
2205@@ -154,33 +158,6 @@ void arch_pick_mmap_layout(struct mm_str
2206 mm->unmap_area = arch_unmap_area;
2207 }
2208
2209-static inline unsigned long brk_rnd(void)
2210-{
2211- unsigned long rnd = get_random_int();
2212-
2213- rnd = rnd << PAGE_SHIFT;
2214- /* 8MB for 32bit, 256MB for 64bit */
2215- if (TASK_IS_32BIT_ADDR)
2216- rnd = rnd & 0x7ffffful;
2217- else
2218- rnd = rnd & 0xffffffful;
2219-
2220- return rnd;
2221-}
2222-
2223-unsigned long arch_randomize_brk(struct mm_struct *mm)
2224-{
2225- unsigned long base = mm->brk;
2226- unsigned long ret;
2227-
2228- ret = PAGE_ALIGN(base + brk_rnd());
2229-
2230- if (ret < mm->brk)
2231- return mm->brk;
2232-
2233- return ret;
2234-}
2235-
2236 SYSCALL_DEFINE6(mips_mmap, unsigned long, addr, unsigned long, len,
2237 unsigned long, prot, unsigned long, flags, unsigned long,
2238 fd, off_t, offset)
2239diff -urNp linux-2.6.39.1/arch/mips/mm/dma-default.c linux-2.6.39.1/arch/mips/mm/dma-default.c
2240--- linux-2.6.39.1/arch/mips/mm/dma-default.c 2011-05-19 00:06:34.000000000 -0400
2241+++ linux-2.6.39.1/arch/mips/mm/dma-default.c 2011-05-22 19:36:30.000000000 -0400
2242@@ -300,7 +300,7 @@ void dma_cache_sync(struct device *dev,
2243
2244 EXPORT_SYMBOL(dma_cache_sync);
2245
2246-static struct dma_map_ops mips_default_dma_map_ops = {
2247+static const struct dma_map_ops mips_default_dma_map_ops = {
2248 .alloc_coherent = mips_dma_alloc_coherent,
2249 .free_coherent = mips_dma_free_coherent,
2250 .map_page = mips_dma_map_page,
2251@@ -315,7 +315,7 @@ static struct dma_map_ops mips_default_d
2252 .dma_supported = mips_dma_supported
2253 };
2254
2255-struct dma_map_ops *mips_dma_map_ops = &mips_default_dma_map_ops;
2256+const struct dma_map_ops *mips_dma_map_ops = &mips_default_dma_map_ops;
2257 EXPORT_SYMBOL(mips_dma_map_ops);
2258
2259 #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
2260diff -urNp linux-2.6.39.1/arch/mips/mm/fault.c linux-2.6.39.1/arch/mips/mm/fault.c
2261--- linux-2.6.39.1/arch/mips/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
2262+++ linux-2.6.39.1/arch/mips/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
2263@@ -28,6 +28,23 @@
2264 #include <asm/highmem.h> /* For VMALLOC_END */
2265 #include <linux/kdebug.h>
2266
2267+#ifdef CONFIG_PAX_PAGEEXEC
2268+void pax_report_insns(void *pc, void *sp)
2269+{
2270+ unsigned long i;
2271+
2272+ printk(KERN_ERR "PAX: bytes at PC: ");
2273+ for (i = 0; i < 5; i++) {
2274+ unsigned int c;
2275+ if (get_user(c, (unsigned int *)pc+i))
2276+ printk(KERN_CONT "???????? ");
2277+ else
2278+ printk(KERN_CONT "%08x ", c);
2279+ }
2280+ printk("\n");
2281+}
2282+#endif
2283+
2284 /*
2285 * This routine handles page faults. It determines the address,
2286 * and the problem, and then passes it off to one of the appropriate
2287diff -urNp linux-2.6.39.1/arch/mips/mti-malta/malta-pci.c linux-2.6.39.1/arch/mips/mti-malta/malta-pci.c
2288--- linux-2.6.39.1/arch/mips/mti-malta/malta-pci.c 2011-05-19 00:06:34.000000000 -0400
2289+++ linux-2.6.39.1/arch/mips/mti-malta/malta-pci.c 2011-05-22 19:36:30.000000000 -0400
2290@@ -64,9 +64,9 @@ static struct resource msc_io_resource =
2291 .flags = IORESOURCE_IO,
2292 };
2293
2294-extern struct pci_ops bonito64_pci_ops;
2295-extern struct pci_ops gt64xxx_pci0_ops;
2296-extern struct pci_ops msc_pci_ops;
2297+extern const struct pci_ops bonito64_pci_ops;
2298+extern const struct pci_ops gt64xxx_pci0_ops;
2299+extern const struct pci_ops msc_pci_ops;
2300
2301 static struct pci_controller bonito64_controller = {
2302 .pci_ops = &bonito64_pci_ops,
2303diff -urNp linux-2.6.39.1/arch/mips/nxp/pnx8550/common/pci.c linux-2.6.39.1/arch/mips/nxp/pnx8550/common/pci.c
2304--- linux-2.6.39.1/arch/mips/nxp/pnx8550/common/pci.c 2011-05-19 00:06:34.000000000 -0400
2305+++ linux-2.6.39.1/arch/mips/nxp/pnx8550/common/pci.c 2011-05-22 19:36:30.000000000 -0400
2306@@ -40,7 +40,7 @@ static struct resource pci_mem_resource
2307 .flags = IORESOURCE_MEM
2308 };
2309
2310-extern struct pci_ops pnx8550_pci_ops;
2311+extern const struct pci_ops pnx8550_pci_ops;
2312
2313 static struct pci_controller pnx8550_controller = {
2314 .pci_ops = &pnx8550_pci_ops,
2315diff -urNp linux-2.6.39.1/arch/mips/pci/ops-au1000.c linux-2.6.39.1/arch/mips/pci/ops-au1000.c
2316--- linux-2.6.39.1/arch/mips/pci/ops-au1000.c 2011-05-19 00:06:34.000000000 -0400
2317+++ linux-2.6.39.1/arch/mips/pci/ops-au1000.c 2011-05-22 19:36:30.000000000 -0400
2318@@ -302,7 +302,7 @@ static int config_write(struct pci_bus *
2319 }
2320 }
2321
2322-struct pci_ops au1x_pci_ops = {
2323+const struct pci_ops au1x_pci_ops = {
2324 config_read,
2325 config_write
2326 };
2327diff -urNp linux-2.6.39.1/arch/mips/pci/ops-bcm63xx.c linux-2.6.39.1/arch/mips/pci/ops-bcm63xx.c
2328--- linux-2.6.39.1/arch/mips/pci/ops-bcm63xx.c 2011-05-19 00:06:34.000000000 -0400
2329+++ linux-2.6.39.1/arch/mips/pci/ops-bcm63xx.c 2011-05-22 19:36:30.000000000 -0400
2330@@ -173,7 +173,7 @@ static int bcm63xx_pci_write(struct pci_
2331 where, size, val);
2332 }
2333
2334-struct pci_ops bcm63xx_pci_ops = {
2335+const struct pci_ops bcm63xx_pci_ops = {
2336 .read = bcm63xx_pci_read,
2337 .write = bcm63xx_pci_write
2338 };
2339@@ -402,7 +402,7 @@ static int bcm63xx_cb_write(struct pci_b
2340 return PCIBIOS_DEVICE_NOT_FOUND;
2341 }
2342
2343-struct pci_ops bcm63xx_cb_ops = {
2344+const struct pci_ops bcm63xx_cb_ops = {
2345 .read = bcm63xx_cb_read,
2346 .write = bcm63xx_cb_write,
2347 };
2348diff -urNp linux-2.6.39.1/arch/mips/pci/ops-bonito64.c linux-2.6.39.1/arch/mips/pci/ops-bonito64.c
2349--- linux-2.6.39.1/arch/mips/pci/ops-bonito64.c 2011-05-19 00:06:34.000000000 -0400
2350+++ linux-2.6.39.1/arch/mips/pci/ops-bonito64.c 2011-05-22 19:36:30.000000000 -0400
2351@@ -155,7 +155,7 @@ static int bonito64_pcibios_write(struct
2352 return PCIBIOS_SUCCESSFUL;
2353 }
2354
2355-struct pci_ops bonito64_pci_ops = {
2356+const struct pci_ops bonito64_pci_ops = {
2357 .read = bonito64_pcibios_read,
2358 .write = bonito64_pcibios_write
2359 };
2360diff -urNp linux-2.6.39.1/arch/mips/pci/ops-bridge.c linux-2.6.39.1/arch/mips/pci/ops-bridge.c
2361--- linux-2.6.39.1/arch/mips/pci/ops-bridge.c 2011-05-19 00:06:34.000000000 -0400
2362+++ linux-2.6.39.1/arch/mips/pci/ops-bridge.c 2011-05-22 19:36:30.000000000 -0400
2363@@ -316,7 +316,7 @@ static int pci_write_config(struct pci_b
2364 return pci_conf0_write_config(bus, devfn, where, size, value);
2365 }
2366
2367-struct pci_ops bridge_pci_ops = {
2368+const struct pci_ops bridge_pci_ops = {
2369 .read = pci_read_config,
2370 .write = pci_write_config,
2371 };
2372diff -urNp linux-2.6.39.1/arch/mips/pci/ops-emma2rh.c linux-2.6.39.1/arch/mips/pci/ops-emma2rh.c
2373--- linux-2.6.39.1/arch/mips/pci/ops-emma2rh.c 2011-05-19 00:06:34.000000000 -0400
2374+++ linux-2.6.39.1/arch/mips/pci/ops-emma2rh.c 2011-05-22 19:36:30.000000000 -0400
2375@@ -176,7 +176,7 @@ static int pci_config_write(struct pci_b
2376 return PCIBIOS_SUCCESSFUL;
2377 }
2378
2379-struct pci_ops emma2rh_pci_ops = {
2380+const struct pci_ops emma2rh_pci_ops = {
2381 .read = pci_config_read,
2382 .write = pci_config_write,
2383 };
2384diff -urNp linux-2.6.39.1/arch/mips/pci/ops-gt64xxx_pci0.c linux-2.6.39.1/arch/mips/pci/ops-gt64xxx_pci0.c
2385--- linux-2.6.39.1/arch/mips/pci/ops-gt64xxx_pci0.c 2011-05-19 00:06:34.000000000 -0400
2386+++ linux-2.6.39.1/arch/mips/pci/ops-gt64xxx_pci0.c 2011-05-22 19:36:30.000000000 -0400
2387@@ -146,7 +146,7 @@ static int gt64xxx_pci0_pcibios_write(st
2388 return PCIBIOS_SUCCESSFUL;
2389 }
2390
2391-struct pci_ops gt64xxx_pci0_ops = {
2392+const struct pci_ops gt64xxx_pci0_ops = {
2393 .read = gt64xxx_pci0_pcibios_read,
2394 .write = gt64xxx_pci0_pcibios_write
2395 };
2396diff -urNp linux-2.6.39.1/arch/mips/pci/ops-loongson2.c linux-2.6.39.1/arch/mips/pci/ops-loongson2.c
2397--- linux-2.6.39.1/arch/mips/pci/ops-loongson2.c 2011-05-19 00:06:34.000000000 -0400
2398+++ linux-2.6.39.1/arch/mips/pci/ops-loongson2.c 2011-05-22 19:36:30.000000000 -0400
2399@@ -174,7 +174,7 @@ static int loongson_pcibios_write(struct
2400 return PCIBIOS_SUCCESSFUL;
2401 }
2402
2403-struct pci_ops loongson_pci_ops = {
2404+const struct pci_ops loongson_pci_ops = {
2405 .read = loongson_pcibios_read,
2406 .write = loongson_pcibios_write
2407 };
2408diff -urNp linux-2.6.39.1/arch/mips/pci/ops-mace.c linux-2.6.39.1/arch/mips/pci/ops-mace.c
2409--- linux-2.6.39.1/arch/mips/pci/ops-mace.c 2011-05-19 00:06:34.000000000 -0400
2410+++ linux-2.6.39.1/arch/mips/pci/ops-mace.c 2011-05-22 19:36:30.000000000 -0400
2411@@ -96,7 +96,7 @@ mace_pci_write_config(struct pci_bus *bu
2412 return PCIBIOS_SUCCESSFUL;
2413 }
2414
2415-struct pci_ops mace_pci_ops = {
2416+const struct pci_ops mace_pci_ops = {
2417 .read = mace_pci_read_config,
2418 .write = mace_pci_write_config,
2419 };
2420diff -urNp linux-2.6.39.1/arch/mips/pci/ops-msc.c linux-2.6.39.1/arch/mips/pci/ops-msc.c
2421--- linux-2.6.39.1/arch/mips/pci/ops-msc.c 2011-05-19 00:06:34.000000000 -0400
2422+++ linux-2.6.39.1/arch/mips/pci/ops-msc.c 2011-05-22 19:36:30.000000000 -0400
2423@@ -142,7 +142,7 @@ static int msc_pcibios_write(struct pci_
2424 return PCIBIOS_SUCCESSFUL;
2425 }
2426
2427-struct pci_ops msc_pci_ops = {
2428+const struct pci_ops msc_pci_ops = {
2429 .read = msc_pcibios_read,
2430 .write = msc_pcibios_write
2431 };
2432diff -urNp linux-2.6.39.1/arch/mips/pci/ops-nile4.c linux-2.6.39.1/arch/mips/pci/ops-nile4.c
2433--- linux-2.6.39.1/arch/mips/pci/ops-nile4.c 2011-05-19 00:06:34.000000000 -0400
2434+++ linux-2.6.39.1/arch/mips/pci/ops-nile4.c 2011-05-22 19:36:30.000000000 -0400
2435@@ -141,7 +141,7 @@ static int nile4_pcibios_write(struct pc
2436 return PCIBIOS_SUCCESSFUL;
2437 }
2438
2439-struct pci_ops nile4_pci_ops = {
2440+const struct pci_ops nile4_pci_ops = {
2441 .read = nile4_pcibios_read,
2442 .write = nile4_pcibios_write,
2443 };
2444diff -urNp linux-2.6.39.1/arch/mips/pci/ops-pmcmsp.c linux-2.6.39.1/arch/mips/pci/ops-pmcmsp.c
2445--- linux-2.6.39.1/arch/mips/pci/ops-pmcmsp.c 2011-05-19 00:06:34.000000000 -0400
2446+++ linux-2.6.39.1/arch/mips/pci/ops-pmcmsp.c 2011-05-22 19:36:30.000000000 -0400
2447@@ -904,7 +904,7 @@ msp_pcibios_write_config(struct pci_bus
2448 * write - function for Linux to generate PCI Configuration writes.
2449 *
2450 ****************************************************************************/
2451-struct pci_ops msp_pci_ops = {
2452+const struct pci_ops msp_pci_ops = {
2453 .read = msp_pcibios_read_config,
2454 .write = msp_pcibios_write_config
2455 };
2456diff -urNp linux-2.6.39.1/arch/mips/pci/ops-pnx8550.c linux-2.6.39.1/arch/mips/pci/ops-pnx8550.c
2457--- linux-2.6.39.1/arch/mips/pci/ops-pnx8550.c 2011-05-19 00:06:34.000000000 -0400
2458+++ linux-2.6.39.1/arch/mips/pci/ops-pnx8550.c 2011-05-22 19:36:30.000000000 -0400
2459@@ -276,7 +276,7 @@ static int config_write(struct pci_bus *
2460 }
2461 }
2462
2463-struct pci_ops pnx8550_pci_ops = {
2464+const struct pci_ops pnx8550_pci_ops = {
2465 config_read,
2466 config_write
2467 };
2468diff -urNp linux-2.6.39.1/arch/mips/pci/ops-rc32434.c linux-2.6.39.1/arch/mips/pci/ops-rc32434.c
2469--- linux-2.6.39.1/arch/mips/pci/ops-rc32434.c 2011-05-19 00:06:34.000000000 -0400
2470+++ linux-2.6.39.1/arch/mips/pci/ops-rc32434.c 2011-05-22 19:36:30.000000000 -0400
2471@@ -201,7 +201,7 @@ static int pci_config_write(struct pci_b
2472 }
2473 }
2474
2475-struct pci_ops rc32434_pci_ops = {
2476+const struct pci_ops rc32434_pci_ops = {
2477 .read = pci_config_read,
2478 .write = pci_config_write,
2479 };
2480diff -urNp linux-2.6.39.1/arch/mips/pci/ops-sni.c linux-2.6.39.1/arch/mips/pci/ops-sni.c
2481--- linux-2.6.39.1/arch/mips/pci/ops-sni.c 2011-05-19 00:06:34.000000000 -0400
2482+++ linux-2.6.39.1/arch/mips/pci/ops-sni.c 2011-05-22 19:36:30.000000000 -0400
2483@@ -83,7 +83,7 @@ static int pcimt_write(struct pci_bus *b
2484 return 0;
2485 }
2486
2487-struct pci_ops sni_pcimt_ops = {
2488+const struct pci_ops sni_pcimt_ops = {
2489 .read = pcimt_read,
2490 .write = pcimt_write,
2491 };
2492@@ -158,7 +158,7 @@ static int pcit_write(struct pci_bus *bu
2493 }
2494
2495
2496-struct pci_ops sni_pcit_ops = {
2497+const struct pci_ops sni_pcit_ops = {
2498 .read = pcit_read,
2499 .write = pcit_write,
2500 };
2501diff -urNp linux-2.6.39.1/arch/mips/pci/ops-titan.c linux-2.6.39.1/arch/mips/pci/ops-titan.c
2502--- linux-2.6.39.1/arch/mips/pci/ops-titan.c 2011-05-19 00:06:34.000000000 -0400
2503+++ linux-2.6.39.1/arch/mips/pci/ops-titan.c 2011-05-22 19:36:30.000000000 -0400
2504@@ -105,7 +105,7 @@ static int titan_write_config(struct pci
2505 /*
2506 * Titan PCI structure
2507 */
2508-struct pci_ops titan_pci_ops = {
2509+const struct pci_ops titan_pci_ops = {
2510 titan_read_config,
2511 titan_write_config,
2512 };
2513diff -urNp linux-2.6.39.1/arch/mips/pci/ops-titan-ht.c linux-2.6.39.1/arch/mips/pci/ops-titan-ht.c
2514--- linux-2.6.39.1/arch/mips/pci/ops-titan-ht.c 2011-05-19 00:06:34.000000000 -0400
2515+++ linux-2.6.39.1/arch/mips/pci/ops-titan-ht.c 2011-05-22 19:36:30.000000000 -0400
2516@@ -118,7 +118,7 @@ static int titan_ht_config_write(struct
2517 return PCIBIOS_SUCCESSFUL;
2518 }
2519
2520-struct pci_ops titan_ht_pci_ops = {
2521+const struct pci_ops titan_ht_pci_ops = {
2522 .read = titan_ht_config_read,
2523 .write = titan_ht_config_write,
2524 };
2525diff -urNp linux-2.6.39.1/arch/mips/pci/ops-tx3927.c linux-2.6.39.1/arch/mips/pci/ops-tx3927.c
2526--- linux-2.6.39.1/arch/mips/pci/ops-tx3927.c 2011-05-19 00:06:34.000000000 -0400
2527+++ linux-2.6.39.1/arch/mips/pci/ops-tx3927.c 2011-05-22 19:36:30.000000000 -0400
2528@@ -121,7 +121,7 @@ static int tx3927_pci_write_config(struc
2529 return check_abort();
2530 }
2531
2532-static struct pci_ops tx3927_pci_ops = {
2533+static const struct pci_ops tx3927_pci_ops = {
2534 .read = tx3927_pci_read_config,
2535 .write = tx3927_pci_write_config,
2536 };
2537diff -urNp linux-2.6.39.1/arch/mips/pci/ops-vr41xx.c linux-2.6.39.1/arch/mips/pci/ops-vr41xx.c
2538--- linux-2.6.39.1/arch/mips/pci/ops-vr41xx.c 2011-05-19 00:06:34.000000000 -0400
2539+++ linux-2.6.39.1/arch/mips/pci/ops-vr41xx.c 2011-05-22 19:36:30.000000000 -0400
2540@@ -120,7 +120,7 @@ static int pci_config_write(struct pci_b
2541 return PCIBIOS_SUCCESSFUL;
2542 }
2543
2544-struct pci_ops vr41xx_pci_ops = {
2545+const struct pci_ops vr41xx_pci_ops = {
2546 .read = pci_config_read,
2547 .write = pci_config_write,
2548 };
2549diff -urNp linux-2.6.39.1/arch/mips/pci/pci-bcm1480.c linux-2.6.39.1/arch/mips/pci/pci-bcm1480.c
2550--- linux-2.6.39.1/arch/mips/pci/pci-bcm1480.c 2011-05-19 00:06:34.000000000 -0400
2551+++ linux-2.6.39.1/arch/mips/pci/pci-bcm1480.c 2011-05-22 19:36:30.000000000 -0400
2552@@ -171,7 +171,7 @@ static int bcm1480_pcibios_write(struct
2553 return PCIBIOS_SUCCESSFUL;
2554 }
2555
2556-struct pci_ops bcm1480_pci_ops = {
2557+const struct pci_ops bcm1480_pci_ops = {
2558 bcm1480_pcibios_read,
2559 bcm1480_pcibios_write,
2560 };
2561diff -urNp linux-2.6.39.1/arch/mips/pci/pci-bcm1480ht.c linux-2.6.39.1/arch/mips/pci/pci-bcm1480ht.c
2562--- linux-2.6.39.1/arch/mips/pci/pci-bcm1480ht.c 2011-05-19 00:06:34.000000000 -0400
2563+++ linux-2.6.39.1/arch/mips/pci/pci-bcm1480ht.c 2011-05-22 19:36:30.000000000 -0400
2564@@ -166,7 +166,7 @@ static int bcm1480ht_pcibios_get_busno(v
2565 return 0;
2566 }
2567
2568-struct pci_ops bcm1480ht_pci_ops = {
2569+const struct pci_ops bcm1480ht_pci_ops = {
2570 .read = bcm1480ht_pcibios_read,
2571 .write = bcm1480ht_pcibios_write,
2572 };
2573diff -urNp linux-2.6.39.1/arch/mips/pci/pci-bcm63xx.h linux-2.6.39.1/arch/mips/pci/pci-bcm63xx.h
2574--- linux-2.6.39.1/arch/mips/pci/pci-bcm63xx.h 2011-05-19 00:06:34.000000000 -0400
2575+++ linux-2.6.39.1/arch/mips/pci/pci-bcm63xx.h 2011-05-22 19:36:30.000000000 -0400
2576@@ -16,8 +16,8 @@
2577 /*
2578 * defined in ops-bcm63xx.c
2579 */
2580-extern struct pci_ops bcm63xx_pci_ops;
2581-extern struct pci_ops bcm63xx_cb_ops;
2582+extern const struct pci_ops bcm63xx_pci_ops;
2583+extern const struct pci_ops bcm63xx_cb_ops;
2584
2585 /*
2586 * defined in pci-bcm63xx.c
2587diff -urNp linux-2.6.39.1/arch/mips/pci/pci-emma2rh.c linux-2.6.39.1/arch/mips/pci/pci-emma2rh.c
2588--- linux-2.6.39.1/arch/mips/pci/pci-emma2rh.c 2011-05-19 00:06:34.000000000 -0400
2589+++ linux-2.6.39.1/arch/mips/pci/pci-emma2rh.c 2011-05-22 19:36:30.000000000 -0400
2590@@ -43,7 +43,7 @@ static struct resource pci_mem_resource
2591 .flags = IORESOURCE_MEM,
2592 };
2593
2594-extern struct pci_ops emma2rh_pci_ops;
2595+extern const struct pci_ops emma2rh_pci_ops;
2596
2597 static struct pci_controller emma2rh_pci_controller = {
2598 .pci_ops = &emma2rh_pci_ops,
2599diff -urNp linux-2.6.39.1/arch/mips/pci/pcie-octeon.c linux-2.6.39.1/arch/mips/pci/pcie-octeon.c
2600--- linux-2.6.39.1/arch/mips/pci/pcie-octeon.c 2011-05-19 00:06:34.000000000 -0400
2601+++ linux-2.6.39.1/arch/mips/pci/pcie-octeon.c 2011-05-22 19:36:30.000000000 -0400
2602@@ -1237,7 +1237,7 @@ static int octeon_pcie1_write_config(str
2603 return octeon_pcie_write_config(1, bus, devfn, reg, size, val);
2604 }
2605
2606-static struct pci_ops octeon_pcie0_ops = {
2607+static const struct pci_ops octeon_pcie0_ops = {
2608 octeon_pcie0_read_config,
2609 octeon_pcie0_write_config,
2610 };
2611@@ -1258,7 +1258,7 @@ static struct pci_controller octeon_pcie
2612 .io_resource = &octeon_pcie0_io_resource,
2613 };
2614
2615-static struct pci_ops octeon_pcie1_ops = {
2616+static const struct pci_ops octeon_pcie1_ops = {
2617 octeon_pcie1_read_config,
2618 octeon_pcie1_write_config,
2619 };
2620diff -urNp linux-2.6.39.1/arch/mips/pci/pci-ip27.c linux-2.6.39.1/arch/mips/pci/pci-ip27.c
2621--- linux-2.6.39.1/arch/mips/pci/pci-ip27.c 2011-05-19 00:06:34.000000000 -0400
2622+++ linux-2.6.39.1/arch/mips/pci/pci-ip27.c 2011-05-22 19:36:30.000000000 -0400
2623@@ -39,7 +39,7 @@ static struct bridge_controller bridges[
2624 struct bridge_controller *irq_to_bridge[MAX_PCI_BUSSES * MAX_DEVICES_PER_PCIBUS];
2625 int irq_to_slot[MAX_PCI_BUSSES * MAX_DEVICES_PER_PCIBUS];
2626
2627-extern struct pci_ops bridge_pci_ops;
2628+extern const struct pci_ops bridge_pci_ops;
2629
2630 int __cpuinit bridge_probe(nasid_t nasid, int widget_id, int masterwid)
2631 {
2632diff -urNp linux-2.6.39.1/arch/mips/pci/pci-ip32.c linux-2.6.39.1/arch/mips/pci/pci-ip32.c
2633--- linux-2.6.39.1/arch/mips/pci/pci-ip32.c 2011-05-19 00:06:34.000000000 -0400
2634+++ linux-2.6.39.1/arch/mips/pci/pci-ip32.c 2011-05-22 19:36:30.000000000 -0400
2635@@ -82,7 +82,7 @@ static irqreturn_t macepci_error(int irq
2636 }
2637
2638
2639-extern struct pci_ops mace_pci_ops;
2640+extern const struct pci_ops mace_pci_ops;
2641 #ifdef CONFIG_64BIT
2642 static struct resource mace_pci_mem_resource = {
2643 .name = "SGI O2 PCI MEM",
2644diff -urNp linux-2.6.39.1/arch/mips/pci/pci-lasat.c linux-2.6.39.1/arch/mips/pci/pci-lasat.c
2645--- linux-2.6.39.1/arch/mips/pci/pci-lasat.c 2011-05-19 00:06:34.000000000 -0400
2646+++ linux-2.6.39.1/arch/mips/pci/pci-lasat.c 2011-05-22 19:36:30.000000000 -0400
2647@@ -14,8 +14,8 @@
2648
2649 #include <irq.h>
2650
2651-extern struct pci_ops nile4_pci_ops;
2652-extern struct pci_ops gt64xxx_pci0_ops;
2653+extern const struct pci_ops nile4_pci_ops;
2654+extern const struct pci_ops gt64xxx_pci0_ops;
2655 static struct resource lasat_pci_mem_resource = {
2656 .name = "LASAT PCI MEM",
2657 .start = 0x18000000,
2658diff -urNp linux-2.6.39.1/arch/mips/pci/pci-octeon.c linux-2.6.39.1/arch/mips/pci/pci-octeon.c
2659--- linux-2.6.39.1/arch/mips/pci/pci-octeon.c 2011-05-19 00:06:34.000000000 -0400
2660+++ linux-2.6.39.1/arch/mips/pci/pci-octeon.c 2011-05-22 19:36:30.000000000 -0400
2661@@ -334,7 +334,7 @@ static int octeon_write_config(struct pc
2662 }
2663
2664
2665-static struct pci_ops octeon_pci_ops = {
2666+static const struct pci_ops octeon_pci_ops = {
2667 octeon_read_config,
2668 octeon_write_config,
2669 };
2670diff -urNp linux-2.6.39.1/arch/mips/pci/pci-rc32434.c linux-2.6.39.1/arch/mips/pci/pci-rc32434.c
2671--- linux-2.6.39.1/arch/mips/pci/pci-rc32434.c 2011-05-19 00:06:34.000000000 -0400
2672+++ linux-2.6.39.1/arch/mips/pci/pci-rc32434.c 2011-05-22 19:36:30.000000000 -0400
2673@@ -75,7 +75,7 @@ static struct resource rc32434_res_pci_i
2674 .flags = IORESOURCE_IO,
2675 };
2676
2677-extern struct pci_ops rc32434_pci_ops;
2678+extern const struct pci_ops rc32434_pci_ops;
2679
2680 #define PCI_MEM1_START PCI_ADDR_START
2681 #define PCI_MEM1_END (PCI_ADDR_START + CPUTOPCI_MEM_WIN - 1)
2682diff -urNp linux-2.6.39.1/arch/mips/pci/pci-sb1250.c linux-2.6.39.1/arch/mips/pci/pci-sb1250.c
2683--- linux-2.6.39.1/arch/mips/pci/pci-sb1250.c 2011-05-19 00:06:34.000000000 -0400
2684+++ linux-2.6.39.1/arch/mips/pci/pci-sb1250.c 2011-05-22 19:36:30.000000000 -0400
2685@@ -181,7 +181,7 @@ static int sb1250_pcibios_write(struct p
2686 return PCIBIOS_SUCCESSFUL;
2687 }
2688
2689-struct pci_ops sb1250_pci_ops = {
2690+const struct pci_ops sb1250_pci_ops = {
2691 .read = sb1250_pcibios_read,
2692 .write = sb1250_pcibios_write,
2693 };
2694diff -urNp linux-2.6.39.1/arch/mips/pci/pci-vr41xx.c linux-2.6.39.1/arch/mips/pci/pci-vr41xx.c
2695--- linux-2.6.39.1/arch/mips/pci/pci-vr41xx.c 2011-05-19 00:06:34.000000000 -0400
2696+++ linux-2.6.39.1/arch/mips/pci/pci-vr41xx.c 2011-05-22 19:36:30.000000000 -0400
2697@@ -36,7 +36,7 @@
2698
2699 #include "pci-vr41xx.h"
2700
2701-extern struct pci_ops vr41xx_pci_ops;
2702+extern const struct pci_ops vr41xx_pci_ops;
2703
2704 static void __iomem *pciu_base;
2705
2706diff -urNp linux-2.6.39.1/arch/mips/pci/pci-yosemite.c linux-2.6.39.1/arch/mips/pci/pci-yosemite.c
2707--- linux-2.6.39.1/arch/mips/pci/pci-yosemite.c 2011-05-19 00:06:34.000000000 -0400
2708+++ linux-2.6.39.1/arch/mips/pci/pci-yosemite.c 2011-05-22 19:36:30.000000000 -0400
2709@@ -11,7 +11,7 @@
2710 #include <linux/pci.h>
2711 #include <asm/titan_dep.h>
2712
2713-extern struct pci_ops titan_pci_ops;
2714+extern const struct pci_ops titan_pci_ops;
2715
2716 static struct resource py_mem_resource = {
2717 .start = 0xe0000000UL,
2718diff -urNp linux-2.6.39.1/arch/mips/pmc-sierra/yosemite/ht.c linux-2.6.39.1/arch/mips/pmc-sierra/yosemite/ht.c
2719--- linux-2.6.39.1/arch/mips/pmc-sierra/yosemite/ht.c 2011-05-19 00:06:34.000000000 -0400
2720+++ linux-2.6.39.1/arch/mips/pmc-sierra/yosemite/ht.c 2011-05-22 19:36:30.000000000 -0400
2721@@ -366,7 +366,7 @@ resource_size_t pcibios_align_resource(v
2722 return start;
2723 }
2724
2725-struct pci_ops titan_pci_ops = {
2726+const struct pci_ops titan_pci_ops = {
2727 titan_ht_config_read_byte,
2728 titan_ht_config_read_word,
2729 titan_ht_config_read_dword,
2730diff -urNp linux-2.6.39.1/arch/mips/pnx8550/common/pci.c linux-2.6.39.1/arch/mips/pnx8550/common/pci.c
2731--- linux-2.6.39.1/arch/mips/pnx8550/common/pci.c 2011-05-19 00:06:34.000000000 -0400
2732+++ linux-2.6.39.1/arch/mips/pnx8550/common/pci.c 2011-05-22 19:36:30.000000000 -0400
2733@@ -40,7 +40,7 @@ static struct resource pci_mem_resource
2734 .flags = IORESOURCE_MEM
2735 };
2736
2737-extern struct pci_ops pnx8550_pci_ops;
2738+extern const struct pci_ops pnx8550_pci_ops;
2739
2740 static struct pci_controller pnx8550_controller = {
2741 .pci_ops = &pnx8550_pci_ops,
2742diff -urNp linux-2.6.39.1/arch/mips/sni/pcimt.c linux-2.6.39.1/arch/mips/sni/pcimt.c
2743--- linux-2.6.39.1/arch/mips/sni/pcimt.c 2011-05-19 00:06:34.000000000 -0400
2744+++ linux-2.6.39.1/arch/mips/sni/pcimt.c 2011-05-22 19:36:30.000000000 -0400
2745@@ -183,7 +183,7 @@ static void __init sni_pcimt_resource_in
2746 request_resource(&sni_mem_resource, pcimt_mem_resources + i);
2747 }
2748
2749-extern struct pci_ops sni_pcimt_ops;
2750+extern const struct pci_ops sni_pcimt_ops;
2751
2752 static struct pci_controller sni_controller = {
2753 .pci_ops = &sni_pcimt_ops,
2754diff -urNp linux-2.6.39.1/arch/mips/sni/pcit.c linux-2.6.39.1/arch/mips/sni/pcit.c
2755--- linux-2.6.39.1/arch/mips/sni/pcit.c 2011-05-19 00:06:34.000000000 -0400
2756+++ linux-2.6.39.1/arch/mips/sni/pcit.c 2011-05-22 19:36:30.000000000 -0400
2757@@ -145,7 +145,7 @@ static void __init sni_pcit_resource_ini
2758 }
2759
2760
2761-extern struct pci_ops sni_pcit_ops;
2762+extern const struct pci_ops sni_pcit_ops;
2763
2764 static struct pci_controller sni_pcit_controller = {
2765 .pci_ops = &sni_pcit_ops,
2766diff -urNp linux-2.6.39.1/arch/mips/wrppmc/pci.c linux-2.6.39.1/arch/mips/wrppmc/pci.c
2767--- linux-2.6.39.1/arch/mips/wrppmc/pci.c 2011-05-19 00:06:34.000000000 -0400
2768+++ linux-2.6.39.1/arch/mips/wrppmc/pci.c 2011-05-22 19:36:30.000000000 -0400
2769@@ -14,7 +14,7 @@
2770
2771 #include <asm/gt64120.h>
2772
2773-extern struct pci_ops gt64xxx_pci0_ops;
2774+extern const struct pci_ops gt64xxx_pci0_ops;
2775
2776 static struct resource pci0_io_resource = {
2777 .name = "pci_0 io",
2778diff -urNp linux-2.6.39.1/arch/mn10300/unit-asb2305/pci-asb2305.h linux-2.6.39.1/arch/mn10300/unit-asb2305/pci-asb2305.h
2779--- linux-2.6.39.1/arch/mn10300/unit-asb2305/pci-asb2305.h 2011-05-19 00:06:34.000000000 -0400
2780+++ linux-2.6.39.1/arch/mn10300/unit-asb2305/pci-asb2305.h 2011-05-22 19:36:30.000000000 -0400
2781@@ -39,7 +39,7 @@ extern void pcibios_resource_survey(void
2782
2783 extern int pcibios_last_bus;
2784 extern struct pci_bus *pci_root_bus;
2785-extern struct pci_ops *pci_root_ops;
2786+extern const struct pci_ops *pci_root_ops;
2787
2788 extern struct irq_routing_table *pcibios_get_irq_routing_table(void);
2789 extern int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq);
2790diff -urNp linux-2.6.39.1/arch/mn10300/unit-asb2305/pci.c linux-2.6.39.1/arch/mn10300/unit-asb2305/pci.c
2791--- linux-2.6.39.1/arch/mn10300/unit-asb2305/pci.c 2011-05-19 00:06:34.000000000 -0400
2792+++ linux-2.6.39.1/arch/mn10300/unit-asb2305/pci.c 2011-05-22 19:36:30.000000000 -0400
2793@@ -24,7 +24,7 @@ unsigned int pci_probe = 1;
2794
2795 int pcibios_last_bus = -1;
2796 struct pci_bus *pci_root_bus;
2797-struct pci_ops *pci_root_ops;
2798+const struct pci_ops *pci_root_ops;
2799
2800 /*
2801 * The accessible PCI window does not cover the entire CPU address space, but
2802@@ -274,7 +274,7 @@ static int pci_ampci_write_config(struct
2803 }
2804 }
2805
2806-static struct pci_ops pci_direct_ampci = {
2807+static const struct pci_ops pci_direct_ampci = {
2808 pci_ampci_read_config,
2809 pci_ampci_write_config,
2810 };
2811@@ -289,7 +289,7 @@ static struct pci_ops pci_direct_ampci =
2812 * This should be close to trivial, but it isn't, because there are buggy
2813 * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
2814 */
2815-static int __init pci_sanity_check(struct pci_ops *o)
2816+static int __init pci_sanity_check(const struct pci_ops *o)
2817 {
2818 struct pci_bus bus; /* Fake bus and device */
2819 u32 x;
2820diff -urNp linux-2.6.39.1/arch/parisc/include/asm/elf.h linux-2.6.39.1/arch/parisc/include/asm/elf.h
2821--- linux-2.6.39.1/arch/parisc/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
2822+++ linux-2.6.39.1/arch/parisc/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
2823@@ -342,6 +342,13 @@ struct pt_regs; /* forward declaration..
2824
2825 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
2826
2827+#ifdef CONFIG_PAX_ASLR
2828+#define PAX_ELF_ET_DYN_BASE 0x10000UL
2829+
2830+#define PAX_DELTA_MMAP_LEN 16
2831+#define PAX_DELTA_STACK_LEN 16
2832+#endif
2833+
2834 /* This yields a mask that user programs can use to figure out what
2835 instruction set this CPU supports. This could be done in user space,
2836 but it's not easy, and we've already done it here. */
2837diff -urNp linux-2.6.39.1/arch/parisc/include/asm/pgtable.h linux-2.6.39.1/arch/parisc/include/asm/pgtable.h
2838--- linux-2.6.39.1/arch/parisc/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
2839+++ linux-2.6.39.1/arch/parisc/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
2840@@ -207,6 +207,17 @@ struct vm_area_struct;
2841 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
2842 #define PAGE_COPY PAGE_EXECREAD
2843 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
2844+
2845+#ifdef CONFIG_PAX_PAGEEXEC
2846+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
2847+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
2848+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
2849+#else
2850+# define PAGE_SHARED_NOEXEC PAGE_SHARED
2851+# define PAGE_COPY_NOEXEC PAGE_COPY
2852+# define PAGE_READONLY_NOEXEC PAGE_READONLY
2853+#endif
2854+
2855 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
2856 #define PAGE_KERNEL_RO __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
2857 #define PAGE_KERNEL_UNC __pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
2858diff -urNp linux-2.6.39.1/arch/parisc/kernel/module.c linux-2.6.39.1/arch/parisc/kernel/module.c
2859--- linux-2.6.39.1/arch/parisc/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
2860+++ linux-2.6.39.1/arch/parisc/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
2861@@ -96,16 +96,38 @@
2862
2863 /* three functions to determine where in the module core
2864 * or init pieces the location is */
2865+static inline int in_init_rx(struct module *me, void *loc)
2866+{
2867+ return (loc >= me->module_init_rx &&
2868+ loc < (me->module_init_rx + me->init_size_rx));
2869+}
2870+
2871+static inline int in_init_rw(struct module *me, void *loc)
2872+{
2873+ return (loc >= me->module_init_rw &&
2874+ loc < (me->module_init_rw + me->init_size_rw));
2875+}
2876+
2877 static inline int in_init(struct module *me, void *loc)
2878 {
2879- return (loc >= me->module_init &&
2880- loc <= (me->module_init + me->init_size));
2881+ return in_init_rx(me, loc) || in_init_rw(me, loc);
2882+}
2883+
2884+static inline int in_core_rx(struct module *me, void *loc)
2885+{
2886+ return (loc >= me->module_core_rx &&
2887+ loc < (me->module_core_rx + me->core_size_rx));
2888+}
2889+
2890+static inline int in_core_rw(struct module *me, void *loc)
2891+{
2892+ return (loc >= me->module_core_rw &&
2893+ loc < (me->module_core_rw + me->core_size_rw));
2894 }
2895
2896 static inline int in_core(struct module *me, void *loc)
2897 {
2898- return (loc >= me->module_core &&
2899- loc <= (me->module_core + me->core_size));
2900+ return in_core_rx(me, loc) || in_core_rw(me, loc);
2901 }
2902
2903 static inline int in_local(struct module *me, void *loc)
2904@@ -365,13 +387,13 @@ int module_frob_arch_sections(CONST Elf_
2905 }
2906
2907 /* align things a bit */
2908- me->core_size = ALIGN(me->core_size, 16);
2909- me->arch.got_offset = me->core_size;
2910- me->core_size += gots * sizeof(struct got_entry);
2911-
2912- me->core_size = ALIGN(me->core_size, 16);
2913- me->arch.fdesc_offset = me->core_size;
2914- me->core_size += fdescs * sizeof(Elf_Fdesc);
2915+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
2916+ me->arch.got_offset = me->core_size_rw;
2917+ me->core_size_rw += gots * sizeof(struct got_entry);
2918+
2919+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
2920+ me->arch.fdesc_offset = me->core_size_rw;
2921+ me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
2922
2923 me->arch.got_max = gots;
2924 me->arch.fdesc_max = fdescs;
2925@@ -389,7 +411,7 @@ static Elf64_Word get_got(struct module
2926
2927 BUG_ON(value == 0);
2928
2929- got = me->module_core + me->arch.got_offset;
2930+ got = me->module_core_rw + me->arch.got_offset;
2931 for (i = 0; got[i].addr; i++)
2932 if (got[i].addr == value)
2933 goto out;
2934@@ -407,7 +429,7 @@ static Elf64_Word get_got(struct module
2935 #ifdef CONFIG_64BIT
2936 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
2937 {
2938- Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
2939+ Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
2940
2941 if (!value) {
2942 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
2943@@ -425,7 +447,7 @@ static Elf_Addr get_fdesc(struct module
2944
2945 /* Create new one */
2946 fdesc->addr = value;
2947- fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
2948+ fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
2949 return (Elf_Addr)fdesc;
2950 }
2951 #endif /* CONFIG_64BIT */
2952@@ -849,7 +871,7 @@ register_unwind_table(struct module *me,
2953
2954 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
2955 end = table + sechdrs[me->arch.unwind_section].sh_size;
2956- gp = (Elf_Addr)me->module_core + me->arch.got_offset;
2957+ gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
2958
2959 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
2960 me->arch.unwind_section, table, end, gp);
2961diff -urNp linux-2.6.39.1/arch/parisc/kernel/sys_parisc.c linux-2.6.39.1/arch/parisc/kernel/sys_parisc.c
2962--- linux-2.6.39.1/arch/parisc/kernel/sys_parisc.c 2011-05-19 00:06:34.000000000 -0400
2963+++ linux-2.6.39.1/arch/parisc/kernel/sys_parisc.c 2011-05-22 19:36:30.000000000 -0400
2964@@ -43,7 +43,7 @@ static unsigned long get_unshared_area(u
2965 /* At this point: (!vma || addr < vma->vm_end). */
2966 if (TASK_SIZE - len < addr)
2967 return -ENOMEM;
2968- if (!vma || addr + len <= vma->vm_start)
2969+ if (check_heap_stack_gap(vma, addr, len))
2970 return addr;
2971 addr = vma->vm_end;
2972 }
2973@@ -79,7 +79,7 @@ static unsigned long get_shared_area(str
2974 /* At this point: (!vma || addr < vma->vm_end). */
2975 if (TASK_SIZE - len < addr)
2976 return -ENOMEM;
2977- if (!vma || addr + len <= vma->vm_start)
2978+ if (check_heap_stack_gap(vma, addr, len))
2979 return addr;
2980 addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
2981 if (addr < vma->vm_end) /* handle wraparound */
2982@@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
2983 if (flags & MAP_FIXED)
2984 return addr;
2985 if (!addr)
2986- addr = TASK_UNMAPPED_BASE;
2987+ addr = current->mm->mmap_base;
2988
2989 if (filp) {
2990 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
2991diff -urNp linux-2.6.39.1/arch/parisc/kernel/traps.c linux-2.6.39.1/arch/parisc/kernel/traps.c
2992--- linux-2.6.39.1/arch/parisc/kernel/traps.c 2011-05-19 00:06:34.000000000 -0400
2993+++ linux-2.6.39.1/arch/parisc/kernel/traps.c 2011-05-22 19:36:30.000000000 -0400
2994@@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
2995
2996 down_read(&current->mm->mmap_sem);
2997 vma = find_vma(current->mm,regs->iaoq[0]);
2998- if (vma && (regs->iaoq[0] >= vma->vm_start)
2999- && (vma->vm_flags & VM_EXEC)) {
3000-
3001+ if (vma && (regs->iaoq[0] >= vma->vm_start)) {
3002 fault_address = regs->iaoq[0];
3003 fault_space = regs->iasq[0];
3004
3005diff -urNp linux-2.6.39.1/arch/parisc/mm/fault.c linux-2.6.39.1/arch/parisc/mm/fault.c
3006--- linux-2.6.39.1/arch/parisc/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
3007+++ linux-2.6.39.1/arch/parisc/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
3008@@ -15,6 +15,7 @@
3009 #include <linux/sched.h>
3010 #include <linux/interrupt.h>
3011 #include <linux/module.h>
3012+#include <linux/unistd.h>
3013
3014 #include <asm/uaccess.h>
3015 #include <asm/traps.h>
3016@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
3017 static unsigned long
3018 parisc_acctyp(unsigned long code, unsigned int inst)
3019 {
3020- if (code == 6 || code == 16)
3021+ if (code == 6 || code == 7 || code == 16)
3022 return VM_EXEC;
3023
3024 switch (inst & 0xf0000000) {
3025@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
3026 }
3027 #endif
3028
3029+#ifdef CONFIG_PAX_PAGEEXEC
3030+/*
3031+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
3032+ *
3033+ * returns 1 when task should be killed
3034+ * 2 when rt_sigreturn trampoline was detected
3035+ * 3 when unpatched PLT trampoline was detected
3036+ */
3037+static int pax_handle_fetch_fault(struct pt_regs *regs)
3038+{
3039+
3040+#ifdef CONFIG_PAX_EMUPLT
3041+ int err;
3042+
3043+ do { /* PaX: unpatched PLT emulation */
3044+ unsigned int bl, depwi;
3045+
3046+ err = get_user(bl, (unsigned int *)instruction_pointer(regs));
3047+ err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
3048+
3049+ if (err)
3050+ break;
3051+
3052+ if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
3053+ unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
3054+
3055+ err = get_user(ldw, (unsigned int *)addr);
3056+ err |= get_user(bv, (unsigned int *)(addr+4));
3057+ err |= get_user(ldw2, (unsigned int *)(addr+8));
3058+
3059+ if (err)
3060+ break;
3061+
3062+ if (ldw == 0x0E801096U &&
3063+ bv == 0xEAC0C000U &&
3064+ ldw2 == 0x0E881095U)
3065+ {
3066+ unsigned int resolver, map;
3067+
3068+ err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
3069+ err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
3070+ if (err)
3071+ break;
3072+
3073+ regs->gr[20] = instruction_pointer(regs)+8;
3074+ regs->gr[21] = map;
3075+ regs->gr[22] = resolver;
3076+ regs->iaoq[0] = resolver | 3UL;
3077+ regs->iaoq[1] = regs->iaoq[0] + 4;
3078+ return 3;
3079+ }
3080+ }
3081+ } while (0);
3082+#endif
3083+
3084+#ifdef CONFIG_PAX_EMUTRAMP
3085+
3086+#ifndef CONFIG_PAX_EMUSIGRT
3087+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
3088+ return 1;
3089+#endif
3090+
3091+ do { /* PaX: rt_sigreturn emulation */
3092+ unsigned int ldi1, ldi2, bel, nop;
3093+
3094+ err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
3095+ err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
3096+ err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
3097+ err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
3098+
3099+ if (err)
3100+ break;
3101+
3102+ if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
3103+ ldi2 == 0x3414015AU &&
3104+ bel == 0xE4008200U &&
3105+ nop == 0x08000240U)
3106+ {
3107+ regs->gr[25] = (ldi1 & 2) >> 1;
3108+ regs->gr[20] = __NR_rt_sigreturn;
3109+ regs->gr[31] = regs->iaoq[1] + 16;
3110+ regs->sr[0] = regs->iasq[1];
3111+ regs->iaoq[0] = 0x100UL;
3112+ regs->iaoq[1] = regs->iaoq[0] + 4;
3113+ regs->iasq[0] = regs->sr[2];
3114+ regs->iasq[1] = regs->sr[2];
3115+ return 2;
3116+ }
3117+ } while (0);
3118+#endif
3119+
3120+ return 1;
3121+}
3122+
3123+void pax_report_insns(void *pc, void *sp)
3124+{
3125+ unsigned long i;
3126+
3127+ printk(KERN_ERR "PAX: bytes at PC: ");
3128+ for (i = 0; i < 5; i++) {
3129+ unsigned int c;
3130+ if (get_user(c, (unsigned int *)pc+i))
3131+ printk(KERN_CONT "???????? ");
3132+ else
3133+ printk(KERN_CONT "%08x ", c);
3134+ }
3135+ printk("\n");
3136+}
3137+#endif
3138+
3139 int fixup_exception(struct pt_regs *regs)
3140 {
3141 const struct exception_table_entry *fix;
3142@@ -192,8 +303,33 @@ good_area:
3143
3144 acc_type = parisc_acctyp(code,regs->iir);
3145
3146- if ((vma->vm_flags & acc_type) != acc_type)
3147+ if ((vma->vm_flags & acc_type) != acc_type) {
3148+
3149+#ifdef CONFIG_PAX_PAGEEXEC
3150+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
3151+ (address & ~3UL) == instruction_pointer(regs))
3152+ {
3153+ up_read(&mm->mmap_sem);
3154+ switch (pax_handle_fetch_fault(regs)) {
3155+
3156+#ifdef CONFIG_PAX_EMUPLT
3157+ case 3:
3158+ return;
3159+#endif
3160+
3161+#ifdef CONFIG_PAX_EMUTRAMP
3162+ case 2:
3163+ return;
3164+#endif
3165+
3166+ }
3167+ pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
3168+ do_group_exit(SIGKILL);
3169+ }
3170+#endif
3171+
3172 goto bad_area;
3173+ }
3174
3175 /*
3176 * If for any reason at all we couldn't handle the fault, make
3177diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/device.h linux-2.6.39.1/arch/powerpc/include/asm/device.h
3178--- linux-2.6.39.1/arch/powerpc/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
3179+++ linux-2.6.39.1/arch/powerpc/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
3180@@ -17,7 +17,7 @@ struct device_node;
3181 */
3182 struct dev_archdata {
3183 /* DMA operations on that device */
3184- struct dma_map_ops *dma_ops;
3185+ const struct dma_map_ops *dma_ops;
3186
3187 /*
3188 * When an iommu is in use, dma_data is used as a ptr to the base of the
3189diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/dma-mapping.h linux-2.6.39.1/arch/powerpc/include/asm/dma-mapping.h
3190--- linux-2.6.39.1/arch/powerpc/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
3191+++ linux-2.6.39.1/arch/powerpc/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
3192@@ -67,12 +67,13 @@ static inline unsigned long device_to_ma
3193 /*
3194 * Available generic sets of operations
3195 */
3196+/* cannot be const */
3197 #ifdef CONFIG_PPC64
3198-extern struct dma_map_ops dma_iommu_ops;
3199+extern const struct dma_map_ops dma_iommu_ops;
3200 #endif
3201-extern struct dma_map_ops dma_direct_ops;
3202+extern const struct dma_map_ops dma_direct_ops;
3203
3204-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
3205+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
3206 {
3207 /* We don't handle the NULL dev case for ISA for now. We could
3208 * do it via an out of line call but it is not needed for now. The
3209@@ -85,7 +86,7 @@ static inline struct dma_map_ops *get_dm
3210 return dev->archdata.dma_ops;
3211 }
3212
3213-static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
3214+static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
3215 {
3216 dev->archdata.dma_ops = ops;
3217 }
3218@@ -119,7 +120,7 @@ static inline void set_dma_offset(struct
3219
3220 static inline int dma_supported(struct device *dev, u64 mask)
3221 {
3222- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3223+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3224
3225 if (unlikely(dma_ops == NULL))
3226 return 0;
3227@@ -133,7 +134,7 @@ extern int dma_set_mask(struct device *d
3228 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
3229 dma_addr_t *dma_handle, gfp_t flag)
3230 {
3231- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3232+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3233 void *cpu_addr;
3234
3235 BUG_ON(!dma_ops);
3236@@ -148,7 +149,7 @@ static inline void *dma_alloc_coherent(s
3237 static inline void dma_free_coherent(struct device *dev, size_t size,
3238 void *cpu_addr, dma_addr_t dma_handle)
3239 {
3240- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3241+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3242
3243 BUG_ON(!dma_ops);
3244
3245@@ -159,7 +160,7 @@ static inline void dma_free_coherent(str
3246
3247 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
3248 {
3249- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3250+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3251
3252 if (dma_ops->mapping_error)
3253 return dma_ops->mapping_error(dev, dma_addr);
3254diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/elf.h linux-2.6.39.1/arch/powerpc/include/asm/elf.h
3255--- linux-2.6.39.1/arch/powerpc/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
3256+++ linux-2.6.39.1/arch/powerpc/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
3257@@ -178,8 +178,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
3258 the loader. We need to make sure that it is out of the way of the program
3259 that it will "exec", and that there is sufficient room for the brk. */
3260
3261-extern unsigned long randomize_et_dyn(unsigned long base);
3262-#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
3263+#define ELF_ET_DYN_BASE (0x20000000)
3264+
3265+#ifdef CONFIG_PAX_ASLR
3266+#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
3267+
3268+#ifdef __powerpc64__
3269+#define PAX_DELTA_MMAP_LEN (is_32bit_task() ? 16 : 28)
3270+#define PAX_DELTA_STACK_LEN (is_32bit_task() ? 16 : 28)
3271+#else
3272+#define PAX_DELTA_MMAP_LEN 15
3273+#define PAX_DELTA_STACK_LEN 15
3274+#endif
3275+#endif
3276
3277 /*
3278 * Our registers are always unsigned longs, whether we're a 32 bit
3279@@ -274,9 +285,6 @@ extern int arch_setup_additional_pages(s
3280 (0x7ff >> (PAGE_SHIFT - 12)) : \
3281 (0x3ffff >> (PAGE_SHIFT - 12)))
3282
3283-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
3284-#define arch_randomize_brk arch_randomize_brk
3285-
3286 #endif /* __KERNEL__ */
3287
3288 /*
3289diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/iommu.h linux-2.6.39.1/arch/powerpc/include/asm/iommu.h
3290--- linux-2.6.39.1/arch/powerpc/include/asm/iommu.h 2011-05-19 00:06:34.000000000 -0400
3291+++ linux-2.6.39.1/arch/powerpc/include/asm/iommu.h 2011-05-22 19:36:30.000000000 -0400
3292@@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
3293 extern void iommu_init_early_dart(void);
3294 extern void iommu_init_early_pasemi(void);
3295
3296+/* dma-iommu.c */
3297+extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
3298+
3299 #ifdef CONFIG_PCI
3300 extern void pci_iommu_init(void);
3301 extern void pci_direct_iommu_init(void);
3302diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/kmap_types.h linux-2.6.39.1/arch/powerpc/include/asm/kmap_types.h
3303--- linux-2.6.39.1/arch/powerpc/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
3304+++ linux-2.6.39.1/arch/powerpc/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
3305@@ -27,6 +27,7 @@ enum km_type {
3306 KM_PPC_SYNC_PAGE,
3307 KM_PPC_SYNC_ICACHE,
3308 KM_KDB,
3309+ KM_CLEARPAGE,
3310 KM_TYPE_NR
3311 };
3312
3313diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/page_64.h linux-2.6.39.1/arch/powerpc/include/asm/page_64.h
3314--- linux-2.6.39.1/arch/powerpc/include/asm/page_64.h 2011-05-19 00:06:34.000000000 -0400
3315+++ linux-2.6.39.1/arch/powerpc/include/asm/page_64.h 2011-05-22 19:36:30.000000000 -0400
3316@@ -172,15 +172,18 @@ do { \
3317 * stack by default, so in the absence of a PT_GNU_STACK program header
3318 * we turn execute permission off.
3319 */
3320-#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
3321- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3322+#define VM_STACK_DEFAULT_FLAGS32 \
3323+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
3324+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3325
3326 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
3327 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3328
3329+#ifndef CONFIG_PAX_PAGEEXEC
3330 #define VM_STACK_DEFAULT_FLAGS \
3331 (is_32bit_task() ? \
3332 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
3333+#endif
3334
3335 #include <asm-generic/getorder.h>
3336
3337diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/page.h linux-2.6.39.1/arch/powerpc/include/asm/page.h
3338--- linux-2.6.39.1/arch/powerpc/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
3339+++ linux-2.6.39.1/arch/powerpc/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
3340@@ -129,8 +129,9 @@ extern phys_addr_t kernstart_addr;
3341 * and needs to be executable. This means the whole heap ends
3342 * up being executable.
3343 */
3344-#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
3345- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3346+#define VM_DATA_DEFAULT_FLAGS32 \
3347+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
3348+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3349
3350 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
3351 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3352@@ -158,6 +159,9 @@ extern phys_addr_t kernstart_addr;
3353 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
3354 #endif
3355
3356+#define ktla_ktva(addr) (addr)
3357+#define ktva_ktla(addr) (addr)
3358+
3359 #ifndef __ASSEMBLY__
3360
3361 #undef STRICT_MM_TYPECHECKS
3362diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/pci.h linux-2.6.39.1/arch/powerpc/include/asm/pci.h
3363--- linux-2.6.39.1/arch/powerpc/include/asm/pci.h 2011-05-19 00:06:34.000000000 -0400
3364+++ linux-2.6.39.1/arch/powerpc/include/asm/pci.h 2011-05-22 19:36:30.000000000 -0400
3365@@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
3366 }
3367
3368 #ifdef CONFIG_PCI
3369-extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
3370-extern struct dma_map_ops *get_pci_dma_ops(void);
3371+extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
3372+extern const struct dma_map_ops *get_pci_dma_ops(void);
3373 #else /* CONFIG_PCI */
3374 #define set_pci_dma_ops(d)
3375 #define get_pci_dma_ops() NULL
3376diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/pgtable.h linux-2.6.39.1/arch/powerpc/include/asm/pgtable.h
3377--- linux-2.6.39.1/arch/powerpc/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
3378+++ linux-2.6.39.1/arch/powerpc/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
3379@@ -2,6 +2,7 @@
3380 #define _ASM_POWERPC_PGTABLE_H
3381 #ifdef __KERNEL__
3382
3383+#include <linux/const.h>
3384 #ifndef __ASSEMBLY__
3385 #include <asm/processor.h> /* For TASK_SIZE */
3386 #include <asm/mmu.h>
3387diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/pte-hash32.h linux-2.6.39.1/arch/powerpc/include/asm/pte-hash32.h
3388--- linux-2.6.39.1/arch/powerpc/include/asm/pte-hash32.h 2011-05-19 00:06:34.000000000 -0400
3389+++ linux-2.6.39.1/arch/powerpc/include/asm/pte-hash32.h 2011-05-22 19:36:30.000000000 -0400
3390@@ -21,6 +21,7 @@
3391 #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
3392 #define _PAGE_USER 0x004 /* usermode access allowed */
3393 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
3394+#define _PAGE_EXEC _PAGE_GUARDED
3395 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
3396 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
3397 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
3398diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/reg.h linux-2.6.39.1/arch/powerpc/include/asm/reg.h
3399--- linux-2.6.39.1/arch/powerpc/include/asm/reg.h 2011-05-19 00:06:34.000000000 -0400
3400+++ linux-2.6.39.1/arch/powerpc/include/asm/reg.h 2011-05-22 19:36:30.000000000 -0400
3401@@ -201,6 +201,7 @@
3402 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
3403 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
3404 #define DSISR_NOHPTE 0x40000000 /* no translation found */
3405+#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
3406 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
3407 #define DSISR_ISSTORE 0x02000000 /* access was a store */
3408 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
3409diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/swiotlb.h linux-2.6.39.1/arch/powerpc/include/asm/swiotlb.h
3410--- linux-2.6.39.1/arch/powerpc/include/asm/swiotlb.h 2011-05-19 00:06:34.000000000 -0400
3411+++ linux-2.6.39.1/arch/powerpc/include/asm/swiotlb.h 2011-05-22 19:36:30.000000000 -0400
3412@@ -13,7 +13,7 @@
3413
3414 #include <linux/swiotlb.h>
3415
3416-extern struct dma_map_ops swiotlb_dma_ops;
3417+extern const struct dma_map_ops swiotlb_dma_ops;
3418
3419 static inline void dma_mark_clean(void *addr, size_t size) {}
3420
3421diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/system.h linux-2.6.39.1/arch/powerpc/include/asm/system.h
3422--- linux-2.6.39.1/arch/powerpc/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
3423+++ linux-2.6.39.1/arch/powerpc/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
3424@@ -533,7 +533,7 @@ __cmpxchg_local(volatile void *ptr, unsi
3425 #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
3426 #endif
3427
3428-extern unsigned long arch_align_stack(unsigned long sp);
3429+#define arch_align_stack(x) ((x) & ~0xfUL)
3430
3431 /* Used in very early kernel initialization. */
3432 extern unsigned long reloc_offset(void);
3433diff -urNp linux-2.6.39.1/arch/powerpc/include/asm/uaccess.h linux-2.6.39.1/arch/powerpc/include/asm/uaccess.h
3434--- linux-2.6.39.1/arch/powerpc/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
3435+++ linux-2.6.39.1/arch/powerpc/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
3436@@ -13,6 +13,8 @@
3437 #define VERIFY_READ 0
3438 #define VERIFY_WRITE 1
3439
3440+extern void check_object_size(const void *ptr, unsigned long n, bool to);
3441+
3442 /*
3443 * The fs value determines whether argument validity checking should be
3444 * performed or not. If get_fs() == USER_DS, checking is performed, with
3445@@ -327,52 +329,6 @@ do { \
3446 extern unsigned long __copy_tofrom_user(void __user *to,
3447 const void __user *from, unsigned long size);
3448
3449-#ifndef __powerpc64__
3450-
3451-static inline unsigned long copy_from_user(void *to,
3452- const void __user *from, unsigned long n)
3453-{
3454- unsigned long over;
3455-
3456- if (access_ok(VERIFY_READ, from, n))
3457- return __copy_tofrom_user((__force void __user *)to, from, n);
3458- if ((unsigned long)from < TASK_SIZE) {
3459- over = (unsigned long)from + n - TASK_SIZE;
3460- return __copy_tofrom_user((__force void __user *)to, from,
3461- n - over) + over;
3462- }
3463- return n;
3464-}
3465-
3466-static inline unsigned long copy_to_user(void __user *to,
3467- const void *from, unsigned long n)
3468-{
3469- unsigned long over;
3470-
3471- if (access_ok(VERIFY_WRITE, to, n))
3472- return __copy_tofrom_user(to, (__force void __user *)from, n);
3473- if ((unsigned long)to < TASK_SIZE) {
3474- over = (unsigned long)to + n - TASK_SIZE;
3475- return __copy_tofrom_user(to, (__force void __user *)from,
3476- n - over) + over;
3477- }
3478- return n;
3479-}
3480-
3481-#else /* __powerpc64__ */
3482-
3483-#define __copy_in_user(to, from, size) \
3484- __copy_tofrom_user((to), (from), (size))
3485-
3486-extern unsigned long copy_from_user(void *to, const void __user *from,
3487- unsigned long n);
3488-extern unsigned long copy_to_user(void __user *to, const void *from,
3489- unsigned long n);
3490-extern unsigned long copy_in_user(void __user *to, const void __user *from,
3491- unsigned long n);
3492-
3493-#endif /* __powerpc64__ */
3494-
3495 static inline unsigned long __copy_from_user_inatomic(void *to,
3496 const void __user *from, unsigned long n)
3497 {
3498@@ -396,6 +352,10 @@ static inline unsigned long __copy_from_
3499 if (ret == 0)
3500 return 0;
3501 }
3502+
3503+ if (!__builtin_constant_p(n))
3504+ check_object_size(to, n, false);
3505+
3506 return __copy_tofrom_user((__force void __user *)to, from, n);
3507 }
3508
3509@@ -422,6 +382,10 @@ static inline unsigned long __copy_to_us
3510 if (ret == 0)
3511 return 0;
3512 }
3513+
3514+ if (!__builtin_constant_p(n))
3515+ check_object_size(from, n, true);
3516+
3517 return __copy_tofrom_user(to, (__force const void __user *)from, n);
3518 }
3519
3520@@ -439,6 +403,92 @@ static inline unsigned long __copy_to_us
3521 return __copy_to_user_inatomic(to, from, size);
3522 }
3523
3524+#ifndef __powerpc64__
3525+
3526+static inline unsigned long __must_check copy_from_user(void *to,
3527+ const void __user *from, unsigned long n)
3528+{
3529+ unsigned long over;
3530+
3531+ if ((long)n < 0)
3532+ return n;
3533+
3534+ if (access_ok(VERIFY_READ, from, n)) {
3535+ if (!__builtin_constant_p(n))
3536+ check_object_size(to, n, false);
3537+ return __copy_tofrom_user((__force void __user *)to, from, n);
3538+ }
3539+ if ((unsigned long)from < TASK_SIZE) {
3540+ over = (unsigned long)from + n - TASK_SIZE;
3541+ if (!__builtin_constant_p(n - over))
3542+ check_object_size(to, n - over, false);
3543+ return __copy_tofrom_user((__force void __user *)to, from,
3544+ n - over) + over;
3545+ }
3546+ return n;
3547+}
3548+
3549+static inline unsigned long __must_check copy_to_user(void __user *to,
3550+ const void *from, unsigned long n)
3551+{
3552+ unsigned long over;
3553+
3554+ if ((long)n < 0)
3555+ return n;
3556+
3557+ if (access_ok(VERIFY_WRITE, to, n)) {
3558+ if (!__builtin_constant_p(n))
3559+ check_object_size(from, n, true);
3560+ return __copy_tofrom_user(to, (__force void __user *)from, n);
3561+ }
3562+ if ((unsigned long)to < TASK_SIZE) {
3563+ over = (unsigned long)to + n - TASK_SIZE;
3564+ if (!__builtin_constant_p(n))
3565+ check_object_size(from, n - over, true);
3566+ return __copy_tofrom_user(to, (__force void __user *)from,
3567+ n - over) + over;
3568+ }
3569+ return n;
3570+}
3571+
3572+#else /* __powerpc64__ */
3573+
3574+#define __copy_in_user(to, from, size) \
3575+ __copy_tofrom_user((to), (from), (size))
3576+
3577+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
3578+{
3579+ if ((long)n < 0 || n > INT_MAX)
3580+ return n;
3581+
3582+ if (!__builtin_constant_p(n))
3583+ check_object_size(to, n, false);
3584+
3585+ if (likely(access_ok(VERIFY_READ, from, n)))
3586+ n = __copy_from_user(to, from, n);
3587+ else
3588+ memset(to, 0, n);
3589+ return n;
3590+}
3591+
3592+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
3593+{
3594+ if ((long)n < 0 || n > INT_MAX)
3595+ return n;
3596+
3597+ if (likely(access_ok(VERIFY_WRITE, to, n))) {
3598+ if (!__builtin_constant_p(n))
3599+ check_object_size(from, n, true);
3600+ n = __copy_to_user(to, from, n);
3601+ }
3602+ return n;
3603+}
3604+
3605+extern unsigned long copy_in_user(void __user *to, const void __user *from,
3606+ unsigned long n);
3607+
3608+#endif /* __powerpc64__ */
3609+
3610 extern unsigned long __clear_user(void __user *addr, unsigned long size);
3611
3612 static inline unsigned long clear_user(void __user *addr, unsigned long size)
3613diff -urNp linux-2.6.39.1/arch/powerpc/kernel/dma.c linux-2.6.39.1/arch/powerpc/kernel/dma.c
3614--- linux-2.6.39.1/arch/powerpc/kernel/dma.c 2011-05-19 00:06:34.000000000 -0400
3615+++ linux-2.6.39.1/arch/powerpc/kernel/dma.c 2011-05-22 19:36:30.000000000 -0400
3616@@ -136,7 +136,7 @@ static inline void dma_direct_sync_singl
3617 }
3618 #endif
3619
3620-struct dma_map_ops dma_direct_ops = {
3621+const struct dma_map_ops dma_direct_ops = {
3622 .alloc_coherent = dma_direct_alloc_coherent,
3623 .free_coherent = dma_direct_free_coherent,
3624 .map_sg = dma_direct_map_sg,
3625@@ -157,7 +157,7 @@ EXPORT_SYMBOL(dma_direct_ops);
3626
3627 int dma_set_mask(struct device *dev, u64 dma_mask)
3628 {
3629- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3630+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3631
3632 if (ppc_md.dma_set_mask)
3633 return ppc_md.dma_set_mask(dev, dma_mask);
3634diff -urNp linux-2.6.39.1/arch/powerpc/kernel/dma-iommu.c linux-2.6.39.1/arch/powerpc/kernel/dma-iommu.c
3635--- linux-2.6.39.1/arch/powerpc/kernel/dma-iommu.c 2011-05-19 00:06:34.000000000 -0400
3636+++ linux-2.6.39.1/arch/powerpc/kernel/dma-iommu.c 2011-05-22 19:36:30.000000000 -0400
3637@@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
3638 }
3639
3640 /* We support DMA to/from any memory page via the iommu */
3641-static int dma_iommu_dma_supported(struct device *dev, u64 mask)
3642+int dma_iommu_dma_supported(struct device *dev, u64 mask)
3643 {
3644 struct iommu_table *tbl = get_iommu_table_base(dev);
3645
3646@@ -90,7 +90,7 @@ static int dma_iommu_dma_supported(struc
3647 return 1;
3648 }
3649
3650-struct dma_map_ops dma_iommu_ops = {
3651+struct dma_map_ops dma_iommu_ops = { /* cannot be const, see arch/powerpc/platforms/cell/iommu.c */
3652 .alloc_coherent = dma_iommu_alloc_coherent,
3653 .free_coherent = dma_iommu_free_coherent,
3654 .map_sg = dma_iommu_map_sg,
3655diff -urNp linux-2.6.39.1/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.39.1/arch/powerpc/kernel/dma-swiotlb.c
3656--- linux-2.6.39.1/arch/powerpc/kernel/dma-swiotlb.c 2011-05-19 00:06:34.000000000 -0400
3657+++ linux-2.6.39.1/arch/powerpc/kernel/dma-swiotlb.c 2011-05-22 19:36:30.000000000 -0400
3658@@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
3659 * map_page, and unmap_page on highmem, use normal dma_ops
3660 * for everything else.
3661 */
3662-struct dma_map_ops swiotlb_dma_ops = {
3663+const struct dma_map_ops swiotlb_dma_ops = {
3664 .alloc_coherent = dma_direct_alloc_coherent,
3665 .free_coherent = dma_direct_free_coherent,
3666 .map_sg = swiotlb_map_sg_attrs,
3667diff -urNp linux-2.6.39.1/arch/powerpc/kernel/exceptions-64e.S linux-2.6.39.1/arch/powerpc/kernel/exceptions-64e.S
3668--- linux-2.6.39.1/arch/powerpc/kernel/exceptions-64e.S 2011-05-19 00:06:34.000000000 -0400
3669+++ linux-2.6.39.1/arch/powerpc/kernel/exceptions-64e.S 2011-05-22 19:36:30.000000000 -0400
3670@@ -495,6 +495,7 @@ storage_fault_common:
3671 std r14,_DAR(r1)
3672 std r15,_DSISR(r1)
3673 addi r3,r1,STACK_FRAME_OVERHEAD
3674+ bl .save_nvgprs
3675 mr r4,r14
3676 mr r5,r15
3677 ld r14,PACA_EXGEN+EX_R14(r13)
3678@@ -504,8 +505,7 @@ storage_fault_common:
3679 cmpdi r3,0
3680 bne- 1f
3681 b .ret_from_except_lite
3682-1: bl .save_nvgprs
3683- mr r5,r3
3684+1: mr r5,r3
3685 addi r3,r1,STACK_FRAME_OVERHEAD
3686 ld r4,_DAR(r1)
3687 bl .bad_page_fault
3688diff -urNp linux-2.6.39.1/arch/powerpc/kernel/exceptions-64s.S linux-2.6.39.1/arch/powerpc/kernel/exceptions-64s.S
3689--- linux-2.6.39.1/arch/powerpc/kernel/exceptions-64s.S 2011-05-19 00:06:34.000000000 -0400
3690+++ linux-2.6.39.1/arch/powerpc/kernel/exceptions-64s.S 2011-05-22 19:36:30.000000000 -0400
3691@@ -848,10 +848,10 @@ handle_page_fault:
3692 11: ld r4,_DAR(r1)
3693 ld r5,_DSISR(r1)
3694 addi r3,r1,STACK_FRAME_OVERHEAD
3695+ bl .save_nvgprs
3696 bl .do_page_fault
3697 cmpdi r3,0
3698 beq+ 13f
3699- bl .save_nvgprs
3700 mr r5,r3
3701 addi r3,r1,STACK_FRAME_OVERHEAD
3702 lwz r4,_DAR(r1)
3703diff -urNp linux-2.6.39.1/arch/powerpc/kernel/ibmebus.c linux-2.6.39.1/arch/powerpc/kernel/ibmebus.c
3704--- linux-2.6.39.1/arch/powerpc/kernel/ibmebus.c 2011-05-19 00:06:34.000000000 -0400
3705+++ linux-2.6.39.1/arch/powerpc/kernel/ibmebus.c 2011-05-22 19:36:30.000000000 -0400
3706@@ -128,7 +128,7 @@ static int ibmebus_dma_supported(struct
3707 return 1;
3708 }
3709
3710-static struct dma_map_ops ibmebus_dma_ops = {
3711+static const struct dma_map_ops ibmebus_dma_ops = {
3712 .alloc_coherent = ibmebus_alloc_coherent,
3713 .free_coherent = ibmebus_free_coherent,
3714 .map_sg = ibmebus_map_sg,
3715diff -urNp linux-2.6.39.1/arch/powerpc/kernel/kgdb.c linux-2.6.39.1/arch/powerpc/kernel/kgdb.c
3716--- linux-2.6.39.1/arch/powerpc/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
3717+++ linux-2.6.39.1/arch/powerpc/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
3718@@ -422,7 +422,7 @@ int kgdb_arch_handle_exception(int vecto
3719 /*
3720 * Global data
3721 */
3722-struct kgdb_arch arch_kgdb_ops = {
3723+const struct kgdb_arch arch_kgdb_ops = {
3724 .gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
3725 };
3726
3727diff -urNp linux-2.6.39.1/arch/powerpc/kernel/module_32.c linux-2.6.39.1/arch/powerpc/kernel/module_32.c
3728--- linux-2.6.39.1/arch/powerpc/kernel/module_32.c 2011-05-19 00:06:34.000000000 -0400
3729+++ linux-2.6.39.1/arch/powerpc/kernel/module_32.c 2011-05-22 19:36:30.000000000 -0400
3730@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
3731 me->arch.core_plt_section = i;
3732 }
3733 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
3734- printk("Module doesn't contain .plt or .init.plt sections.\n");
3735+ printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
3736 return -ENOEXEC;
3737 }
3738
3739@@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
3740
3741 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
3742 /* Init, or core PLT? */
3743- if (location >= mod->module_core
3744- && location < mod->module_core + mod->core_size)
3745+ if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
3746+ (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
3747 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
3748- else
3749+ else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
3750+ (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
3751 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
3752+ else {
3753+ printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
3754+ return ~0UL;
3755+ }
3756
3757 /* Find this entry, or if that fails, the next avail. entry */
3758 while (entry->jump[0]) {
3759diff -urNp linux-2.6.39.1/arch/powerpc/kernel/module.c linux-2.6.39.1/arch/powerpc/kernel/module.c
3760--- linux-2.6.39.1/arch/powerpc/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
3761+++ linux-2.6.39.1/arch/powerpc/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
3762@@ -31,11 +31,24 @@
3763
3764 LIST_HEAD(module_bug_list);
3765
3766+#ifdef CONFIG_PAX_KERNEXEC
3767 void *module_alloc(unsigned long size)
3768 {
3769 if (size == 0)
3770 return NULL;
3771
3772+ return vmalloc(size);
3773+}
3774+
3775+void *module_alloc_exec(unsigned long size)
3776+#else
3777+void *module_alloc(unsigned long size)
3778+#endif
3779+
3780+{
3781+ if (size == 0)
3782+ return NULL;
3783+
3784 return vmalloc_exec(size);
3785 }
3786
3787@@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
3788 vfree(module_region);
3789 }
3790
3791+#ifdef CONFIG_PAX_KERNEXEC
3792+void module_free_exec(struct module *mod, void *module_region)
3793+{
3794+ module_free(mod, module_region);
3795+}
3796+#endif
3797+
3798 static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
3799 const Elf_Shdr *sechdrs,
3800 const char *name)
3801diff -urNp linux-2.6.39.1/arch/powerpc/kernel/pci-common.c linux-2.6.39.1/arch/powerpc/kernel/pci-common.c
3802--- linux-2.6.39.1/arch/powerpc/kernel/pci-common.c 2011-05-19 00:06:34.000000000 -0400
3803+++ linux-2.6.39.1/arch/powerpc/kernel/pci-common.c 2011-05-22 19:36:30.000000000 -0400
3804@@ -53,14 +53,14 @@ resource_size_t isa_mem_base;
3805 unsigned int ppc_pci_flags = 0;
3806
3807
3808-static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
3809+static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
3810
3811-void set_pci_dma_ops(struct dma_map_ops *dma_ops)
3812+void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
3813 {
3814 pci_dma_ops = dma_ops;
3815 }
3816
3817-struct dma_map_ops *get_pci_dma_ops(void)
3818+const struct dma_map_ops *get_pci_dma_ops(void)
3819 {
3820 return pci_dma_ops;
3821 }
3822@@ -1639,7 +1639,7 @@ null_write_config(struct pci_bus *bus, u
3823 return PCIBIOS_DEVICE_NOT_FOUND;
3824 }
3825
3826-static struct pci_ops null_pci_ops =
3827+static const struct pci_ops null_pci_ops =
3828 {
3829 .read = null_read_config,
3830 .write = null_write_config,
3831diff -urNp linux-2.6.39.1/arch/powerpc/kernel/process.c linux-2.6.39.1/arch/powerpc/kernel/process.c
3832--- linux-2.6.39.1/arch/powerpc/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
3833+++ linux-2.6.39.1/arch/powerpc/kernel/process.c 2011-05-22 19:41:32.000000000 -0400
3834@@ -655,8 +655,8 @@ void show_regs(struct pt_regs * regs)
3835 * Lookup NIP late so we have the best change of getting the
3836 * above info out without failing
3837 */
3838- printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
3839- printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
3840+ printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
3841+ printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
3842 #endif
3843 show_stack(current, (unsigned long *) regs->gpr[1]);
3844 if (!user_mode(regs))
3845@@ -1146,10 +1146,10 @@ void show_stack(struct task_struct *tsk,
3846 newsp = stack[0];
3847 ip = stack[STACK_FRAME_LR_SAVE];
3848 if (!firstframe || ip != lr) {
3849- printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
3850+ printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
3851 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
3852 if ((ip == rth || ip == mrth) && curr_frame >= 0) {
3853- printk(" (%pS)",
3854+ printk(" (%pA)",
3855 (void *)current->ret_stack[curr_frame].ret);
3856 curr_frame--;
3857 }
3858@@ -1169,7 +1169,7 @@ void show_stack(struct task_struct *tsk,
3859 struct pt_regs *regs = (struct pt_regs *)
3860 (sp + STACK_FRAME_OVERHEAD);
3861 lr = regs->link;
3862- printk("--- Exception: %lx at %pS\n LR = %pS\n",
3863+ printk("--- Exception: %lx at %pA\n LR = %pA\n",
3864 regs->trap, (void *)regs->nip, (void *)lr);
3865 firstframe = 1;
3866 }
3867@@ -1244,58 +1244,3 @@ void thread_info_cache_init(void)
3868 }
3869
3870 #endif /* THREAD_SHIFT < PAGE_SHIFT */
3871-
3872-unsigned long arch_align_stack(unsigned long sp)
3873-{
3874- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
3875- sp -= get_random_int() & ~PAGE_MASK;
3876- return sp & ~0xf;
3877-}
3878-
3879-static inline unsigned long brk_rnd(void)
3880-{
3881- unsigned long rnd = 0;
3882-
3883- /* 8MB for 32bit, 1GB for 64bit */
3884- if (is_32bit_task())
3885- rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
3886- else
3887- rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
3888-
3889- return rnd << PAGE_SHIFT;
3890-}
3891-
3892-unsigned long arch_randomize_brk(struct mm_struct *mm)
3893-{
3894- unsigned long base = mm->brk;
3895- unsigned long ret;
3896-
3897-#ifdef CONFIG_PPC_STD_MMU_64
3898- /*
3899- * If we are using 1TB segments and we are allowed to randomise
3900- * the heap, we can put it above 1TB so it is backed by a 1TB
3901- * segment. Otherwise the heap will be in the bottom 1TB
3902- * which always uses 256MB segments and this may result in a
3903- * performance penalty.
3904- */
3905- if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
3906- base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
3907-#endif
3908-
3909- ret = PAGE_ALIGN(base + brk_rnd());
3910-
3911- if (ret < mm->brk)
3912- return mm->brk;
3913-
3914- return ret;
3915-}
3916-
3917-unsigned long randomize_et_dyn(unsigned long base)
3918-{
3919- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
3920-
3921- if (ret < base)
3922- return base;
3923-
3924- return ret;
3925-}
3926diff -urNp linux-2.6.39.1/arch/powerpc/kernel/rtas_pci.c linux-2.6.39.1/arch/powerpc/kernel/rtas_pci.c
3927--- linux-2.6.39.1/arch/powerpc/kernel/rtas_pci.c 2011-05-19 00:06:34.000000000 -0400
3928+++ linux-2.6.39.1/arch/powerpc/kernel/rtas_pci.c 2011-05-22 19:36:30.000000000 -0400
3929@@ -149,7 +149,7 @@ static int rtas_pci_write_config(struct
3930 return PCIBIOS_DEVICE_NOT_FOUND;
3931 }
3932
3933-static struct pci_ops rtas_pci_ops = {
3934+static const struct pci_ops rtas_pci_ops = {
3935 .read = rtas_pci_read_config,
3936 .write = rtas_pci_write_config,
3937 };
3938diff -urNp linux-2.6.39.1/arch/powerpc/kernel/signal_32.c linux-2.6.39.1/arch/powerpc/kernel/signal_32.c
3939--- linux-2.6.39.1/arch/powerpc/kernel/signal_32.c 2011-05-19 00:06:34.000000000 -0400
3940+++ linux-2.6.39.1/arch/powerpc/kernel/signal_32.c 2011-05-22 19:36:30.000000000 -0400
3941@@ -858,7 +858,7 @@ int handle_rt_signal32(unsigned long sig
3942 /* Save user registers on the stack */
3943 frame = &rt_sf->uc.uc_mcontext;
3944 addr = frame;
3945- if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
3946+ if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
3947 if (save_user_regs(regs, frame, 0, 1))
3948 goto badframe;
3949 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
3950diff -urNp linux-2.6.39.1/arch/powerpc/kernel/signal_64.c linux-2.6.39.1/arch/powerpc/kernel/signal_64.c
3951--- linux-2.6.39.1/arch/powerpc/kernel/signal_64.c 2011-05-19 00:06:34.000000000 -0400
3952+++ linux-2.6.39.1/arch/powerpc/kernel/signal_64.c 2011-05-22 19:36:30.000000000 -0400
3953@@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
3954 current->thread.fpscr.val = 0;
3955
3956 /* Set up to return from userspace. */
3957- if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
3958+ if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
3959 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
3960 } else {
3961 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
3962diff -urNp linux-2.6.39.1/arch/powerpc/kernel/vdso.c linux-2.6.39.1/arch/powerpc/kernel/vdso.c
3963--- linux-2.6.39.1/arch/powerpc/kernel/vdso.c 2011-05-19 00:06:34.000000000 -0400
3964+++ linux-2.6.39.1/arch/powerpc/kernel/vdso.c 2011-05-22 19:36:30.000000000 -0400
3965@@ -36,6 +36,7 @@
3966 #include <asm/firmware.h>
3967 #include <asm/vdso.h>
3968 #include <asm/vdso_datapage.h>
3969+#include <asm/mman.h>
3970
3971 #include "setup.h"
3972
3973@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
3974 vdso_base = VDSO32_MBASE;
3975 #endif
3976
3977- current->mm->context.vdso_base = 0;
3978+ current->mm->context.vdso_base = ~0UL;
3979
3980 /* vDSO has a problem and was disabled, just don't "enable" it for the
3981 * process
3982@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
3983 vdso_base = get_unmapped_area(NULL, vdso_base,
3984 (vdso_pages << PAGE_SHIFT) +
3985 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
3986- 0, 0);
3987+ 0, MAP_PRIVATE | MAP_EXECUTABLE);
3988 if (IS_ERR_VALUE(vdso_base)) {
3989 rc = vdso_base;
3990 goto fail_mmapsem;
3991diff -urNp linux-2.6.39.1/arch/powerpc/kernel/vio.c linux-2.6.39.1/arch/powerpc/kernel/vio.c
3992--- linux-2.6.39.1/arch/powerpc/kernel/vio.c 2011-05-19 00:06:34.000000000 -0400
3993+++ linux-2.6.39.1/arch/powerpc/kernel/vio.c 2011-05-22 19:36:30.000000000 -0400
3994@@ -605,11 +605,12 @@ static int vio_dma_iommu_dma_supported(s
3995 return dma_iommu_ops.dma_supported(dev, mask);
3996 }
3997
3998-struct dma_map_ops vio_dma_mapping_ops = {
3999+const struct dma_map_ops vio_dma_mapping_ops = {
4000 .alloc_coherent = vio_dma_iommu_alloc_coherent,
4001 .free_coherent = vio_dma_iommu_free_coherent,
4002 .map_sg = vio_dma_iommu_map_sg,
4003 .unmap_sg = vio_dma_iommu_unmap_sg,
4004+ .dma_supported = dma_iommu_dma_supported,
4005 .map_page = vio_dma_iommu_map_page,
4006 .unmap_page = vio_dma_iommu_unmap_page,
4007 .dma_supported = vio_dma_iommu_dma_supported,
4008diff -urNp linux-2.6.39.1/arch/powerpc/lib/usercopy_64.c linux-2.6.39.1/arch/powerpc/lib/usercopy_64.c
4009--- linux-2.6.39.1/arch/powerpc/lib/usercopy_64.c 2011-05-19 00:06:34.000000000 -0400
4010+++ linux-2.6.39.1/arch/powerpc/lib/usercopy_64.c 2011-05-22 19:36:30.000000000 -0400
4011@@ -9,22 +9,6 @@
4012 #include <linux/module.h>
4013 #include <asm/uaccess.h>
4014
4015-unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
4016-{
4017- if (likely(access_ok(VERIFY_READ, from, n)))
4018- n = __copy_from_user(to, from, n);
4019- else
4020- memset(to, 0, n);
4021- return n;
4022-}
4023-
4024-unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
4025-{
4026- if (likely(access_ok(VERIFY_WRITE, to, n)))
4027- n = __copy_to_user(to, from, n);
4028- return n;
4029-}
4030-
4031 unsigned long copy_in_user(void __user *to, const void __user *from,
4032 unsigned long n)
4033 {
4034@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
4035 return n;
4036 }
4037
4038-EXPORT_SYMBOL(copy_from_user);
4039-EXPORT_SYMBOL(copy_to_user);
4040 EXPORT_SYMBOL(copy_in_user);
4041
4042diff -urNp linux-2.6.39.1/arch/powerpc/mm/fault.c linux-2.6.39.1/arch/powerpc/mm/fault.c
4043--- linux-2.6.39.1/arch/powerpc/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
4044+++ linux-2.6.39.1/arch/powerpc/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
4045@@ -31,6 +31,10 @@
4046 #include <linux/kdebug.h>
4047 #include <linux/perf_event.h>
4048 #include <linux/magic.h>
4049+#include <linux/slab.h>
4050+#include <linux/pagemap.h>
4051+#include <linux/compiler.h>
4052+#include <linux/unistd.h>
4053
4054 #include <asm/firmware.h>
4055 #include <asm/page.h>
4056@@ -42,6 +46,7 @@
4057 #include <asm/tlbflush.h>
4058 #include <asm/siginfo.h>
4059 #include <mm/mmu_decl.h>
4060+#include <asm/ptrace.h>
4061
4062 #ifdef CONFIG_KPROBES
4063 static inline int notify_page_fault(struct pt_regs *regs)
4064@@ -65,6 +70,33 @@ static inline int notify_page_fault(stru
4065 }
4066 #endif
4067
4068+#ifdef CONFIG_PAX_PAGEEXEC
4069+/*
4070+ * PaX: decide what to do with offenders (regs->nip = fault address)
4071+ *
4072+ * returns 1 when task should be killed
4073+ */
4074+static int pax_handle_fetch_fault(struct pt_regs *regs)
4075+{
4076+ return 1;
4077+}
4078+
4079+void pax_report_insns(void *pc, void *sp)
4080+{
4081+ unsigned long i;
4082+
4083+ printk(KERN_ERR "PAX: bytes at PC: ");
4084+ for (i = 0; i < 5; i++) {
4085+ unsigned int c;
4086+ if (get_user(c, (unsigned int __user *)pc+i))
4087+ printk(KERN_CONT "???????? ");
4088+ else
4089+ printk(KERN_CONT "%08x ", c);
4090+ }
4091+ printk("\n");
4092+}
4093+#endif
4094+
4095 /*
4096 * Check whether the instruction at regs->nip is a store using
4097 * an update addressing form which will update r1.
4098@@ -135,7 +167,7 @@ int __kprobes do_page_fault(struct pt_re
4099 * indicate errors in DSISR but can validly be set in SRR1.
4100 */
4101 if (trap == 0x400)
4102- error_code &= 0x48200000;
4103+ error_code &= 0x58200000;
4104 else
4105 is_write = error_code & DSISR_ISSTORE;
4106 #else
4107@@ -258,7 +290,7 @@ good_area:
4108 * "undefined". Of those that can be set, this is the only
4109 * one which seems bad.
4110 */
4111- if (error_code & 0x10000000)
4112+ if (error_code & DSISR_GUARDED)
4113 /* Guarded storage error. */
4114 goto bad_area;
4115 #endif /* CONFIG_8xx */
4116@@ -273,7 +305,7 @@ good_area:
4117 * processors use the same I/D cache coherency mechanism
4118 * as embedded.
4119 */
4120- if (error_code & DSISR_PROTFAULT)
4121+ if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
4122 goto bad_area;
4123 #endif /* CONFIG_PPC_STD_MMU */
4124
4125@@ -342,6 +374,23 @@ bad_area:
4126 bad_area_nosemaphore:
4127 /* User mode accesses cause a SIGSEGV */
4128 if (user_mode(regs)) {
4129+
4130+#ifdef CONFIG_PAX_PAGEEXEC
4131+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
4132+#ifdef CONFIG_PPC_STD_MMU
4133+ if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
4134+#else
4135+ if (is_exec && regs->nip == address) {
4136+#endif
4137+ switch (pax_handle_fetch_fault(regs)) {
4138+ }
4139+
4140+ pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
4141+ do_group_exit(SIGKILL);
4142+ }
4143+ }
4144+#endif
4145+
4146 _exception(SIGSEGV, regs, code, address);
4147 return 0;
4148 }
4149diff -urNp linux-2.6.39.1/arch/powerpc/mm/mmap_64.c linux-2.6.39.1/arch/powerpc/mm/mmap_64.c
4150--- linux-2.6.39.1/arch/powerpc/mm/mmap_64.c 2011-05-19 00:06:34.000000000 -0400
4151+++ linux-2.6.39.1/arch/powerpc/mm/mmap_64.c 2011-05-22 19:36:30.000000000 -0400
4152@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
4153 */
4154 if (mmap_is_legacy()) {
4155 mm->mmap_base = TASK_UNMAPPED_BASE;
4156+
4157+#ifdef CONFIG_PAX_RANDMMAP
4158+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4159+ mm->mmap_base += mm->delta_mmap;
4160+#endif
4161+
4162 mm->get_unmapped_area = arch_get_unmapped_area;
4163 mm->unmap_area = arch_unmap_area;
4164 } else {
4165 mm->mmap_base = mmap_base();
4166+
4167+#ifdef CONFIG_PAX_RANDMMAP
4168+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4169+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4170+#endif
4171+
4172 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4173 mm->unmap_area = arch_unmap_area_topdown;
4174 }
4175diff -urNp linux-2.6.39.1/arch/powerpc/mm/slice.c linux-2.6.39.1/arch/powerpc/mm/slice.c
4176--- linux-2.6.39.1/arch/powerpc/mm/slice.c 2011-05-19 00:06:34.000000000 -0400
4177+++ linux-2.6.39.1/arch/powerpc/mm/slice.c 2011-05-22 19:36:30.000000000 -0400
4178@@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_
4179 if ((mm->task_size - len) < addr)
4180 return 0;
4181 vma = find_vma(mm, addr);
4182- return (!vma || (addr + len) <= vma->vm_start);
4183+ return check_heap_stack_gap(vma, addr, len);
4184 }
4185
4186 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
4187@@ -256,7 +256,7 @@ full_search:
4188 addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
4189 continue;
4190 }
4191- if (!vma || addr + len <= vma->vm_start) {
4192+ if (check_heap_stack_gap(vma, addr, len)) {
4193 /*
4194 * Remember the place where we stopped the search:
4195 */
4196@@ -313,10 +313,14 @@ static unsigned long slice_find_area_top
4197 }
4198 }
4199
4200- addr = mm->mmap_base;
4201- while (addr > len) {
4202+ if (mm->mmap_base < len)
4203+ addr = -ENOMEM;
4204+ else
4205+ addr = mm->mmap_base - len;
4206+
4207+ while (!IS_ERR_VALUE(addr)) {
4208 /* Go down by chunk size */
4209- addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
4210+ addr = _ALIGN_DOWN(addr, 1ul << pshift);
4211
4212 /* Check for hit with different page size */
4213 mask = slice_range_to_mask(addr, len);
4214@@ -336,7 +340,7 @@ static unsigned long slice_find_area_top
4215 * return with success:
4216 */
4217 vma = find_vma(mm, addr);
4218- if (!vma || (addr + len) <= vma->vm_start) {
4219+ if (check_heap_stack_gap(vma, addr, len)) {
4220 /* remember the address as a hint for next time */
4221 if (use_cache)
4222 mm->free_area_cache = addr;
4223@@ -348,7 +352,7 @@ static unsigned long slice_find_area_top
4224 mm->cached_hole_size = vma->vm_start - addr;
4225
4226 /* try just below the current vma->vm_start */
4227- addr = vma->vm_start;
4228+ addr = skip_heap_stack_gap(vma, len);
4229 }
4230
4231 /*
4232@@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(un
4233 if (fixed && addr > (mm->task_size - len))
4234 return -EINVAL;
4235
4236+#ifdef CONFIG_PAX_RANDMMAP
4237+ if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
4238+ addr = 0;
4239+#endif
4240+
4241 /* If hint, make sure it matches our alignment restrictions */
4242 if (!fixed && addr) {
4243 addr = _ALIGN_UP(addr, 1ul << pshift);
4244diff -urNp linux-2.6.39.1/arch/powerpc/platforms/52xx/efika.c linux-2.6.39.1/arch/powerpc/platforms/52xx/efika.c
4245--- linux-2.6.39.1/arch/powerpc/platforms/52xx/efika.c 2011-05-19 00:06:34.000000000 -0400
4246+++ linux-2.6.39.1/arch/powerpc/platforms/52xx/efika.c 2011-05-22 19:36:30.000000000 -0400
4247@@ -60,7 +60,7 @@ static int rtas_write_config(struct pci_
4248 return rval ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
4249 }
4250
4251-static struct pci_ops rtas_pci_ops = {
4252+static const struct pci_ops rtas_pci_ops = {
4253 .read = rtas_read_config,
4254 .write = rtas_write_config,
4255 };
4256diff -urNp linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_pci.c linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_pci.c
4257--- linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_pci.c 2011-05-19 00:06:34.000000000 -0400
4258+++ linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_pci.c 2011-05-22 19:36:30.000000000 -0400
4259@@ -234,7 +234,7 @@ static int celleb_fake_pci_write_config(
4260 return PCIBIOS_SUCCESSFUL;
4261 }
4262
4263-static struct pci_ops celleb_fake_pci_ops = {
4264+static const struct pci_ops celleb_fake_pci_ops = {
4265 .read = celleb_fake_pci_read_config,
4266 .write = celleb_fake_pci_write_config,
4267 };
4268diff -urNp linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_scc_epci.c linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_scc_epci.c
4269--- linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_scc_epci.c 2011-05-19 00:06:34.000000000 -0400
4270+++ linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_scc_epci.c 2011-05-22 19:36:30.000000000 -0400
4271@@ -245,7 +245,7 @@ static int celleb_epci_write_config(stru
4272 return celleb_epci_check_abort(hose, addr);
4273 }
4274
4275-struct pci_ops celleb_epci_ops = {
4276+const struct pci_ops celleb_epci_ops = {
4277 .read = celleb_epci_read_config,
4278 .write = celleb_epci_write_config,
4279 };
4280diff -urNp linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_scc_pciex.c linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_scc_pciex.c
4281--- linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_scc_pciex.c 2011-05-19 00:06:34.000000000 -0400
4282+++ linux-2.6.39.1/arch/powerpc/platforms/cell/celleb_scc_pciex.c 2011-05-22 19:36:30.000000000 -0400
4283@@ -399,7 +399,7 @@ static int scc_pciex_write_config(struct
4284 return PCIBIOS_SUCCESSFUL;
4285 }
4286
4287-static struct pci_ops scc_pciex_pci_ops = {
4288+static const struct pci_ops scc_pciex_pci_ops = {
4289 scc_pciex_read_config,
4290 scc_pciex_write_config,
4291 };
4292diff -urNp linux-2.6.39.1/arch/powerpc/platforms/cell/iommu.c linux-2.6.39.1/arch/powerpc/platforms/cell/iommu.c
4293--- linux-2.6.39.1/arch/powerpc/platforms/cell/iommu.c 2011-05-19 00:06:34.000000000 -0400
4294+++ linux-2.6.39.1/arch/powerpc/platforms/cell/iommu.c 2011-05-22 19:36:30.000000000 -0400
4295@@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
4296
4297 static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
4298
4299-struct dma_map_ops dma_iommu_fixed_ops = {
4300+const struct dma_map_ops dma_iommu_fixed_ops = {
4301 .alloc_coherent = dma_fixed_alloc_coherent,
4302 .free_coherent = dma_fixed_free_coherent,
4303 .map_sg = dma_fixed_map_sg,
4304diff -urNp linux-2.6.39.1/arch/powerpc/platforms/chrp/pci.c linux-2.6.39.1/arch/powerpc/platforms/chrp/pci.c
4305--- linux-2.6.39.1/arch/powerpc/platforms/chrp/pci.c 2011-05-19 00:06:34.000000000 -0400
4306+++ linux-2.6.39.1/arch/powerpc/platforms/chrp/pci.c 2011-05-22 19:36:30.000000000 -0400
4307@@ -84,7 +84,7 @@ int gg2_write_config(struct pci_bus *bus
4308 return PCIBIOS_SUCCESSFUL;
4309 }
4310
4311-static struct pci_ops gg2_pci_ops =
4312+static const struct pci_ops gg2_pci_ops =
4313 {
4314 .read = gg2_read_config,
4315 .write = gg2_write_config,
4316@@ -122,7 +122,7 @@ int rtas_write_config(struct pci_bus *bu
4317 return rval? PCIBIOS_DEVICE_NOT_FOUND: PCIBIOS_SUCCESSFUL;
4318 }
4319
4320-static struct pci_ops rtas_pci_ops =
4321+static const struct pci_ops rtas_pci_ops =
4322 {
4323 .read = rtas_read_config,
4324 .write = rtas_write_config,
4325diff -urNp linux-2.6.39.1/arch/powerpc/platforms/iseries/pci.c linux-2.6.39.1/arch/powerpc/platforms/iseries/pci.c
4326--- linux-2.6.39.1/arch/powerpc/platforms/iseries/pci.c 2011-05-19 00:06:34.000000000 -0400
4327+++ linux-2.6.39.1/arch/powerpc/platforms/iseries/pci.c 2011-05-22 19:36:30.000000000 -0400
4328@@ -533,7 +533,7 @@ static int iSeries_pci_write_config(stru
4329 return 0;
4330 }
4331
4332-static struct pci_ops iSeries_pci_ops = {
4333+static const struct pci_ops iSeries_pci_ops = {
4334 .read = iSeries_pci_read_config,
4335 .write = iSeries_pci_write_config
4336 };
4337diff -urNp linux-2.6.39.1/arch/powerpc/platforms/maple/pci.c linux-2.6.39.1/arch/powerpc/platforms/maple/pci.c
4338--- linux-2.6.39.1/arch/powerpc/platforms/maple/pci.c 2011-05-19 00:06:34.000000000 -0400
4339+++ linux-2.6.39.1/arch/powerpc/platforms/maple/pci.c 2011-05-22 19:36:30.000000000 -0400
4340@@ -180,7 +180,7 @@ static int u3_agp_write_config(struct pc
4341 return PCIBIOS_SUCCESSFUL;
4342 }
4343
4344-static struct pci_ops u3_agp_pci_ops =
4345+static const struct pci_ops u3_agp_pci_ops =
4346 {
4347 .read = u3_agp_read_config,
4348 .write = u3_agp_write_config,
4349@@ -276,7 +276,7 @@ static int u3_ht_write_config(struct pci
4350 return PCIBIOS_SUCCESSFUL;
4351 }
4352
4353-static struct pci_ops u3_ht_pci_ops =
4354+static const struct pci_ops u3_ht_pci_ops =
4355 {
4356 .read = u3_ht_read_config,
4357 .write = u3_ht_write_config,
4358@@ -381,7 +381,7 @@ static int u4_pcie_write_config(struct p
4359 return PCIBIOS_SUCCESSFUL;
4360 }
4361
4362-static struct pci_ops u4_pcie_pci_ops =
4363+static const struct pci_ops u4_pcie_pci_ops =
4364 {
4365 .read = u4_pcie_read_config,
4366 .write = u4_pcie_write_config,
4367diff -urNp linux-2.6.39.1/arch/powerpc/platforms/pasemi/pci.c linux-2.6.39.1/arch/powerpc/platforms/pasemi/pci.c
4368--- linux-2.6.39.1/arch/powerpc/platforms/pasemi/pci.c 2011-05-19 00:06:34.000000000 -0400
4369+++ linux-2.6.39.1/arch/powerpc/platforms/pasemi/pci.c 2011-05-22 19:36:30.000000000 -0400
4370@@ -176,7 +176,7 @@ static int pa_pxp_write_config(struct pc
4371 return PCIBIOS_SUCCESSFUL;
4372 }
4373
4374-static struct pci_ops pa_pxp_ops = {
4375+static const struct pci_ops pa_pxp_ops = {
4376 .read = pa_pxp_read_config,
4377 .write = pa_pxp_write_config,
4378 };
4379diff -urNp linux-2.6.39.1/arch/powerpc/platforms/powermac/pci.c linux-2.6.39.1/arch/powerpc/platforms/powermac/pci.c
4380--- linux-2.6.39.1/arch/powerpc/platforms/powermac/pci.c 2011-05-19 00:06:34.000000000 -0400
4381+++ linux-2.6.39.1/arch/powerpc/platforms/powermac/pci.c 2011-05-22 19:36:30.000000000 -0400
4382@@ -218,7 +218,7 @@ static int macrisc_write_config(struct p
4383 return PCIBIOS_SUCCESSFUL;
4384 }
4385
4386-static struct pci_ops macrisc_pci_ops =
4387+static const struct pci_ops macrisc_pci_ops =
4388 {
4389 .read = macrisc_read_config,
4390 .write = macrisc_write_config,
4391@@ -273,7 +273,7 @@ chaos_write_config(struct pci_bus *bus,
4392 return macrisc_write_config(bus, devfn, offset, len, val);
4393 }
4394
4395-static struct pci_ops chaos_pci_ops =
4396+static const struct pci_ops chaos_pci_ops =
4397 {
4398 .read = chaos_read_config,
4399 .write = chaos_write_config,
4400diff -urNp linux-2.6.39.1/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.39.1/arch/powerpc/platforms/ps3/system-bus.c
4401--- linux-2.6.39.1/arch/powerpc/platforms/ps3/system-bus.c 2011-05-19 00:06:34.000000000 -0400
4402+++ linux-2.6.39.1/arch/powerpc/platforms/ps3/system-bus.c 2011-05-22 19:36:30.000000000 -0400
4403@@ -695,7 +695,7 @@ static int ps3_dma_supported(struct devi
4404 return mask >= DMA_BIT_MASK(32);
4405 }
4406
4407-static struct dma_map_ops ps3_sb_dma_ops = {
4408+static const struct dma_map_ops ps3_sb_dma_ops = {
4409 .alloc_coherent = ps3_alloc_coherent,
4410 .free_coherent = ps3_free_coherent,
4411 .map_sg = ps3_sb_map_sg,
4412@@ -705,7 +705,7 @@ static struct dma_map_ops ps3_sb_dma_ops
4413 .unmap_page = ps3_unmap_page,
4414 };
4415
4416-static struct dma_map_ops ps3_ioc0_dma_ops = {
4417+static const struct dma_map_ops ps3_ioc0_dma_ops = {
4418 .alloc_coherent = ps3_alloc_coherent,
4419 .free_coherent = ps3_free_coherent,
4420 .map_sg = ps3_ioc0_map_sg,
4421diff -urNp linux-2.6.39.1/arch/powerpc/sysdev/fsl_pci.c linux-2.6.39.1/arch/powerpc/sysdev/fsl_pci.c
4422--- linux-2.6.39.1/arch/powerpc/sysdev/fsl_pci.c 2011-05-19 00:06:34.000000000 -0400
4423+++ linux-2.6.39.1/arch/powerpc/sysdev/fsl_pci.c 2011-05-22 19:36:30.000000000 -0400
4424@@ -573,7 +573,7 @@ static int mpc83xx_pcie_write_config(str
4425 return PCIBIOS_SUCCESSFUL;
4426 }
4427
4428-static struct pci_ops mpc83xx_pcie_ops = {
4429+static const struct pci_ops mpc83xx_pcie_ops = {
4430 .read = mpc83xx_pcie_read_config,
4431 .write = mpc83xx_pcie_write_config,
4432 };
4433diff -urNp linux-2.6.39.1/arch/powerpc/sysdev/indirect_pci.c linux-2.6.39.1/arch/powerpc/sysdev/indirect_pci.c
4434--- linux-2.6.39.1/arch/powerpc/sysdev/indirect_pci.c 2011-05-19 00:06:34.000000000 -0400
4435+++ linux-2.6.39.1/arch/powerpc/sysdev/indirect_pci.c 2011-05-22 19:36:30.000000000 -0400
4436@@ -148,7 +148,7 @@ indirect_write_config(struct pci_bus *bu
4437 return PCIBIOS_SUCCESSFUL;
4438 }
4439
4440-static struct pci_ops indirect_pci_ops =
4441+static const struct pci_ops indirect_pci_ops =
4442 {
4443 .read = indirect_read_config,
4444 .write = indirect_write_config,
4445diff -urNp linux-2.6.39.1/arch/powerpc/sysdev/ppc4xx_pci.c linux-2.6.39.1/arch/powerpc/sysdev/ppc4xx_pci.c
4446--- linux-2.6.39.1/arch/powerpc/sysdev/ppc4xx_pci.c 2011-05-19 00:06:34.000000000 -0400
4447+++ linux-2.6.39.1/arch/powerpc/sysdev/ppc4xx_pci.c 2011-05-22 19:36:30.000000000 -0400
4448@@ -1514,7 +1514,7 @@ static int ppc4xx_pciex_write_config(str
4449 return PCIBIOS_SUCCESSFUL;
4450 }
4451
4452-static struct pci_ops ppc4xx_pciex_pci_ops =
4453+static const struct pci_ops ppc4xx_pciex_pci_ops =
4454 {
4455 .read = ppc4xx_pciex_read_config,
4456 .write = ppc4xx_pciex_write_config,
4457diff -urNp linux-2.6.39.1/arch/powerpc/sysdev/tsi108_pci.c linux-2.6.39.1/arch/powerpc/sysdev/tsi108_pci.c
4458--- linux-2.6.39.1/arch/powerpc/sysdev/tsi108_pci.c 2011-05-19 00:06:34.000000000 -0400
4459+++ linux-2.6.39.1/arch/powerpc/sysdev/tsi108_pci.c 2011-05-22 19:36:30.000000000 -0400
4460@@ -190,7 +190,7 @@ void tsi108_clear_pci_cfg_error(void)
4461 tsi108_clear_pci_error(tsi108_pci_cfg_phys);
4462 }
4463
4464-static struct pci_ops tsi108_direct_pci_ops = {
4465+static const struct pci_ops tsi108_direct_pci_ops = {
4466 .read = tsi108_direct_read_config,
4467 .write = tsi108_direct_write_config,
4468 };
4469diff -urNp linux-2.6.39.1/arch/s390/include/asm/elf.h linux-2.6.39.1/arch/s390/include/asm/elf.h
4470--- linux-2.6.39.1/arch/s390/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
4471+++ linux-2.6.39.1/arch/s390/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
4472@@ -162,8 +162,14 @@ extern unsigned int vdso_enabled;
4473 the loader. We need to make sure that it is out of the way of the program
4474 that it will "exec", and that there is sufficient room for the brk. */
4475
4476-extern unsigned long randomize_et_dyn(unsigned long base);
4477-#define ELF_ET_DYN_BASE (randomize_et_dyn(STACK_TOP / 3 * 2))
4478+#define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
4479+
4480+#ifdef CONFIG_PAX_ASLR
4481+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
4482+
4483+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
4484+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
4485+#endif
4486
4487 /* This yields a mask that user programs can use to figure out what
4488 instruction set this CPU supports. */
4489@@ -222,7 +228,4 @@ struct linux_binprm;
4490 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
4491 int arch_setup_additional_pages(struct linux_binprm *, int);
4492
4493-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
4494-#define arch_randomize_brk arch_randomize_brk
4495-
4496 #endif
4497diff -urNp linux-2.6.39.1/arch/s390/include/asm/system.h linux-2.6.39.1/arch/s390/include/asm/system.h
4498--- linux-2.6.39.1/arch/s390/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
4499+++ linux-2.6.39.1/arch/s390/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
4500@@ -255,7 +255,7 @@ extern void (*_machine_restart)(char *co
4501 extern void (*_machine_halt)(void);
4502 extern void (*_machine_power_off)(void);
4503
4504-extern unsigned long arch_align_stack(unsigned long sp);
4505+#define arch_align_stack(x) ((x) & ~0xfUL)
4506
4507 static inline int tprot(unsigned long addr)
4508 {
4509diff -urNp linux-2.6.39.1/arch/s390/include/asm/uaccess.h linux-2.6.39.1/arch/s390/include/asm/uaccess.h
4510--- linux-2.6.39.1/arch/s390/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
4511+++ linux-2.6.39.1/arch/s390/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
4512@@ -234,6 +234,10 @@ static inline unsigned long __must_check
4513 copy_to_user(void __user *to, const void *from, unsigned long n)
4514 {
4515 might_fault();
4516+
4517+ if ((long)n < 0)
4518+ return n;
4519+
4520 if (access_ok(VERIFY_WRITE, to, n))
4521 n = __copy_to_user(to, from, n);
4522 return n;
4523@@ -259,6 +263,9 @@ copy_to_user(void __user *to, const void
4524 static inline unsigned long __must_check
4525 __copy_from_user(void *to, const void __user *from, unsigned long n)
4526 {
4527+ if ((long)n < 0)
4528+ return n;
4529+
4530 if (__builtin_constant_p(n) && (n <= 256))
4531 return uaccess.copy_from_user_small(n, from, to);
4532 else
4533@@ -293,6 +300,10 @@ copy_from_user(void *to, const void __us
4534 unsigned int sz = __compiletime_object_size(to);
4535
4536 might_fault();
4537+
4538+ if ((long)n < 0)
4539+ return n;
4540+
4541 if (unlikely(sz != -1 && sz < n)) {
4542 copy_from_user_overflow();
4543 return n;
4544diff -urNp linux-2.6.39.1/arch/s390/Kconfig linux-2.6.39.1/arch/s390/Kconfig
4545--- linux-2.6.39.1/arch/s390/Kconfig 2011-05-19 00:06:34.000000000 -0400
4546+++ linux-2.6.39.1/arch/s390/Kconfig 2011-05-22 19:36:30.000000000 -0400
4547@@ -234,11 +234,9 @@ config S390_EXEC_PROTECT
4548 prompt "Data execute protection"
4549 help
4550 This option allows to enable a buffer overflow protection for user
4551- space programs and it also selects the addressing mode option above.
4552- The kernel parameter noexec=on will enable this feature and also
4553- switch the addressing modes, default is disabled. Enabling this (via
4554- kernel parameter) on machines earlier than IBM System z9 this will
4555- reduce system performance.
4556+ space programs.
4557+ Enabling this (via kernel parameter) on machines earlier than IBM
4558+ System z9 this will reduce system performance.
4559
4560 comment "Code generation options"
4561
4562diff -urNp linux-2.6.39.1/arch/s390/kernel/module.c linux-2.6.39.1/arch/s390/kernel/module.c
4563--- linux-2.6.39.1/arch/s390/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
4564+++ linux-2.6.39.1/arch/s390/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
4565@@ -168,11 +168,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
4566
4567 /* Increase core size by size of got & plt and set start
4568 offsets for got and plt. */
4569- me->core_size = ALIGN(me->core_size, 4);
4570- me->arch.got_offset = me->core_size;
4571- me->core_size += me->arch.got_size;
4572- me->arch.plt_offset = me->core_size;
4573- me->core_size += me->arch.plt_size;
4574+ me->core_size_rw = ALIGN(me->core_size_rw, 4);
4575+ me->arch.got_offset = me->core_size_rw;
4576+ me->core_size_rw += me->arch.got_size;
4577+ me->arch.plt_offset = me->core_size_rx;
4578+ me->core_size_rx += me->arch.plt_size;
4579 return 0;
4580 }
4581
4582@@ -258,7 +258,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4583 if (info->got_initialized == 0) {
4584 Elf_Addr *gotent;
4585
4586- gotent = me->module_core + me->arch.got_offset +
4587+ gotent = me->module_core_rw + me->arch.got_offset +
4588 info->got_offset;
4589 *gotent = val;
4590 info->got_initialized = 1;
4591@@ -282,7 +282,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4592 else if (r_type == R_390_GOTENT ||
4593 r_type == R_390_GOTPLTENT)
4594 *(unsigned int *) loc =
4595- (val + (Elf_Addr) me->module_core - loc) >> 1;
4596+ (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
4597 else if (r_type == R_390_GOT64 ||
4598 r_type == R_390_GOTPLT64)
4599 *(unsigned long *) loc = val;
4600@@ -296,7 +296,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4601 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
4602 if (info->plt_initialized == 0) {
4603 unsigned int *ip;
4604- ip = me->module_core + me->arch.plt_offset +
4605+ ip = me->module_core_rx + me->arch.plt_offset +
4606 info->plt_offset;
4607 #ifndef CONFIG_64BIT
4608 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
4609@@ -321,7 +321,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4610 val - loc + 0xffffUL < 0x1ffffeUL) ||
4611 (r_type == R_390_PLT32DBL &&
4612 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
4613- val = (Elf_Addr) me->module_core +
4614+ val = (Elf_Addr) me->module_core_rx +
4615 me->arch.plt_offset +
4616 info->plt_offset;
4617 val += rela->r_addend - loc;
4618@@ -343,7 +343,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4619 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
4620 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
4621 val = val + rela->r_addend -
4622- ((Elf_Addr) me->module_core + me->arch.got_offset);
4623+ ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
4624 if (r_type == R_390_GOTOFF16)
4625 *(unsigned short *) loc = val;
4626 else if (r_type == R_390_GOTOFF32)
4627@@ -353,7 +353,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4628 break;
4629 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
4630 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
4631- val = (Elf_Addr) me->module_core + me->arch.got_offset +
4632+ val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
4633 rela->r_addend - loc;
4634 if (r_type == R_390_GOTPC)
4635 *(unsigned int *) loc = val;
4636diff -urNp linux-2.6.39.1/arch/s390/kernel/process.c linux-2.6.39.1/arch/s390/kernel/process.c
4637--- linux-2.6.39.1/arch/s390/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
4638+++ linux-2.6.39.1/arch/s390/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
4639@@ -334,39 +334,3 @@ unsigned long get_wchan(struct task_stru
4640 }
4641 return 0;
4642 }
4643-
4644-unsigned long arch_align_stack(unsigned long sp)
4645-{
4646- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
4647- sp -= get_random_int() & ~PAGE_MASK;
4648- return sp & ~0xf;
4649-}
4650-
4651-static inline unsigned long brk_rnd(void)
4652-{
4653- /* 8MB for 32bit, 1GB for 64bit */
4654- if (is_32bit_task())
4655- return (get_random_int() & 0x7ffUL) << PAGE_SHIFT;
4656- else
4657- return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT;
4658-}
4659-
4660-unsigned long arch_randomize_brk(struct mm_struct *mm)
4661-{
4662- unsigned long ret = PAGE_ALIGN(mm->brk + brk_rnd());
4663-
4664- if (ret < mm->brk)
4665- return mm->brk;
4666- return ret;
4667-}
4668-
4669-unsigned long randomize_et_dyn(unsigned long base)
4670-{
4671- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
4672-
4673- if (!(current->flags & PF_RANDOMIZE))
4674- return base;
4675- if (ret < base)
4676- return base;
4677- return ret;
4678-}
4679diff -urNp linux-2.6.39.1/arch/s390/kernel/setup.c linux-2.6.39.1/arch/s390/kernel/setup.c
4680--- linux-2.6.39.1/arch/s390/kernel/setup.c 2011-05-19 00:06:34.000000000 -0400
4681+++ linux-2.6.39.1/arch/s390/kernel/setup.c 2011-05-22 19:36:30.000000000 -0400
4682@@ -271,7 +271,7 @@ static int __init early_parse_mem(char *
4683 }
4684 early_param("mem", early_parse_mem);
4685
4686-unsigned int user_mode = HOME_SPACE_MODE;
4687+unsigned int user_mode = SECONDARY_SPACE_MODE;
4688 EXPORT_SYMBOL_GPL(user_mode);
4689
4690 static int set_amode_and_uaccess(unsigned long user_amode,
4691@@ -300,17 +300,6 @@ static int set_amode_and_uaccess(unsigne
4692 }
4693 }
4694
4695-/*
4696- * Switch kernel/user addressing modes?
4697- */
4698-static int __init early_parse_switch_amode(char *p)
4699-{
4700- if (user_mode != SECONDARY_SPACE_MODE)
4701- user_mode = PRIMARY_SPACE_MODE;
4702- return 0;
4703-}
4704-early_param("switch_amode", early_parse_switch_amode);
4705-
4706 static int __init early_parse_user_mode(char *p)
4707 {
4708 if (p && strcmp(p, "primary") == 0)
4709@@ -327,20 +316,6 @@ static int __init early_parse_user_mode(
4710 }
4711 early_param("user_mode", early_parse_user_mode);
4712
4713-#ifdef CONFIG_S390_EXEC_PROTECT
4714-/*
4715- * Enable execute protection?
4716- */
4717-static int __init early_parse_noexec(char *p)
4718-{
4719- if (!strncmp(p, "off", 3))
4720- return 0;
4721- user_mode = SECONDARY_SPACE_MODE;
4722- return 0;
4723-}
4724-early_param("noexec", early_parse_noexec);
4725-#endif /* CONFIG_S390_EXEC_PROTECT */
4726-
4727 static void setup_addressing_mode(void)
4728 {
4729 if (user_mode == SECONDARY_SPACE_MODE) {
4730diff -urNp linux-2.6.39.1/arch/s390/mm/maccess.c linux-2.6.39.1/arch/s390/mm/maccess.c
4731--- linux-2.6.39.1/arch/s390/mm/maccess.c 2011-05-19 00:06:34.000000000 -0400
4732+++ linux-2.6.39.1/arch/s390/mm/maccess.c 2011-05-22 19:36:30.000000000 -0400
4733@@ -45,7 +45,7 @@ static long probe_kernel_write_odd(void
4734 return rc ? rc : count;
4735 }
4736
4737-long probe_kernel_write(void *dst, void *src, size_t size)
4738+long probe_kernel_write(void *dst, const void *src, size_t size)
4739 {
4740 long copied = 0;
4741
4742diff -urNp linux-2.6.39.1/arch/s390/mm/mmap.c linux-2.6.39.1/arch/s390/mm/mmap.c
4743--- linux-2.6.39.1/arch/s390/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
4744+++ linux-2.6.39.1/arch/s390/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
4745@@ -91,10 +91,22 @@ void arch_pick_mmap_layout(struct mm_str
4746 */
4747 if (mmap_is_legacy()) {
4748 mm->mmap_base = TASK_UNMAPPED_BASE;
4749+
4750+#ifdef CONFIG_PAX_RANDMMAP
4751+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4752+ mm->mmap_base += mm->delta_mmap;
4753+#endif
4754+
4755 mm->get_unmapped_area = arch_get_unmapped_area;
4756 mm->unmap_area = arch_unmap_area;
4757 } else {
4758 mm->mmap_base = mmap_base();
4759+
4760+#ifdef CONFIG_PAX_RANDMMAP
4761+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4762+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4763+#endif
4764+
4765 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4766 mm->unmap_area = arch_unmap_area_topdown;
4767 }
4768@@ -166,10 +178,22 @@ void arch_pick_mmap_layout(struct mm_str
4769 */
4770 if (mmap_is_legacy()) {
4771 mm->mmap_base = TASK_UNMAPPED_BASE;
4772+
4773+#ifdef CONFIG_PAX_RANDMMAP
4774+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4775+ mm->mmap_base += mm->delta_mmap;
4776+#endif
4777+
4778 mm->get_unmapped_area = s390_get_unmapped_area;
4779 mm->unmap_area = arch_unmap_area;
4780 } else {
4781 mm->mmap_base = mmap_base();
4782+
4783+#ifdef CONFIG_PAX_RANDMMAP
4784+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4785+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4786+#endif
4787+
4788 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
4789 mm->unmap_area = arch_unmap_area_topdown;
4790 }
4791diff -urNp linux-2.6.39.1/arch/score/include/asm/system.h linux-2.6.39.1/arch/score/include/asm/system.h
4792--- linux-2.6.39.1/arch/score/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
4793+++ linux-2.6.39.1/arch/score/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
4794@@ -17,7 +17,7 @@ do { \
4795 #define finish_arch_switch(prev) do {} while (0)
4796
4797 typedef void (*vi_handler_t)(void);
4798-extern unsigned long arch_align_stack(unsigned long sp);
4799+#define arch_align_stack(x) (x)
4800
4801 #define mb() barrier()
4802 #define rmb() barrier()
4803diff -urNp linux-2.6.39.1/arch/score/kernel/process.c linux-2.6.39.1/arch/score/kernel/process.c
4804--- linux-2.6.39.1/arch/score/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
4805+++ linux-2.6.39.1/arch/score/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
4806@@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_stru
4807
4808 return task_pt_regs(task)->cp0_epc;
4809 }
4810-
4811-unsigned long arch_align_stack(unsigned long sp)
4812-{
4813- return sp;
4814-}
4815diff -urNp linux-2.6.39.1/arch/sh/drivers/pci/ops-dreamcast.c linux-2.6.39.1/arch/sh/drivers/pci/ops-dreamcast.c
4816--- linux-2.6.39.1/arch/sh/drivers/pci/ops-dreamcast.c 2011-05-19 00:06:34.000000000 -0400
4817+++ linux-2.6.39.1/arch/sh/drivers/pci/ops-dreamcast.c 2011-05-22 19:36:30.000000000 -0400
4818@@ -76,7 +76,7 @@ static int gapspci_write(struct pci_bus
4819 return PCIBIOS_SUCCESSFUL;
4820 }
4821
4822-struct pci_ops gapspci_pci_ops = {
4823+const struct pci_ops gapspci_pci_ops = {
4824 .read = gapspci_read,
4825 .write = gapspci_write,
4826 };
4827diff -urNp linux-2.6.39.1/arch/sh/drivers/pci/ops-sh4.c linux-2.6.39.1/arch/sh/drivers/pci/ops-sh4.c
4828--- linux-2.6.39.1/arch/sh/drivers/pci/ops-sh4.c 2011-05-19 00:06:34.000000000 -0400
4829+++ linux-2.6.39.1/arch/sh/drivers/pci/ops-sh4.c 2011-05-22 19:36:30.000000000 -0400
4830@@ -96,7 +96,7 @@ static int sh4_pci_write(struct pci_bus
4831 return PCIBIOS_SUCCESSFUL;
4832 }
4833
4834-struct pci_ops sh4_pci_ops = {
4835+const struct pci_ops sh4_pci_ops = {
4836 .read = sh4_pci_read,
4837 .write = sh4_pci_write,
4838 };
4839diff -urNp linux-2.6.39.1/arch/sh/drivers/pci/ops-sh5.c linux-2.6.39.1/arch/sh/drivers/pci/ops-sh5.c
4840--- linux-2.6.39.1/arch/sh/drivers/pci/ops-sh5.c 2011-05-19 00:06:34.000000000 -0400
4841+++ linux-2.6.39.1/arch/sh/drivers/pci/ops-sh5.c 2011-05-22 19:36:30.000000000 -0400
4842@@ -62,7 +62,7 @@ static int sh5pci_write(struct pci_bus *
4843 return PCIBIOS_SUCCESSFUL;
4844 }
4845
4846-struct pci_ops sh5_pci_ops = {
4847+const struct pci_ops sh5_pci_ops = {
4848 .read = sh5pci_read,
4849 .write = sh5pci_write,
4850 };
4851diff -urNp linux-2.6.39.1/arch/sh/drivers/pci/ops-sh7786.c linux-2.6.39.1/arch/sh/drivers/pci/ops-sh7786.c
4852--- linux-2.6.39.1/arch/sh/drivers/pci/ops-sh7786.c 2011-05-19 00:06:34.000000000 -0400
4853+++ linux-2.6.39.1/arch/sh/drivers/pci/ops-sh7786.c 2011-05-22 19:36:30.000000000 -0400
4854@@ -165,7 +165,7 @@ out:
4855 return ret;
4856 }
4857
4858-struct pci_ops sh7786_pci_ops = {
4859+const struct pci_ops sh7786_pci_ops = {
4860 .read = sh7786_pcie_read,
4861 .write = sh7786_pcie_write,
4862 };
4863diff -urNp linux-2.6.39.1/arch/sh/drivers/pci/pcie-sh7786.c linux-2.6.39.1/arch/sh/drivers/pci/pcie-sh7786.c
4864--- linux-2.6.39.1/arch/sh/drivers/pci/pcie-sh7786.c 2011-05-19 00:06:34.000000000 -0400
4865+++ linux-2.6.39.1/arch/sh/drivers/pci/pcie-sh7786.c 2011-05-22 19:36:30.000000000 -0400
4866@@ -109,7 +109,7 @@ static struct resource sh7786_pci2_resou
4867 },
4868 };
4869
4870-extern struct pci_ops sh7786_pci_ops;
4871+extern const struct pci_ops sh7786_pci_ops;
4872
4873 #define DEFINE_CONTROLLER(start, idx) \
4874 { \
4875diff -urNp linux-2.6.39.1/arch/sh/drivers/pci/pci-sh4.h linux-2.6.39.1/arch/sh/drivers/pci/pci-sh4.h
4876--- linux-2.6.39.1/arch/sh/drivers/pci/pci-sh4.h 2011-05-19 00:06:34.000000000 -0400
4877+++ linux-2.6.39.1/arch/sh/drivers/pci/pci-sh4.h 2011-05-22 19:36:30.000000000 -0400
4878@@ -161,7 +161,7 @@
4879 #define SH4_PCIPDR 0x220 /* Port IO Data Register */
4880
4881 /* arch/sh/kernel/drivers/pci/ops-sh4.c */
4882-extern struct pci_ops sh4_pci_ops;
4883+extern const struct pci_ops sh4_pci_ops;
4884 int pci_fixup_pcic(struct pci_channel *chan);
4885
4886 struct sh4_pci_address_space {
4887diff -urNp linux-2.6.39.1/arch/sh/drivers/pci/pci-sh5.h linux-2.6.39.1/arch/sh/drivers/pci/pci-sh5.h
4888--- linux-2.6.39.1/arch/sh/drivers/pci/pci-sh5.h 2011-05-19 00:06:34.000000000 -0400
4889+++ linux-2.6.39.1/arch/sh/drivers/pci/pci-sh5.h 2011-05-22 19:36:30.000000000 -0400
4890@@ -105,6 +105,6 @@ extern unsigned long pcicr_virt;
4891 #define PCISH5_MEM_SIZCONV(x) (((x / 0x40000) - 1) << 18)
4892 #define PCISH5_IO_SIZCONV(x) (((x / 0x40000) - 1) << 18)
4893
4894-extern struct pci_ops sh5_pci_ops;
4895+extern const struct pci_ops sh5_pci_ops;
4896
4897 #endif /* __PCI_SH5_H */
4898diff -urNp linux-2.6.39.1/arch/sh/include/asm/dma-mapping.h linux-2.6.39.1/arch/sh/include/asm/dma-mapping.h
4899--- linux-2.6.39.1/arch/sh/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
4900+++ linux-2.6.39.1/arch/sh/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
4901@@ -1,10 +1,10 @@
4902 #ifndef __ASM_SH_DMA_MAPPING_H
4903 #define __ASM_SH_DMA_MAPPING_H
4904
4905-extern struct dma_map_ops *dma_ops;
4906+extern const struct dma_map_ops *dma_ops;
4907 extern void no_iommu_init(void);
4908
4909-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
4910+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
4911 {
4912 return dma_ops;
4913 }
4914@@ -14,7 +14,7 @@ static inline struct dma_map_ops *get_dm
4915
4916 static inline int dma_supported(struct device *dev, u64 mask)
4917 {
4918- struct dma_map_ops *ops = get_dma_ops(dev);
4919+ const struct dma_map_ops *ops = get_dma_ops(dev);
4920
4921 if (ops->dma_supported)
4922 return ops->dma_supported(dev, mask);
4923@@ -24,7 +24,7 @@ static inline int dma_supported(struct d
4924
4925 static inline int dma_set_mask(struct device *dev, u64 mask)
4926 {
4927- struct dma_map_ops *ops = get_dma_ops(dev);
4928+ const struct dma_map_ops *ops = get_dma_ops(dev);
4929
4930 if (!dev->dma_mask || !dma_supported(dev, mask))
4931 return -EIO;
4932@@ -44,7 +44,7 @@ void dma_cache_sync(struct device *dev,
4933
4934 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
4935 {
4936- struct dma_map_ops *ops = get_dma_ops(dev);
4937+ const struct dma_map_ops *ops = get_dma_ops(dev);
4938
4939 if (ops->mapping_error)
4940 return ops->mapping_error(dev, dma_addr);
4941@@ -55,7 +55,7 @@ static inline int dma_mapping_error(stru
4942 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
4943 dma_addr_t *dma_handle, gfp_t gfp)
4944 {
4945- struct dma_map_ops *ops = get_dma_ops(dev);
4946+ const struct dma_map_ops *ops = get_dma_ops(dev);
4947 void *memory;
4948
4949 if (dma_alloc_from_coherent(dev, size, dma_handle, &memory))
4950@@ -72,7 +72,7 @@ static inline void *dma_alloc_coherent(s
4951 static inline void dma_free_coherent(struct device *dev, size_t size,
4952 void *vaddr, dma_addr_t dma_handle)
4953 {
4954- struct dma_map_ops *ops = get_dma_ops(dev);
4955+ const struct dma_map_ops *ops = get_dma_ops(dev);
4956
4957 if (dma_release_from_coherent(dev, get_order(size), vaddr))
4958 return;
4959diff -urNp linux-2.6.39.1/arch/sh/kernel/dma-nommu.c linux-2.6.39.1/arch/sh/kernel/dma-nommu.c
4960--- linux-2.6.39.1/arch/sh/kernel/dma-nommu.c 2011-05-19 00:06:34.000000000 -0400
4961+++ linux-2.6.39.1/arch/sh/kernel/dma-nommu.c 2011-05-22 19:36:30.000000000 -0400
4962@@ -62,7 +62,7 @@ static void nommu_sync_sg(struct device
4963 }
4964 #endif
4965
4966-struct dma_map_ops nommu_dma_ops = {
4967+const struct dma_map_ops nommu_dma_ops = {
4968 .alloc_coherent = dma_generic_alloc_coherent,
4969 .free_coherent = dma_generic_free_coherent,
4970 .map_page = nommu_map_page,
4971diff -urNp linux-2.6.39.1/arch/sh/kernel/kgdb.c linux-2.6.39.1/arch/sh/kernel/kgdb.c
4972--- linux-2.6.39.1/arch/sh/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
4973+++ linux-2.6.39.1/arch/sh/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
4974@@ -319,7 +319,7 @@ void kgdb_arch_exit(void)
4975 unregister_die_notifier(&kgdb_notifier);
4976 }
4977
4978-struct kgdb_arch arch_kgdb_ops = {
4979+const struct kgdb_arch arch_kgdb_ops = {
4980 /* Breakpoint instruction: trapa #0x3c */
4981 #ifdef CONFIG_CPU_LITTLE_ENDIAN
4982 .gdb_bpt_instr = { 0x3c, 0xc3 },
4983diff -urNp linux-2.6.39.1/arch/sh/mm/consistent.c linux-2.6.39.1/arch/sh/mm/consistent.c
4984--- linux-2.6.39.1/arch/sh/mm/consistent.c 2011-05-19 00:06:34.000000000 -0400
4985+++ linux-2.6.39.1/arch/sh/mm/consistent.c 2011-05-22 19:36:30.000000000 -0400
4986@@ -22,7 +22,7 @@
4987
4988 #define PREALLOC_DMA_DEBUG_ENTRIES 4096
4989
4990-struct dma_map_ops *dma_ops;
4991+const struct dma_map_ops *dma_ops;
4992 EXPORT_SYMBOL(dma_ops);
4993
4994 static int __init dma_init(void)
4995diff -urNp linux-2.6.39.1/arch/sh/mm/mmap.c linux-2.6.39.1/arch/sh/mm/mmap.c
4996--- linux-2.6.39.1/arch/sh/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
4997+++ linux-2.6.39.1/arch/sh/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
4998@@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(str
4999 addr = PAGE_ALIGN(addr);
5000
5001 vma = find_vma(mm, addr);
5002- if (TASK_SIZE - len >= addr &&
5003- (!vma || addr + len <= vma->vm_start))
5004+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
5005 return addr;
5006 }
5007
5008@@ -106,7 +105,7 @@ full_search:
5009 }
5010 return -ENOMEM;
5011 }
5012- if (likely(!vma || addr + len <= vma->vm_start)) {
5013+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5014 /*
5015 * Remember the place where we stopped the search:
5016 */
5017@@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct fi
5018 addr = PAGE_ALIGN(addr);
5019
5020 vma = find_vma(mm, addr);
5021- if (TASK_SIZE - len >= addr &&
5022- (!vma || addr + len <= vma->vm_start))
5023+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
5024 return addr;
5025 }
5026
5027@@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct fi
5028 /* make sure it can fit in the remaining address space */
5029 if (likely(addr > len)) {
5030 vma = find_vma(mm, addr-len);
5031- if (!vma || addr <= vma->vm_start) {
5032+ if (check_heap_stack_gap(vma, addr - len, len)) {
5033 /* remember the address as a hint for next time */
5034 return (mm->free_area_cache = addr-len);
5035 }
5036@@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct fi
5037 if (unlikely(mm->mmap_base < len))
5038 goto bottomup;
5039
5040- addr = mm->mmap_base-len;
5041- if (do_colour_align)
5042- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5043+ addr = mm->mmap_base - len;
5044
5045 do {
5046+ if (do_colour_align)
5047+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5048 /*
5049 * Lookup failure means no vma is above this address,
5050 * else if new region fits below vma->vm_start,
5051 * return with success:
5052 */
5053 vma = find_vma(mm, addr);
5054- if (likely(!vma || addr+len <= vma->vm_start)) {
5055+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5056 /* remember the address as a hint for next time */
5057 return (mm->free_area_cache = addr);
5058 }
5059@@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct fi
5060 mm->cached_hole_size = vma->vm_start - addr;
5061
5062 /* try just below the current vma->vm_start */
5063- addr = vma->vm_start-len;
5064- if (do_colour_align)
5065- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5066- } while (likely(len < vma->vm_start));
5067+ addr = skip_heap_stack_gap(vma, len);
5068+ } while (!IS_ERR_VALUE(addr));
5069
5070 bottomup:
5071 /*
5072diff -urNp linux-2.6.39.1/arch/sparc/include/asm/atomic_64.h linux-2.6.39.1/arch/sparc/include/asm/atomic_64.h
5073--- linux-2.6.39.1/arch/sparc/include/asm/atomic_64.h 2011-05-19 00:06:34.000000000 -0400
5074+++ linux-2.6.39.1/arch/sparc/include/asm/atomic_64.h 2011-05-22 19:36:30.000000000 -0400
5075@@ -14,18 +14,40 @@
5076 #define ATOMIC64_INIT(i) { (i) }
5077
5078 #define atomic_read(v) (*(volatile int *)&(v)->counter)
5079+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
5080+{
5081+ return v->counter;
5082+}
5083 #define atomic64_read(v) (*(volatile long *)&(v)->counter)
5084+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
5085+{
5086+ return v->counter;
5087+}
5088
5089 #define atomic_set(v, i) (((v)->counter) = i)
5090+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
5091+{
5092+ v->counter = i;
5093+}
5094 #define atomic64_set(v, i) (((v)->counter) = i)
5095+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
5096+{
5097+ v->counter = i;
5098+}
5099
5100 extern void atomic_add(int, atomic_t *);
5101+extern void atomic_add_unchecked(int, atomic_unchecked_t *);
5102 extern void atomic64_add(long, atomic64_t *);
5103+extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
5104 extern void atomic_sub(int, atomic_t *);
5105+extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
5106 extern void atomic64_sub(long, atomic64_t *);
5107+extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
5108
5109 extern int atomic_add_ret(int, atomic_t *);
5110+extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
5111 extern long atomic64_add_ret(long, atomic64_t *);
5112+extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
5113 extern int atomic_sub_ret(int, atomic_t *);
5114 extern long atomic64_sub_ret(long, atomic64_t *);
5115
5116@@ -33,12 +55,24 @@ extern long atomic64_sub_ret(long, atomi
5117 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
5118
5119 #define atomic_inc_return(v) atomic_add_ret(1, v)
5120+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
5121+{
5122+ return atomic_add_ret_unchecked(1, v);
5123+}
5124 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
5125+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
5126+{
5127+ return atomic64_add_ret_unchecked(1, v);
5128+}
5129
5130 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
5131 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
5132
5133 #define atomic_add_return(i, v) atomic_add_ret(i, v)
5134+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
5135+{
5136+ return atomic_add_ret_unchecked(i, v);
5137+}
5138 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
5139
5140 /*
5141@@ -50,6 +84,7 @@ extern long atomic64_sub_ret(long, atomi
5142 * other cases.
5143 */
5144 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
5145+#define atomic_inc_and_test_unchecked(v) (atomic_inc_return_unchecked(v) == 0)
5146 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
5147
5148 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
5149@@ -59,30 +94,59 @@ extern long atomic64_sub_ret(long, atomi
5150 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
5151
5152 #define atomic_inc(v) atomic_add(1, v)
5153+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
5154+{
5155+ atomic_add_unchecked(1, v);
5156+}
5157 #define atomic64_inc(v) atomic64_add(1, v)
5158+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
5159+{
5160+ atomic64_add_unchecked(1, v);
5161+}
5162
5163 #define atomic_dec(v) atomic_sub(1, v)
5164+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
5165+{
5166+ atomic_sub_unchecked(1, v);
5167+}
5168 #define atomic64_dec(v) atomic64_sub(1, v)
5169+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
5170+{
5171+ atomic64_sub_unchecked(1, v);
5172+}
5173
5174 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
5175 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
5176
5177 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
5178+#define atomic_cmpxchg_unchecked(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
5179 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
5180+#define atomic_xchg_unchecked(v, new) (xchg(&((v)->counter), new))
5181
5182 static inline int atomic_add_unless(atomic_t *v, int a, int u)
5183 {
5184- int c, old;
5185+ int c, old, new;
5186 c = atomic_read(v);
5187 for (;;) {
5188- if (unlikely(c == (u)))
5189+ if (unlikely(c == u))
5190 break;
5191- old = atomic_cmpxchg((v), c, c + (a));
5192+
5193+ asm volatile("addcc %2, %0, %0\n"
5194+
5195+#ifdef CONFIG_PAX_REFCOUNT
5196+ "tvs %%icc, 6\n"
5197+#endif
5198+
5199+ : "=r" (new)
5200+ : "0" (c), "ir" (a)
5201+ : "cc");
5202+
5203+ old = atomic_cmpxchg(v, c, new);
5204 if (likely(old == c))
5205 break;
5206 c = old;
5207 }
5208- return c != (u);
5209+ return c != u;
5210 }
5211
5212 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
5213@@ -93,17 +157,28 @@ static inline int atomic_add_unless(atom
5214
5215 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
5216 {
5217- long c, old;
5218+ long c, old, new;
5219 c = atomic64_read(v);
5220 for (;;) {
5221- if (unlikely(c == (u)))
5222+ if (unlikely(c == u))
5223 break;
5224- old = atomic64_cmpxchg((v), c, c + (a));
5225+
5226+ asm volatile("addcc %2, %0, %0\n"
5227+
5228+#ifdef CONFIG_PAX_REFCOUNT
5229+ "tvs %%xcc, 6\n"
5230+#endif
5231+
5232+ : "=r" (new)
5233+ : "0" (c), "ir" (a)
5234+ : "cc");
5235+
5236+ old = atomic64_cmpxchg(v, c, new);
5237 if (likely(old == c))
5238 break;
5239 c = old;
5240 }
5241- return c != (u);
5242+ return c != u;
5243 }
5244
5245 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
5246diff -urNp linux-2.6.39.1/arch/sparc/include/asm/cache.h linux-2.6.39.1/arch/sparc/include/asm/cache.h
5247--- linux-2.6.39.1/arch/sparc/include/asm/cache.h 2011-05-19 00:06:34.000000000 -0400
5248+++ linux-2.6.39.1/arch/sparc/include/asm/cache.h 2011-05-22 19:36:30.000000000 -0400
5249@@ -10,7 +10,7 @@
5250 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
5251
5252 #define L1_CACHE_SHIFT 5
5253-#define L1_CACHE_BYTES 32
5254+#define L1_CACHE_BYTES 32U
5255
5256 #ifdef CONFIG_SPARC32
5257 #define SMP_CACHE_BYTES_SHIFT 5
5258diff -urNp linux-2.6.39.1/arch/sparc/include/asm/dma-mapping.h linux-2.6.39.1/arch/sparc/include/asm/dma-mapping.h
5259--- linux-2.6.39.1/arch/sparc/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
5260+++ linux-2.6.39.1/arch/sparc/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
5261@@ -12,10 +12,10 @@ extern int dma_supported(struct device *
5262 #define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
5263 #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
5264
5265-extern struct dma_map_ops *dma_ops, pci32_dma_ops;
5266+extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
5267 extern struct bus_type pci_bus_type;
5268
5269-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
5270+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
5271 {
5272 #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
5273 if (dev->bus == &pci_bus_type)
5274@@ -29,7 +29,7 @@ static inline struct dma_map_ops *get_dm
5275 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
5276 dma_addr_t *dma_handle, gfp_t flag)
5277 {
5278- struct dma_map_ops *ops = get_dma_ops(dev);
5279+ const struct dma_map_ops *ops = get_dma_ops(dev);
5280 void *cpu_addr;
5281
5282 cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
5283@@ -40,7 +40,7 @@ static inline void *dma_alloc_coherent(s
5284 static inline void dma_free_coherent(struct device *dev, size_t size,
5285 void *cpu_addr, dma_addr_t dma_handle)
5286 {
5287- struct dma_map_ops *ops = get_dma_ops(dev);
5288+ const struct dma_map_ops *ops = get_dma_ops(dev);
5289
5290 debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
5291 ops->free_coherent(dev, size, cpu_addr, dma_handle);
5292diff -urNp linux-2.6.39.1/arch/sparc/include/asm/elf_32.h linux-2.6.39.1/arch/sparc/include/asm/elf_32.h
5293--- linux-2.6.39.1/arch/sparc/include/asm/elf_32.h 2011-05-19 00:06:34.000000000 -0400
5294+++ linux-2.6.39.1/arch/sparc/include/asm/elf_32.h 2011-05-22 19:36:30.000000000 -0400
5295@@ -114,6 +114,13 @@ typedef struct {
5296
5297 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
5298
5299+#ifdef CONFIG_PAX_ASLR
5300+#define PAX_ELF_ET_DYN_BASE 0x10000UL
5301+
5302+#define PAX_DELTA_MMAP_LEN 16
5303+#define PAX_DELTA_STACK_LEN 16
5304+#endif
5305+
5306 /* This yields a mask that user programs can use to figure out what
5307 instruction set this cpu supports. This can NOT be done in userspace
5308 on Sparc. */
5309diff -urNp linux-2.6.39.1/arch/sparc/include/asm/elf_64.h linux-2.6.39.1/arch/sparc/include/asm/elf_64.h
5310--- linux-2.6.39.1/arch/sparc/include/asm/elf_64.h 2011-05-19 00:06:34.000000000 -0400
5311+++ linux-2.6.39.1/arch/sparc/include/asm/elf_64.h 2011-05-22 19:36:30.000000000 -0400
5312@@ -162,6 +162,12 @@ typedef struct {
5313 #define ELF_ET_DYN_BASE 0x0000010000000000UL
5314 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
5315
5316+#ifdef CONFIG_PAX_ASLR
5317+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
5318+
5319+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
5320+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
5321+#endif
5322
5323 /* This yields a mask that user programs can use to figure out what
5324 instruction set this cpu supports. */
5325diff -urNp linux-2.6.39.1/arch/sparc/include/asm/pgtable_32.h linux-2.6.39.1/arch/sparc/include/asm/pgtable_32.h
5326--- linux-2.6.39.1/arch/sparc/include/asm/pgtable_32.h 2011-05-19 00:06:34.000000000 -0400
5327+++ linux-2.6.39.1/arch/sparc/include/asm/pgtable_32.h 2011-05-22 19:36:30.000000000 -0400
5328@@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
5329 BTFIXUPDEF_INT(page_none)
5330 BTFIXUPDEF_INT(page_copy)
5331 BTFIXUPDEF_INT(page_readonly)
5332+
5333+#ifdef CONFIG_PAX_PAGEEXEC
5334+BTFIXUPDEF_INT(page_shared_noexec)
5335+BTFIXUPDEF_INT(page_copy_noexec)
5336+BTFIXUPDEF_INT(page_readonly_noexec)
5337+#endif
5338+
5339 BTFIXUPDEF_INT(page_kernel)
5340
5341 #define PMD_SHIFT SUN4C_PMD_SHIFT
5342@@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
5343 #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
5344 #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
5345
5346+#ifdef CONFIG_PAX_PAGEEXEC
5347+extern pgprot_t PAGE_SHARED_NOEXEC;
5348+# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
5349+# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
5350+#else
5351+# define PAGE_SHARED_NOEXEC PAGE_SHARED
5352+# define PAGE_COPY_NOEXEC PAGE_COPY
5353+# define PAGE_READONLY_NOEXEC PAGE_READONLY
5354+#endif
5355+
5356 extern unsigned long page_kernel;
5357
5358 #ifdef MODULE
5359diff -urNp linux-2.6.39.1/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.39.1/arch/sparc/include/asm/pgtsrmmu.h
5360--- linux-2.6.39.1/arch/sparc/include/asm/pgtsrmmu.h 2011-05-19 00:06:34.000000000 -0400
5361+++ linux-2.6.39.1/arch/sparc/include/asm/pgtsrmmu.h 2011-05-22 19:36:30.000000000 -0400
5362@@ -115,6 +115,13 @@
5363 SRMMU_EXEC | SRMMU_REF)
5364 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
5365 SRMMU_EXEC | SRMMU_REF)
5366+
5367+#ifdef CONFIG_PAX_PAGEEXEC
5368+#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
5369+#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
5370+#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
5371+#endif
5372+
5373 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
5374 SRMMU_DIRTY | SRMMU_REF)
5375
5376diff -urNp linux-2.6.39.1/arch/sparc/include/asm/spinlock_64.h linux-2.6.39.1/arch/sparc/include/asm/spinlock_64.h
5377--- linux-2.6.39.1/arch/sparc/include/asm/spinlock_64.h 2011-05-19 00:06:34.000000000 -0400
5378+++ linux-2.6.39.1/arch/sparc/include/asm/spinlock_64.h 2011-05-22 19:36:30.000000000 -0400
5379@@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags(
5380
5381 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
5382
5383-static void inline arch_read_lock(arch_rwlock_t *lock)
5384+static inline void arch_read_lock(arch_rwlock_t *lock)
5385 {
5386 unsigned long tmp1, tmp2;
5387
5388 __asm__ __volatile__ (
5389 "1: ldsw [%2], %0\n"
5390 " brlz,pn %0, 2f\n"
5391-"4: add %0, 1, %1\n"
5392+"4: addcc %0, 1, %1\n"
5393+
5394+#ifdef CONFIG_PAX_REFCOUNT
5395+" tvs %%icc, 6\n"
5396+#endif
5397+
5398 " cas [%2], %0, %1\n"
5399 " cmp %0, %1\n"
5400 " bne,pn %%icc, 1b\n"
5401@@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_r
5402 " .previous"
5403 : "=&r" (tmp1), "=&r" (tmp2)
5404 : "r" (lock)
5405- : "memory");
5406+ : "memory", "cc");
5407 }
5408
5409-static int inline arch_read_trylock(arch_rwlock_t *lock)
5410+static inline int arch_read_trylock(arch_rwlock_t *lock)
5411 {
5412 int tmp1, tmp2;
5413
5414@@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch
5415 "1: ldsw [%2], %0\n"
5416 " brlz,a,pn %0, 2f\n"
5417 " mov 0, %0\n"
5418-" add %0, 1, %1\n"
5419+" addcc %0, 1, %1\n"
5420+
5421+#ifdef CONFIG_PAX_REFCOUNT
5422+" tvs %%icc, 6\n"
5423+#endif
5424+
5425 " cas [%2], %0, %1\n"
5426 " cmp %0, %1\n"
5427 " bne,pn %%icc, 1b\n"
5428@@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch
5429 return tmp1;
5430 }
5431
5432-static void inline arch_read_unlock(arch_rwlock_t *lock)
5433+static inline void arch_read_unlock(arch_rwlock_t *lock)
5434 {
5435 unsigned long tmp1, tmp2;
5436
5437 __asm__ __volatile__(
5438 "1: lduw [%2], %0\n"
5439-" sub %0, 1, %1\n"
5440+" subcc %0, 1, %1\n"
5441+
5442+#ifdef CONFIG_PAX_REFCOUNT
5443+" tvs %%icc, 6\n"
5444+#endif
5445+
5446 " cas [%2], %0, %1\n"
5447 " cmp %0, %1\n"
5448 " bne,pn %%xcc, 1b\n"
5449@@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch
5450 : "memory");
5451 }
5452
5453-static void inline arch_write_lock(arch_rwlock_t *lock)
5454+static inline void arch_write_lock(arch_rwlock_t *lock)
5455 {
5456 unsigned long mask, tmp1, tmp2;
5457
5458@@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_
5459 : "memory");
5460 }
5461
5462-static void inline arch_write_unlock(arch_rwlock_t *lock)
5463+static inline void arch_write_unlock(arch_rwlock_t *lock)
5464 {
5465 __asm__ __volatile__(
5466 " stw %%g0, [%0]"
5467@@ -186,7 +201,7 @@ static void inline arch_write_unlock(arc
5468 : "memory");
5469 }
5470
5471-static int inline arch_write_trylock(arch_rwlock_t *lock)
5472+static inline int arch_write_trylock(arch_rwlock_t *lock)
5473 {
5474 unsigned long mask, tmp1, tmp2, result;
5475
5476diff -urNp linux-2.6.39.1/arch/sparc/include/asm/thread_info_32.h linux-2.6.39.1/arch/sparc/include/asm/thread_info_32.h
5477--- linux-2.6.39.1/arch/sparc/include/asm/thread_info_32.h 2011-05-19 00:06:34.000000000 -0400
5478+++ linux-2.6.39.1/arch/sparc/include/asm/thread_info_32.h 2011-06-03 01:14:03.000000000 -0400
5479@@ -50,6 +50,8 @@ struct thread_info {
5480 unsigned long w_saved;
5481
5482 struct restart_block restart_block;
5483+
5484+ unsigned long lowest_stack;
5485 };
5486
5487 /*
5488diff -urNp linux-2.6.39.1/arch/sparc/include/asm/thread_info_64.h linux-2.6.39.1/arch/sparc/include/asm/thread_info_64.h
5489--- linux-2.6.39.1/arch/sparc/include/asm/thread_info_64.h 2011-05-19 00:06:34.000000000 -0400
5490+++ linux-2.6.39.1/arch/sparc/include/asm/thread_info_64.h 2011-06-03 01:14:21.000000000 -0400
5491@@ -63,6 +63,8 @@ struct thread_info {
5492 struct pt_regs *kern_una_regs;
5493 unsigned int kern_una_insn;
5494
5495+ unsigned long lowest_stack;
5496+
5497 unsigned long fpregs[0] __attribute__ ((aligned(64)));
5498 };
5499
5500diff -urNp linux-2.6.39.1/arch/sparc/include/asm/uaccess_32.h linux-2.6.39.1/arch/sparc/include/asm/uaccess_32.h
5501--- linux-2.6.39.1/arch/sparc/include/asm/uaccess_32.h 2011-05-19 00:06:34.000000000 -0400
5502+++ linux-2.6.39.1/arch/sparc/include/asm/uaccess_32.h 2011-05-22 19:36:30.000000000 -0400
5503@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
5504
5505 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
5506 {
5507- if (n && __access_ok((unsigned long) to, n))
5508+ if ((long)n < 0)
5509+ return n;
5510+
5511+ if (n && __access_ok((unsigned long) to, n)) {
5512+ if (!__builtin_constant_p(n))
5513+ check_object_size(from, n, true);
5514 return __copy_user(to, (__force void __user *) from, n);
5515- else
5516+ } else
5517 return n;
5518 }
5519
5520 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
5521 {
5522+ if ((long)n < 0)
5523+ return n;
5524+
5525+ if (!__builtin_constant_p(n))
5526+ check_object_size(from, n, true);
5527+
5528 return __copy_user(to, (__force void __user *) from, n);
5529 }
5530
5531 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
5532 {
5533- if (n && __access_ok((unsigned long) from, n))
5534+ if ((long)n < 0)
5535+ return n;
5536+
5537+ if (n && __access_ok((unsigned long) from, n)) {
5538+ if (!__builtin_constant_p(n))
5539+ check_object_size(to, n, false);
5540 return __copy_user((__force void __user *) to, from, n);
5541- else
5542+ } else
5543 return n;
5544 }
5545
5546 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
5547 {
5548+ if ((long)n < 0)
5549+ return n;
5550+
5551 return __copy_user((__force void __user *) to, from, n);
5552 }
5553
5554diff -urNp linux-2.6.39.1/arch/sparc/include/asm/uaccess_64.h linux-2.6.39.1/arch/sparc/include/asm/uaccess_64.h
5555--- linux-2.6.39.1/arch/sparc/include/asm/uaccess_64.h 2011-05-19 00:06:34.000000000 -0400
5556+++ linux-2.6.39.1/arch/sparc/include/asm/uaccess_64.h 2011-05-22 19:36:30.000000000 -0400
5557@@ -10,6 +10,7 @@
5558 #include <linux/compiler.h>
5559 #include <linux/string.h>
5560 #include <linux/thread_info.h>
5561+#include <linux/kernel.h>
5562 #include <asm/asi.h>
5563 #include <asm/system.h>
5564 #include <asm/spitfire.h>
5565@@ -213,8 +214,15 @@ extern unsigned long copy_from_user_fixu
5566 static inline unsigned long __must_check
5567 copy_from_user(void *to, const void __user *from, unsigned long size)
5568 {
5569- unsigned long ret = ___copy_from_user(to, from, size);
5570+ unsigned long ret;
5571
5572+ if ((long)size < 0 || size > INT_MAX)
5573+ return size;
5574+
5575+ if (!__builtin_constant_p(size))
5576+ check_object_size(to, size, false);
5577+
5578+ ret = ___copy_from_user(to, from, size);
5579 if (unlikely(ret))
5580 ret = copy_from_user_fixup(to, from, size);
5581
5582@@ -230,8 +238,15 @@ extern unsigned long copy_to_user_fixup(
5583 static inline unsigned long __must_check
5584 copy_to_user(void __user *to, const void *from, unsigned long size)
5585 {
5586- unsigned long ret = ___copy_to_user(to, from, size);
5587+ unsigned long ret;
5588+
5589+ if ((long)size < 0 || size > INT_MAX)
5590+ return size;
5591+
5592+ if (!__builtin_constant_p(size))
5593+ check_object_size(from, size, true);
5594
5595+ ret = ___copy_to_user(to, from, size);
5596 if (unlikely(ret))
5597 ret = copy_to_user_fixup(to, from, size);
5598 return ret;
5599diff -urNp linux-2.6.39.1/arch/sparc/include/asm/uaccess.h linux-2.6.39.1/arch/sparc/include/asm/uaccess.h
5600--- linux-2.6.39.1/arch/sparc/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
5601+++ linux-2.6.39.1/arch/sparc/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
5602@@ -1,5 +1,13 @@
5603 #ifndef ___ASM_SPARC_UACCESS_H
5604 #define ___ASM_SPARC_UACCESS_H
5605+
5606+#ifdef __KERNEL__
5607+#ifndef __ASSEMBLY__
5608+#include <linux/types.h>
5609+extern void check_object_size(const void *ptr, unsigned long n, bool to);
5610+#endif
5611+#endif
5612+
5613 #if defined(__sparc__) && defined(__arch64__)
5614 #include <asm/uaccess_64.h>
5615 #else
5616diff -urNp linux-2.6.39.1/arch/sparc/kernel/iommu.c linux-2.6.39.1/arch/sparc/kernel/iommu.c
5617--- linux-2.6.39.1/arch/sparc/kernel/iommu.c 2011-05-19 00:06:34.000000000 -0400
5618+++ linux-2.6.39.1/arch/sparc/kernel/iommu.c 2011-05-22 19:36:30.000000000 -0400
5619@@ -824,7 +824,7 @@ static void dma_4u_sync_sg_for_cpu(struc
5620 spin_unlock_irqrestore(&iommu->lock, flags);
5621 }
5622
5623-static struct dma_map_ops sun4u_dma_ops = {
5624+static const struct dma_map_ops sun4u_dma_ops = {
5625 .alloc_coherent = dma_4u_alloc_coherent,
5626 .free_coherent = dma_4u_free_coherent,
5627 .map_page = dma_4u_map_page,
5628@@ -835,7 +835,7 @@ static struct dma_map_ops sun4u_dma_ops
5629 .sync_sg_for_cpu = dma_4u_sync_sg_for_cpu,
5630 };
5631
5632-struct dma_map_ops *dma_ops = &sun4u_dma_ops;
5633+const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
5634 EXPORT_SYMBOL(dma_ops);
5635
5636 extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
5637diff -urNp linux-2.6.39.1/arch/sparc/kernel/ioport.c linux-2.6.39.1/arch/sparc/kernel/ioport.c
5638--- linux-2.6.39.1/arch/sparc/kernel/ioport.c 2011-05-19 00:06:34.000000000 -0400
5639+++ linux-2.6.39.1/arch/sparc/kernel/ioport.c 2011-05-22 19:36:30.000000000 -0400
5640@@ -402,7 +402,7 @@ static void sbus_sync_sg_for_device(stru
5641 BUG();
5642 }
5643
5644-struct dma_map_ops sbus_dma_ops = {
5645+const struct dma_map_ops sbus_dma_ops = {
5646 .alloc_coherent = sbus_alloc_coherent,
5647 .free_coherent = sbus_free_coherent,
5648 .map_page = sbus_map_page,
5649@@ -653,7 +653,7 @@ static void pci32_sync_sg_for_device(str
5650 }
5651 }
5652
5653-struct dma_map_ops pci32_dma_ops = {
5654+const struct dma_map_ops pci32_dma_ops = {
5655 .alloc_coherent = pci32_alloc_coherent,
5656 .free_coherent = pci32_free_coherent,
5657 .map_page = pci32_map_page,
5658diff -urNp linux-2.6.39.1/arch/sparc/kernel/kgdb_32.c linux-2.6.39.1/arch/sparc/kernel/kgdb_32.c
5659--- linux-2.6.39.1/arch/sparc/kernel/kgdb_32.c 2011-05-19 00:06:34.000000000 -0400
5660+++ linux-2.6.39.1/arch/sparc/kernel/kgdb_32.c 2011-05-22 19:36:30.000000000 -0400
5661@@ -164,7 +164,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
5662 regs->npc = regs->pc + 4;
5663 }
5664
5665-struct kgdb_arch arch_kgdb_ops = {
5666+const struct kgdb_arch arch_kgdb_ops = {
5667 /* Breakpoint instruction: ta 0x7d */
5668 .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x7d },
5669 };
5670diff -urNp linux-2.6.39.1/arch/sparc/kernel/kgdb_64.c linux-2.6.39.1/arch/sparc/kernel/kgdb_64.c
5671--- linux-2.6.39.1/arch/sparc/kernel/kgdb_64.c 2011-05-19 00:06:34.000000000 -0400
5672+++ linux-2.6.39.1/arch/sparc/kernel/kgdb_64.c 2011-05-22 19:36:30.000000000 -0400
5673@@ -187,7 +187,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
5674 regs->tnpc = regs->tpc + 4;
5675 }
5676
5677-struct kgdb_arch arch_kgdb_ops = {
5678+const struct kgdb_arch arch_kgdb_ops = {
5679 /* Breakpoint instruction: ta 0x72 */
5680 .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x72 },
5681 };
5682diff -urNp linux-2.6.39.1/arch/sparc/kernel/Makefile linux-2.6.39.1/arch/sparc/kernel/Makefile
5683--- linux-2.6.39.1/arch/sparc/kernel/Makefile 2011-05-19 00:06:34.000000000 -0400
5684+++ linux-2.6.39.1/arch/sparc/kernel/Makefile 2011-05-22 19:36:30.000000000 -0400
5685@@ -3,7 +3,7 @@
5686 #
5687
5688 asflags-y := -ansi
5689-ccflags-y := -Werror
5690+#ccflags-y := -Werror
5691
5692 extra-y := head_$(BITS).o
5693 extra-y += init_task.o
5694diff -urNp linux-2.6.39.1/arch/sparc/kernel/pcic.c linux-2.6.39.1/arch/sparc/kernel/pcic.c
5695--- linux-2.6.39.1/arch/sparc/kernel/pcic.c 2011-05-19 00:06:34.000000000 -0400
5696+++ linux-2.6.39.1/arch/sparc/kernel/pcic.c 2011-05-22 19:36:30.000000000 -0400
5697@@ -268,7 +268,7 @@ static int pcic_write_config(struct pci_
5698 return -EINVAL;
5699 }
5700
5701-static struct pci_ops pcic_ops = {
5702+static const struct pci_ops pcic_ops = {
5703 .read = pcic_read_config,
5704 .write = pcic_write_config,
5705 };
5706diff -urNp linux-2.6.39.1/arch/sparc/kernel/pci_common.c linux-2.6.39.1/arch/sparc/kernel/pci_common.c
5707--- linux-2.6.39.1/arch/sparc/kernel/pci_common.c 2011-05-19 00:06:34.000000000 -0400
5708+++ linux-2.6.39.1/arch/sparc/kernel/pci_common.c 2011-05-22 19:36:30.000000000 -0400
5709@@ -249,7 +249,7 @@ static int sun4u_write_pci_cfg(struct pc
5710 return PCIBIOS_SUCCESSFUL;
5711 }
5712
5713-struct pci_ops sun4u_pci_ops = {
5714+const struct pci_ops sun4u_pci_ops = {
5715 .read = sun4u_read_pci_cfg,
5716 .write = sun4u_write_pci_cfg,
5717 };
5718@@ -310,7 +310,7 @@ static int sun4v_write_pci_cfg(struct pc
5719 return PCIBIOS_SUCCESSFUL;
5720 }
5721
5722-struct pci_ops sun4v_pci_ops = {
5723+const struct pci_ops sun4v_pci_ops = {
5724 .read = sun4v_read_pci_cfg,
5725 .write = sun4v_write_pci_cfg,
5726 };
5727diff -urNp linux-2.6.39.1/arch/sparc/kernel/pci_impl.h linux-2.6.39.1/arch/sparc/kernel/pci_impl.h
5728--- linux-2.6.39.1/arch/sparc/kernel/pci_impl.h 2011-05-19 00:06:34.000000000 -0400
5729+++ linux-2.6.39.1/arch/sparc/kernel/pci_impl.h 2011-05-22 19:36:30.000000000 -0400
5730@@ -175,8 +175,8 @@ extern void pci_config_write8(u8 *addr,
5731 extern void pci_config_write16(u16 *addr, u16 val);
5732 extern void pci_config_write32(u32 *addr, u32 val);
5733
5734-extern struct pci_ops sun4u_pci_ops;
5735-extern struct pci_ops sun4v_pci_ops;
5736+extern const struct pci_ops sun4u_pci_ops;
5737+extern const struct pci_ops sun4v_pci_ops;
5738
5739 extern volatile int pci_poke_in_progress;
5740 extern volatile int pci_poke_cpu;
5741diff -urNp linux-2.6.39.1/arch/sparc/kernel/pci_sun4v.c linux-2.6.39.1/arch/sparc/kernel/pci_sun4v.c
5742--- linux-2.6.39.1/arch/sparc/kernel/pci_sun4v.c 2011-05-19 00:06:34.000000000 -0400
5743+++ linux-2.6.39.1/arch/sparc/kernel/pci_sun4v.c 2011-05-22 19:36:30.000000000 -0400
5744@@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
5745 spin_unlock_irqrestore(&iommu->lock, flags);
5746 }
5747
5748-static struct dma_map_ops sun4v_dma_ops = {
5749+static const struct dma_map_ops sun4v_dma_ops = {
5750 .alloc_coherent = dma_4v_alloc_coherent,
5751 .free_coherent = dma_4v_free_coherent,
5752 .map_page = dma_4v_map_page,
5753diff -urNp linux-2.6.39.1/arch/sparc/kernel/process_32.c linux-2.6.39.1/arch/sparc/kernel/process_32.c
5754--- linux-2.6.39.1/arch/sparc/kernel/process_32.c 2011-05-19 00:06:34.000000000 -0400
5755+++ linux-2.6.39.1/arch/sparc/kernel/process_32.c 2011-05-22 19:41:32.000000000 -0400
5756@@ -196,7 +196,7 @@ void __show_backtrace(unsigned long fp)
5757 rw->ins[4], rw->ins[5],
5758 rw->ins[6],
5759 rw->ins[7]);
5760- printk("%pS\n", (void *) rw->ins[7]);
5761+ printk("%pA\n", (void *) rw->ins[7]);
5762 rw = (struct reg_window32 *) rw->ins[6];
5763 }
5764 spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
5765@@ -263,14 +263,14 @@ void show_regs(struct pt_regs *r)
5766
5767 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
5768 r->psr, r->pc, r->npc, r->y, print_tainted());
5769- printk("PC: <%pS>\n", (void *) r->pc);
5770+ printk("PC: <%pA>\n", (void *) r->pc);
5771 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
5772 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
5773 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
5774 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
5775 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
5776 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
5777- printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
5778+ printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
5779
5780 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
5781 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
5782@@ -305,7 +305,7 @@ void show_stack(struct task_struct *tsk,
5783 rw = (struct reg_window32 *) fp;
5784 pc = rw->ins[7];
5785 printk("[%08lx : ", pc);
5786- printk("%pS ] ", (void *) pc);
5787+ printk("%pA ] ", (void *) pc);
5788 fp = rw->ins[6];
5789 } while (++count < 16);
5790 printk("\n");
5791diff -urNp linux-2.6.39.1/arch/sparc/kernel/process_64.c linux-2.6.39.1/arch/sparc/kernel/process_64.c
5792--- linux-2.6.39.1/arch/sparc/kernel/process_64.c 2011-05-19 00:06:34.000000000 -0400
5793+++ linux-2.6.39.1/arch/sparc/kernel/process_64.c 2011-05-22 19:41:32.000000000 -0400
5794@@ -180,14 +180,14 @@ static void show_regwindow(struct pt_reg
5795 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
5796 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
5797 if (regs->tstate & TSTATE_PRIV)
5798- printk("I7: <%pS>\n", (void *) rwk->ins[7]);
5799+ printk("I7: <%pA>\n", (void *) rwk->ins[7]);
5800 }
5801
5802 void show_regs(struct pt_regs *regs)
5803 {
5804 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
5805 regs->tpc, regs->tnpc, regs->y, print_tainted());
5806- printk("TPC: <%pS>\n", (void *) regs->tpc);
5807+ printk("TPC: <%pA>\n", (void *) regs->tpc);
5808 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
5809 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
5810 regs->u_regs[3]);
5811@@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
5812 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
5813 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
5814 regs->u_regs[15]);
5815- printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
5816+ printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
5817 show_regwindow(regs);
5818 show_stack(current, (unsigned long *) regs->u_regs[UREG_FP]);
5819 }
5820@@ -285,7 +285,7 @@ void arch_trigger_all_cpu_backtrace(void
5821 ((tp && tp->task) ? tp->task->pid : -1));
5822
5823 if (gp->tstate & TSTATE_PRIV) {
5824- printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
5825+ printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
5826 (void *) gp->tpc,
5827 (void *) gp->o7,
5828 (void *) gp->i7,
5829diff -urNp linux-2.6.39.1/arch/sparc/kernel/sys_sparc_32.c linux-2.6.39.1/arch/sparc/kernel/sys_sparc_32.c
5830--- linux-2.6.39.1/arch/sparc/kernel/sys_sparc_32.c 2011-05-19 00:06:34.000000000 -0400
5831+++ linux-2.6.39.1/arch/sparc/kernel/sys_sparc_32.c 2011-05-22 19:36:30.000000000 -0400
5832@@ -56,7 +56,7 @@ unsigned long arch_get_unmapped_area(str
5833 if (ARCH_SUN4C && len > 0x20000000)
5834 return -ENOMEM;
5835 if (!addr)
5836- addr = TASK_UNMAPPED_BASE;
5837+ addr = current->mm->mmap_base;
5838
5839 if (flags & MAP_SHARED)
5840 addr = COLOUR_ALIGN(addr);
5841@@ -71,7 +71,7 @@ unsigned long arch_get_unmapped_area(str
5842 }
5843 if (TASK_SIZE - PAGE_SIZE - len < addr)
5844 return -ENOMEM;
5845- if (!vmm || addr + len <= vmm->vm_start)
5846+ if (check_heap_stack_gap(vmm, addr, len))
5847 return addr;
5848 addr = vmm->vm_end;
5849 if (flags & MAP_SHARED)
5850diff -urNp linux-2.6.39.1/arch/sparc/kernel/sys_sparc_64.c linux-2.6.39.1/arch/sparc/kernel/sys_sparc_64.c
5851--- linux-2.6.39.1/arch/sparc/kernel/sys_sparc_64.c 2011-05-19 00:06:34.000000000 -0400
5852+++ linux-2.6.39.1/arch/sparc/kernel/sys_sparc_64.c 2011-05-22 19:36:30.000000000 -0400
5853@@ -124,7 +124,7 @@ unsigned long arch_get_unmapped_area(str
5854 /* We do not accept a shared mapping if it would violate
5855 * cache aliasing constraints.
5856 */
5857- if ((flags & MAP_SHARED) &&
5858+ if ((filp || (flags & MAP_SHARED)) &&
5859 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
5860 return -EINVAL;
5861 return addr;
5862@@ -139,6 +139,10 @@ unsigned long arch_get_unmapped_area(str
5863 if (filp || (flags & MAP_SHARED))
5864 do_color_align = 1;
5865
5866+#ifdef CONFIG_PAX_RANDMMAP
5867+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
5868+#endif
5869+
5870 if (addr) {
5871 if (do_color_align)
5872 addr = COLOUR_ALIGN(addr, pgoff);
5873@@ -146,15 +150,14 @@ unsigned long arch_get_unmapped_area(str
5874 addr = PAGE_ALIGN(addr);
5875
5876 vma = find_vma(mm, addr);
5877- if (task_size - len >= addr &&
5878- (!vma || addr + len <= vma->vm_start))
5879+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
5880 return addr;
5881 }
5882
5883 if (len > mm->cached_hole_size) {
5884- start_addr = addr = mm->free_area_cache;
5885+ start_addr = addr = mm->free_area_cache;
5886 } else {
5887- start_addr = addr = TASK_UNMAPPED_BASE;
5888+ start_addr = addr = mm->mmap_base;
5889 mm->cached_hole_size = 0;
5890 }
5891
5892@@ -174,14 +177,14 @@ full_search:
5893 vma = find_vma(mm, VA_EXCLUDE_END);
5894 }
5895 if (unlikely(task_size < addr)) {
5896- if (start_addr != TASK_UNMAPPED_BASE) {
5897- start_addr = addr = TASK_UNMAPPED_BASE;
5898+ if (start_addr != mm->mmap_base) {
5899+ start_addr = addr = mm->mmap_base;
5900 mm->cached_hole_size = 0;
5901 goto full_search;
5902 }
5903 return -ENOMEM;
5904 }
5905- if (likely(!vma || addr + len <= vma->vm_start)) {
5906+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5907 /*
5908 * Remember the place where we stopped the search:
5909 */
5910@@ -215,7 +218,7 @@ arch_get_unmapped_area_topdown(struct fi
5911 /* We do not accept a shared mapping if it would violate
5912 * cache aliasing constraints.
5913 */
5914- if ((flags & MAP_SHARED) &&
5915+ if ((filp || (flags & MAP_SHARED)) &&
5916 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
5917 return -EINVAL;
5918 return addr;
5919@@ -236,8 +239,7 @@ arch_get_unmapped_area_topdown(struct fi
5920 addr = PAGE_ALIGN(addr);
5921
5922 vma = find_vma(mm, addr);
5923- if (task_size - len >= addr &&
5924- (!vma || addr + len <= vma->vm_start))
5925+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
5926 return addr;
5927 }
5928
5929@@ -258,7 +260,7 @@ arch_get_unmapped_area_topdown(struct fi
5930 /* make sure it can fit in the remaining address space */
5931 if (likely(addr > len)) {
5932 vma = find_vma(mm, addr-len);
5933- if (!vma || addr <= vma->vm_start) {
5934+ if (check_heap_stack_gap(vma, addr - len, len)) {
5935 /* remember the address as a hint for next time */
5936 return (mm->free_area_cache = addr-len);
5937 }
5938@@ -267,18 +269,18 @@ arch_get_unmapped_area_topdown(struct fi
5939 if (unlikely(mm->mmap_base < len))
5940 goto bottomup;
5941
5942- addr = mm->mmap_base-len;
5943- if (do_color_align)
5944- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5945+ addr = mm->mmap_base - len;
5946
5947 do {
5948+ if (do_color_align)
5949+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5950 /*
5951 * Lookup failure means no vma is above this address,
5952 * else if new region fits below vma->vm_start,
5953 * return with success:
5954 */
5955 vma = find_vma(mm, addr);
5956- if (likely(!vma || addr+len <= vma->vm_start)) {
5957+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5958 /* remember the address as a hint for next time */
5959 return (mm->free_area_cache = addr);
5960 }
5961@@ -288,10 +290,8 @@ arch_get_unmapped_area_topdown(struct fi
5962 mm->cached_hole_size = vma->vm_start - addr;
5963
5964 /* try just below the current vma->vm_start */
5965- addr = vma->vm_start-len;
5966- if (do_color_align)
5967- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5968- } while (likely(len < vma->vm_start));
5969+ addr = skip_heap_stack_gap(vma, len);
5970+ } while (!IS_ERR_VALUE(addr));
5971
5972 bottomup:
5973 /*
5974@@ -390,6 +390,12 @@ void arch_pick_mmap_layout(struct mm_str
5975 gap == RLIM_INFINITY ||
5976 sysctl_legacy_va_layout) {
5977 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
5978+
5979+#ifdef CONFIG_PAX_RANDMMAP
5980+ if (mm->pax_flags & MF_PAX_RANDMMAP)
5981+ mm->mmap_base += mm->delta_mmap;
5982+#endif
5983+
5984 mm->get_unmapped_area = arch_get_unmapped_area;
5985 mm->unmap_area = arch_unmap_area;
5986 } else {
5987@@ -402,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_str
5988 gap = (task_size / 6 * 5);
5989
5990 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
5991+
5992+#ifdef CONFIG_PAX_RANDMMAP
5993+ if (mm->pax_flags & MF_PAX_RANDMMAP)
5994+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
5995+#endif
5996+
5997 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
5998 mm->unmap_area = arch_unmap_area_topdown;
5999 }
6000diff -urNp linux-2.6.39.1/arch/sparc/kernel/traps_32.c linux-2.6.39.1/arch/sparc/kernel/traps_32.c
6001--- linux-2.6.39.1/arch/sparc/kernel/traps_32.c 2011-05-19 00:06:34.000000000 -0400
6002+++ linux-2.6.39.1/arch/sparc/kernel/traps_32.c 2011-05-22 19:41:32.000000000 -0400
6003@@ -76,7 +76,7 @@ void die_if_kernel(char *str, struct pt_
6004 count++ < 30 &&
6005 (((unsigned long) rw) >= PAGE_OFFSET) &&
6006 !(((unsigned long) rw) & 0x7)) {
6007- printk("Caller[%08lx]: %pS\n", rw->ins[7],
6008+ printk("Caller[%08lx]: %pA\n", rw->ins[7],
6009 (void *) rw->ins[7]);
6010 rw = (struct reg_window32 *)rw->ins[6];
6011 }
6012diff -urNp linux-2.6.39.1/arch/sparc/kernel/traps_64.c linux-2.6.39.1/arch/sparc/kernel/traps_64.c
6013--- linux-2.6.39.1/arch/sparc/kernel/traps_64.c 2011-05-19 00:06:34.000000000 -0400
6014+++ linux-2.6.39.1/arch/sparc/kernel/traps_64.c 2011-05-22 19:41:32.000000000 -0400
6015@@ -75,7 +75,7 @@ static void dump_tl1_traplog(struct tl1_
6016 i + 1,
6017 p->trapstack[i].tstate, p->trapstack[i].tpc,
6018 p->trapstack[i].tnpc, p->trapstack[i].tt);
6019- printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
6020+ printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
6021 }
6022 }
6023
6024@@ -95,6 +95,12 @@ void bad_trap(struct pt_regs *regs, long
6025
6026 lvl -= 0x100;
6027 if (regs->tstate & TSTATE_PRIV) {
6028+
6029+#ifdef CONFIG_PAX_REFCOUNT
6030+ if (lvl == 6)
6031+ pax_report_refcount_overflow(regs);
6032+#endif
6033+
6034 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
6035 die_if_kernel(buffer, regs);
6036 }
6037@@ -113,11 +119,16 @@ void bad_trap(struct pt_regs *regs, long
6038 void bad_trap_tl1(struct pt_regs *regs, long lvl)
6039 {
6040 char buffer[32];
6041-
6042+
6043 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
6044 0, lvl, SIGTRAP) == NOTIFY_STOP)
6045 return;
6046
6047+#ifdef CONFIG_PAX_REFCOUNT
6048+ if (lvl == 6)
6049+ pax_report_refcount_overflow(regs);
6050+#endif
6051+
6052 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
6053
6054 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
6055@@ -1141,7 +1152,7 @@ static void cheetah_log_errors(struct pt
6056 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
6057 printk("%s" "ERROR(%d): ",
6058 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
6059- printk("TPC<%pS>\n", (void *) regs->tpc);
6060+ printk("TPC<%pA>\n", (void *) regs->tpc);
6061 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
6062 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
6063 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
6064@@ -1748,7 +1759,7 @@ void cheetah_plus_parity_error(int type,
6065 smp_processor_id(),
6066 (type & 0x1) ? 'I' : 'D',
6067 regs->tpc);
6068- printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
6069+ printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
6070 panic("Irrecoverable Cheetah+ parity error.");
6071 }
6072
6073@@ -1756,7 +1767,7 @@ void cheetah_plus_parity_error(int type,
6074 smp_processor_id(),
6075 (type & 0x1) ? 'I' : 'D',
6076 regs->tpc);
6077- printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
6078+ printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
6079 }
6080
6081 struct sun4v_error_entry {
6082@@ -1963,9 +1974,9 @@ void sun4v_itlb_error_report(struct pt_r
6083
6084 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
6085 regs->tpc, tl);
6086- printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
6087+ printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
6088 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
6089- printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
6090+ printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
6091 (void *) regs->u_regs[UREG_I7]);
6092 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
6093 "pte[%lx] error[%lx]\n",
6094@@ -1987,9 +1998,9 @@ void sun4v_dtlb_error_report(struct pt_r
6095
6096 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
6097 regs->tpc, tl);
6098- printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
6099+ printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
6100 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
6101- printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
6102+ printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
6103 (void *) regs->u_regs[UREG_I7]);
6104 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
6105 "pte[%lx] error[%lx]\n",
6106@@ -2195,13 +2206,13 @@ void show_stack(struct task_struct *tsk,
6107 fp = (unsigned long)sf->fp + STACK_BIAS;
6108 }
6109
6110- printk(" [%016lx] %pS\n", pc, (void *) pc);
6111+ printk(" [%016lx] %pA\n", pc, (void *) pc);
6112 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
6113 if ((pc + 8UL) == (unsigned long) &return_to_handler) {
6114 int index = tsk->curr_ret_stack;
6115 if (tsk->ret_stack && index >= graph) {
6116 pc = tsk->ret_stack[index - graph].ret;
6117- printk(" [%016lx] %pS\n", pc, (void *) pc);
6118+ printk(" [%016lx] %pA\n", pc, (void *) pc);
6119 graph++;
6120 }
6121 }
6122@@ -2254,7 +2265,7 @@ void die_if_kernel(char *str, struct pt_
6123 while (rw &&
6124 count++ < 30 &&
6125 kstack_valid(tp, (unsigned long) rw)) {
6126- printk("Caller[%016lx]: %pS\n", rw->ins[7],
6127+ printk("Caller[%016lx]: %pA\n", rw->ins[7],
6128 (void *) rw->ins[7]);
6129
6130 rw = kernel_stack_up(rw);
6131diff -urNp linux-2.6.39.1/arch/sparc/kernel/unaligned_64.c linux-2.6.39.1/arch/sparc/kernel/unaligned_64.c
6132--- linux-2.6.39.1/arch/sparc/kernel/unaligned_64.c 2011-05-19 00:06:34.000000000 -0400
6133+++ linux-2.6.39.1/arch/sparc/kernel/unaligned_64.c 2011-05-22 19:41:32.000000000 -0400
6134@@ -278,7 +278,7 @@ static void log_unaligned(struct pt_regs
6135 static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
6136
6137 if (__ratelimit(&ratelimit)) {
6138- printk("Kernel unaligned access at TPC[%lx] %pS\n",
6139+ printk("Kernel unaligned access at TPC[%lx] %pA\n",
6140 regs->tpc, (void *) regs->tpc);
6141 }
6142 }
6143diff -urNp linux-2.6.39.1/arch/sparc/lib/atomic_64.S linux-2.6.39.1/arch/sparc/lib/atomic_64.S
6144--- linux-2.6.39.1/arch/sparc/lib/atomic_64.S 2011-05-19 00:06:34.000000000 -0400
6145+++ linux-2.6.39.1/arch/sparc/lib/atomic_64.S 2011-05-22 19:36:30.000000000 -0400
6146@@ -18,7 +18,12 @@
6147 atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
6148 BACKOFF_SETUP(%o2)
6149 1: lduw [%o1], %g1
6150- add %g1, %o0, %g7
6151+ addcc %g1, %o0, %g7
6152+
6153+#ifdef CONFIG_PAX_REFCOUNT
6154+ tvs %icc, 6
6155+#endif
6156+
6157 cas [%o1], %g1, %g7
6158 cmp %g1, %g7
6159 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6160@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
6161 2: BACKOFF_SPIN(%o2, %o3, 1b)
6162 .size atomic_add, .-atomic_add
6163
6164+ .globl atomic_add_unchecked
6165+ .type atomic_add_unchecked,#function
6166+atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6167+ BACKOFF_SETUP(%o2)
6168+1: lduw [%o1], %g1
6169+ add %g1, %o0, %g7
6170+ cas [%o1], %g1, %g7
6171+ cmp %g1, %g7
6172+ bne,pn %icc, 2f
6173+ nop
6174+ retl
6175+ nop
6176+2: BACKOFF_SPIN(%o2, %o3, 1b)
6177+ .size atomic_add_unchecked, .-atomic_add_unchecked
6178+
6179 .globl atomic_sub
6180 .type atomic_sub,#function
6181 atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
6182 BACKOFF_SETUP(%o2)
6183 1: lduw [%o1], %g1
6184- sub %g1, %o0, %g7
6185+ subcc %g1, %o0, %g7
6186+
6187+#ifdef CONFIG_PAX_REFCOUNT
6188+ tvs %icc, 6
6189+#endif
6190+
6191 cas [%o1], %g1, %g7
6192 cmp %g1, %g7
6193 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6194@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
6195 2: BACKOFF_SPIN(%o2, %o3, 1b)
6196 .size atomic_sub, .-atomic_sub
6197
6198+ .globl atomic_sub_unchecked
6199+ .type atomic_sub_unchecked,#function
6200+atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
6201+ BACKOFF_SETUP(%o2)
6202+1: lduw [%o1], %g1
6203+ sub %g1, %o0, %g7
6204+ cas [%o1], %g1, %g7
6205+ cmp %g1, %g7
6206+ bne,pn %icc, 2f
6207+ nop
6208+ retl
6209+ nop
6210+2: BACKOFF_SPIN(%o2, %o3, 1b)
6211+ .size atomic_sub_unchecked, .-atomic_sub_unchecked
6212+
6213 .globl atomic_add_ret
6214 .type atomic_add_ret,#function
6215 atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
6216 BACKOFF_SETUP(%o2)
6217 1: lduw [%o1], %g1
6218- add %g1, %o0, %g7
6219+ addcc %g1, %o0, %g7
6220+
6221+#ifdef CONFIG_PAX_REFCOUNT
6222+ tvs %icc, 6
6223+#endif
6224+
6225 cas [%o1], %g1, %g7
6226 cmp %g1, %g7
6227 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6228@@ -58,12 +103,33 @@ atomic_add_ret: /* %o0 = increment, %o1
6229 2: BACKOFF_SPIN(%o2, %o3, 1b)
6230 .size atomic_add_ret, .-atomic_add_ret
6231
6232+ .globl atomic_add_ret_unchecked
6233+ .type atomic_add_ret_unchecked,#function
6234+atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6235+ BACKOFF_SETUP(%o2)
6236+1: lduw [%o1], %g1
6237+ addcc %g1, %o0, %g7
6238+ cas [%o1], %g1, %g7
6239+ cmp %g1, %g7
6240+ bne,pn %icc, 2f
6241+ add %g7, %o0, %g7
6242+ sra %g7, 0, %o0
6243+ retl
6244+ nop
6245+2: BACKOFF_SPIN(%o2, %o3, 1b)
6246+ .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
6247+
6248 .globl atomic_sub_ret
6249 .type atomic_sub_ret,#function
6250 atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
6251 BACKOFF_SETUP(%o2)
6252 1: lduw [%o1], %g1
6253- sub %g1, %o0, %g7
6254+ subcc %g1, %o0, %g7
6255+
6256+#ifdef CONFIG_PAX_REFCOUNT
6257+ tvs %icc, 6
6258+#endif
6259+
6260 cas [%o1], %g1, %g7
6261 cmp %g1, %g7
6262 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6263@@ -78,7 +144,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1
6264 atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
6265 BACKOFF_SETUP(%o2)
6266 1: ldx [%o1], %g1
6267- add %g1, %o0, %g7
6268+ addcc %g1, %o0, %g7
6269+
6270+#ifdef CONFIG_PAX_REFCOUNT
6271+ tvs %xcc, 6
6272+#endif
6273+
6274 casx [%o1], %g1, %g7
6275 cmp %g1, %g7
6276 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6277@@ -88,12 +159,32 @@ atomic64_add: /* %o0 = increment, %o1 =
6278 2: BACKOFF_SPIN(%o2, %o3, 1b)
6279 .size atomic64_add, .-atomic64_add
6280
6281+ .globl atomic64_add_unchecked
6282+ .type atomic64_add_unchecked,#function
6283+atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6284+ BACKOFF_SETUP(%o2)
6285+1: ldx [%o1], %g1
6286+ addcc %g1, %o0, %g7
6287+ casx [%o1], %g1, %g7
6288+ cmp %g1, %g7
6289+ bne,pn %xcc, 2f
6290+ nop
6291+ retl
6292+ nop
6293+2: BACKOFF_SPIN(%o2, %o3, 1b)
6294+ .size atomic64_add_unchecked, .-atomic64_add_unchecked
6295+
6296 .globl atomic64_sub
6297 .type atomic64_sub,#function
6298 atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
6299 BACKOFF_SETUP(%o2)
6300 1: ldx [%o1], %g1
6301- sub %g1, %o0, %g7
6302+ subcc %g1, %o0, %g7
6303+
6304+#ifdef CONFIG_PAX_REFCOUNT
6305+ tvs %xcc, 6
6306+#endif
6307+
6308 casx [%o1], %g1, %g7
6309 cmp %g1, %g7
6310 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6311@@ -103,12 +194,32 @@ atomic64_sub: /* %o0 = decrement, %o1 =
6312 2: BACKOFF_SPIN(%o2, %o3, 1b)
6313 .size atomic64_sub, .-atomic64_sub
6314
6315+ .globl atomic64_sub_unchecked
6316+ .type atomic64_sub_unchecked,#function
6317+atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
6318+ BACKOFF_SETUP(%o2)
6319+1: ldx [%o1], %g1
6320+ subcc %g1, %o0, %g7
6321+ casx [%o1], %g1, %g7
6322+ cmp %g1, %g7
6323+ bne,pn %xcc, 2f
6324+ nop
6325+ retl
6326+ nop
6327+2: BACKOFF_SPIN(%o2, %o3, 1b)
6328+ .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
6329+
6330 .globl atomic64_add_ret
6331 .type atomic64_add_ret,#function
6332 atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
6333 BACKOFF_SETUP(%o2)
6334 1: ldx [%o1], %g1
6335- add %g1, %o0, %g7
6336+ addcc %g1, %o0, %g7
6337+
6338+#ifdef CONFIG_PAX_REFCOUNT
6339+ tvs %xcc, 6
6340+#endif
6341+
6342 casx [%o1], %g1, %g7
6343 cmp %g1, %g7
6344 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6345@@ -118,12 +229,33 @@ atomic64_add_ret: /* %o0 = increment, %o
6346 2: BACKOFF_SPIN(%o2, %o3, 1b)
6347 .size atomic64_add_ret, .-atomic64_add_ret
6348
6349+ .globl atomic64_add_ret_unchecked
6350+ .type atomic64_add_ret_unchecked,#function
6351+atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6352+ BACKOFF_SETUP(%o2)
6353+1: ldx [%o1], %g1
6354+ addcc %g1, %o0, %g7
6355+ casx [%o1], %g1, %g7
6356+ cmp %g1, %g7
6357+ bne,pn %xcc, 2f
6358+ add %g7, %o0, %g7
6359+ mov %g7, %o0
6360+ retl
6361+ nop
6362+2: BACKOFF_SPIN(%o2, %o3, 1b)
6363+ .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
6364+
6365 .globl atomic64_sub_ret
6366 .type atomic64_sub_ret,#function
6367 atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
6368 BACKOFF_SETUP(%o2)
6369 1: ldx [%o1], %g1
6370- sub %g1, %o0, %g7
6371+ subcc %g1, %o0, %g7
6372+
6373+#ifdef CONFIG_PAX_REFCOUNT
6374+ tvs %xcc, 6
6375+#endif
6376+
6377 casx [%o1], %g1, %g7
6378 cmp %g1, %g7
6379 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6380diff -urNp linux-2.6.39.1/arch/sparc/lib/ksyms.c linux-2.6.39.1/arch/sparc/lib/ksyms.c
6381--- linux-2.6.39.1/arch/sparc/lib/ksyms.c 2011-05-19 00:06:34.000000000 -0400
6382+++ linux-2.6.39.1/arch/sparc/lib/ksyms.c 2011-05-22 19:36:30.000000000 -0400
6383@@ -142,12 +142,17 @@ EXPORT_SYMBOL(__downgrade_write);
6384
6385 /* Atomic counter implementation. */
6386 EXPORT_SYMBOL(atomic_add);
6387+EXPORT_SYMBOL(atomic_add_unchecked);
6388 EXPORT_SYMBOL(atomic_add_ret);
6389 EXPORT_SYMBOL(atomic_sub);
6390+EXPORT_SYMBOL(atomic_sub_unchecked);
6391 EXPORT_SYMBOL(atomic_sub_ret);
6392 EXPORT_SYMBOL(atomic64_add);
6393+EXPORT_SYMBOL(atomic64_add_unchecked);
6394 EXPORT_SYMBOL(atomic64_add_ret);
6395+EXPORT_SYMBOL(atomic64_add_ret_unchecked);
6396 EXPORT_SYMBOL(atomic64_sub);
6397+EXPORT_SYMBOL(atomic64_sub_unchecked);
6398 EXPORT_SYMBOL(atomic64_sub_ret);
6399
6400 /* Atomic bit operations. */
6401diff -urNp linux-2.6.39.1/arch/sparc/lib/Makefile linux-2.6.39.1/arch/sparc/lib/Makefile
6402--- linux-2.6.39.1/arch/sparc/lib/Makefile 2011-05-19 00:06:34.000000000 -0400
6403+++ linux-2.6.39.1/arch/sparc/lib/Makefile 2011-05-22 19:36:30.000000000 -0400
6404@@ -2,7 +2,7 @@
6405 #
6406
6407 asflags-y := -ansi -DST_DIV0=0x02
6408-ccflags-y := -Werror
6409+#ccflags-y := -Werror
6410
6411 lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
6412 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
6413diff -urNp linux-2.6.39.1/arch/sparc/Makefile linux-2.6.39.1/arch/sparc/Makefile
6414--- linux-2.6.39.1/arch/sparc/Makefile 2011-05-19 00:06:34.000000000 -0400
6415+++ linux-2.6.39.1/arch/sparc/Makefile 2011-05-22 19:41:32.000000000 -0400
6416@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc
6417 # Export what is needed by arch/sparc/boot/Makefile
6418 export VMLINUX_INIT VMLINUX_MAIN
6419 VMLINUX_INIT := $(head-y) $(init-y)
6420-VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
6421+VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
6422 VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
6423 VMLINUX_MAIN += $(drivers-y) $(net-y)
6424
6425diff -urNp linux-2.6.39.1/arch/sparc/mm/fault_32.c linux-2.6.39.1/arch/sparc/mm/fault_32.c
6426--- linux-2.6.39.1/arch/sparc/mm/fault_32.c 2011-05-19 00:06:34.000000000 -0400
6427+++ linux-2.6.39.1/arch/sparc/mm/fault_32.c 2011-05-22 19:36:30.000000000 -0400
6428@@ -22,6 +22,9 @@
6429 #include <linux/interrupt.h>
6430 #include <linux/module.h>
6431 #include <linux/kdebug.h>
6432+#include <linux/slab.h>
6433+#include <linux/pagemap.h>
6434+#include <linux/compiler.h>
6435
6436 #include <asm/system.h>
6437 #include <asm/page.h>
6438@@ -209,6 +212,268 @@ static unsigned long compute_si_addr(str
6439 return safe_compute_effective_address(regs, insn);
6440 }
6441
6442+#ifdef CONFIG_PAX_PAGEEXEC
6443+#ifdef CONFIG_PAX_DLRESOLVE
6444+static void pax_emuplt_close(struct vm_area_struct *vma)
6445+{
6446+ vma->vm_mm->call_dl_resolve = 0UL;
6447+}
6448+
6449+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
6450+{
6451+ unsigned int *kaddr;
6452+
6453+ vmf->page = alloc_page(GFP_HIGHUSER);
6454+ if (!vmf->page)
6455+ return VM_FAULT_OOM;
6456+
6457+ kaddr = kmap(vmf->page);
6458+ memset(kaddr, 0, PAGE_SIZE);
6459+ kaddr[0] = 0x9DE3BFA8U; /* save */
6460+ flush_dcache_page(vmf->page);
6461+ kunmap(vmf->page);
6462+ return VM_FAULT_MAJOR;
6463+}
6464+
6465+static const struct vm_operations_struct pax_vm_ops = {
6466+ .close = pax_emuplt_close,
6467+ .fault = pax_emuplt_fault
6468+};
6469+
6470+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
6471+{
6472+ int ret;
6473+
6474+ INIT_LIST_HEAD(&vma->anon_vma_chain);
6475+ vma->vm_mm = current->mm;
6476+ vma->vm_start = addr;
6477+ vma->vm_end = addr + PAGE_SIZE;
6478+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
6479+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
6480+ vma->vm_ops = &pax_vm_ops;
6481+
6482+ ret = insert_vm_struct(current->mm, vma);
6483+ if (ret)
6484+ return ret;
6485+
6486+ ++current->mm->total_vm;
6487+ return 0;
6488+}
6489+#endif
6490+
6491+/*
6492+ * PaX: decide what to do with offenders (regs->pc = fault address)
6493+ *
6494+ * returns 1 when task should be killed
6495+ * 2 when patched PLT trampoline was detected
6496+ * 3 when unpatched PLT trampoline was detected
6497+ */
6498+static int pax_handle_fetch_fault(struct pt_regs *regs)
6499+{
6500+
6501+#ifdef CONFIG_PAX_EMUPLT
6502+ int err;
6503+
6504+ do { /* PaX: patched PLT emulation #1 */
6505+ unsigned int sethi1, sethi2, jmpl;
6506+
6507+ err = get_user(sethi1, (unsigned int *)regs->pc);
6508+ err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
6509+ err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
6510+
6511+ if (err)
6512+ break;
6513+
6514+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
6515+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
6516+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
6517+ {
6518+ unsigned int addr;
6519+
6520+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
6521+ addr = regs->u_regs[UREG_G1];
6522+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6523+ regs->pc = addr;
6524+ regs->npc = addr+4;
6525+ return 2;
6526+ }
6527+ } while (0);
6528+
6529+ { /* PaX: patched PLT emulation #2 */
6530+ unsigned int ba;
6531+
6532+ err = get_user(ba, (unsigned int *)regs->pc);
6533+
6534+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
6535+ unsigned int addr;
6536+
6537+ addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
6538+ regs->pc = addr;
6539+ regs->npc = addr+4;
6540+ return 2;
6541+ }
6542+ }
6543+
6544+ do { /* PaX: patched PLT emulation #3 */
6545+ unsigned int sethi, jmpl, nop;
6546+
6547+ err = get_user(sethi, (unsigned int *)regs->pc);
6548+ err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
6549+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
6550+
6551+ if (err)
6552+ break;
6553+
6554+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6555+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
6556+ nop == 0x01000000U)
6557+ {
6558+ unsigned int addr;
6559+
6560+ addr = (sethi & 0x003FFFFFU) << 10;
6561+ regs->u_regs[UREG_G1] = addr;
6562+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6563+ regs->pc = addr;
6564+ regs->npc = addr+4;
6565+ return 2;
6566+ }
6567+ } while (0);
6568+
6569+ do { /* PaX: unpatched PLT emulation step 1 */
6570+ unsigned int sethi, ba, nop;
6571+
6572+ err = get_user(sethi, (unsigned int *)regs->pc);
6573+ err |= get_user(ba, (unsigned int *)(regs->pc+4));
6574+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
6575+
6576+ if (err)
6577+ break;
6578+
6579+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6580+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
6581+ nop == 0x01000000U)
6582+ {
6583+ unsigned int addr, save, call;
6584+
6585+ if ((ba & 0xFFC00000U) == 0x30800000U)
6586+ addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
6587+ else
6588+ addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
6589+
6590+ err = get_user(save, (unsigned int *)addr);
6591+ err |= get_user(call, (unsigned int *)(addr+4));
6592+ err |= get_user(nop, (unsigned int *)(addr+8));
6593+ if (err)
6594+ break;
6595+
6596+#ifdef CONFIG_PAX_DLRESOLVE
6597+ if (save == 0x9DE3BFA8U &&
6598+ (call & 0xC0000000U) == 0x40000000U &&
6599+ nop == 0x01000000U)
6600+ {
6601+ struct vm_area_struct *vma;
6602+ unsigned long call_dl_resolve;
6603+
6604+ down_read(&current->mm->mmap_sem);
6605+ call_dl_resolve = current->mm->call_dl_resolve;
6606+ up_read(&current->mm->mmap_sem);
6607+ if (likely(call_dl_resolve))
6608+ goto emulate;
6609+
6610+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
6611+
6612+ down_write(&current->mm->mmap_sem);
6613+ if (current->mm->call_dl_resolve) {
6614+ call_dl_resolve = current->mm->call_dl_resolve;
6615+ up_write(&current->mm->mmap_sem);
6616+ if (vma)
6617+ kmem_cache_free(vm_area_cachep, vma);
6618+ goto emulate;
6619+ }
6620+
6621+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
6622+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
6623+ up_write(&current->mm->mmap_sem);
6624+ if (vma)
6625+ kmem_cache_free(vm_area_cachep, vma);
6626+ return 1;
6627+ }
6628+
6629+ if (pax_insert_vma(vma, call_dl_resolve)) {
6630+ up_write(&current->mm->mmap_sem);
6631+ kmem_cache_free(vm_area_cachep, vma);
6632+ return 1;
6633+ }
6634+
6635+ current->mm->call_dl_resolve = call_dl_resolve;
6636+ up_write(&current->mm->mmap_sem);
6637+
6638+emulate:
6639+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
6640+ regs->pc = call_dl_resolve;
6641+ regs->npc = addr+4;
6642+ return 3;
6643+ }
6644+#endif
6645+
6646+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
6647+ if ((save & 0xFFC00000U) == 0x05000000U &&
6648+ (call & 0xFFFFE000U) == 0x85C0A000U &&
6649+ nop == 0x01000000U)
6650+ {
6651+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
6652+ regs->u_regs[UREG_G2] = addr + 4;
6653+ addr = (save & 0x003FFFFFU) << 10;
6654+ addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6655+ regs->pc = addr;
6656+ regs->npc = addr+4;
6657+ return 3;
6658+ }
6659+ }
6660+ } while (0);
6661+
6662+ do { /* PaX: unpatched PLT emulation step 2 */
6663+ unsigned int save, call, nop;
6664+
6665+ err = get_user(save, (unsigned int *)(regs->pc-4));
6666+ err |= get_user(call, (unsigned int *)regs->pc);
6667+ err |= get_user(nop, (unsigned int *)(regs->pc+4));
6668+ if (err)
6669+ break;
6670+
6671+ if (save == 0x9DE3BFA8U &&
6672+ (call & 0xC0000000U) == 0x40000000U &&
6673+ nop == 0x01000000U)
6674+ {
6675+ unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
6676+
6677+ regs->u_regs[UREG_RETPC] = regs->pc;
6678+ regs->pc = dl_resolve;
6679+ regs->npc = dl_resolve+4;
6680+ return 3;
6681+ }
6682+ } while (0);
6683+#endif
6684+
6685+ return 1;
6686+}
6687+
6688+void pax_report_insns(void *pc, void *sp)
6689+{
6690+ unsigned long i;
6691+
6692+ printk(KERN_ERR "PAX: bytes at PC: ");
6693+ for (i = 0; i < 8; i++) {
6694+ unsigned int c;
6695+ if (get_user(c, (unsigned int *)pc+i))
6696+ printk(KERN_CONT "???????? ");
6697+ else
6698+ printk(KERN_CONT "%08x ", c);
6699+ }
6700+ printk("\n");
6701+}
6702+#endif
6703+
6704 static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
6705 int text_fault)
6706 {
6707@@ -281,6 +546,24 @@ good_area:
6708 if(!(vma->vm_flags & VM_WRITE))
6709 goto bad_area;
6710 } else {
6711+
6712+#ifdef CONFIG_PAX_PAGEEXEC
6713+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
6714+ up_read(&mm->mmap_sem);
6715+ switch (pax_handle_fetch_fault(regs)) {
6716+
6717+#ifdef CONFIG_PAX_EMUPLT
6718+ case 2:
6719+ case 3:
6720+ return;
6721+#endif
6722+
6723+ }
6724+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
6725+ do_group_exit(SIGKILL);
6726+ }
6727+#endif
6728+
6729 /* Allow reads even for write-only mappings */
6730 if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
6731 goto bad_area;
6732diff -urNp linux-2.6.39.1/arch/sparc/mm/fault_64.c linux-2.6.39.1/arch/sparc/mm/fault_64.c
6733--- linux-2.6.39.1/arch/sparc/mm/fault_64.c 2011-05-19 00:06:34.000000000 -0400
6734+++ linux-2.6.39.1/arch/sparc/mm/fault_64.c 2011-05-22 19:41:32.000000000 -0400
6735@@ -21,6 +21,9 @@
6736 #include <linux/kprobes.h>
6737 #include <linux/kdebug.h>
6738 #include <linux/percpu.h>
6739+#include <linux/slab.h>
6740+#include <linux/pagemap.h>
6741+#include <linux/compiler.h>
6742
6743 #include <asm/page.h>
6744 #include <asm/pgtable.h>
6745@@ -74,7 +77,7 @@ static void __kprobes bad_kernel_pc(stru
6746 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
6747 regs->tpc);
6748 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
6749- printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
6750+ printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
6751 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
6752 dump_stack();
6753 unhandled_fault(regs->tpc, current, regs);
6754@@ -272,6 +275,457 @@ static void noinline __kprobes bogus_32b
6755 show_regs(regs);
6756 }
6757
6758+#ifdef CONFIG_PAX_PAGEEXEC
6759+#ifdef CONFIG_PAX_DLRESOLVE
6760+static void pax_emuplt_close(struct vm_area_struct *vma)
6761+{
6762+ vma->vm_mm->call_dl_resolve = 0UL;
6763+}
6764+
6765+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
6766+{
6767+ unsigned int *kaddr;
6768+
6769+ vmf->page = alloc_page(GFP_HIGHUSER);
6770+ if (!vmf->page)
6771+ return VM_FAULT_OOM;
6772+
6773+ kaddr = kmap(vmf->page);
6774+ memset(kaddr, 0, PAGE_SIZE);
6775+ kaddr[0] = 0x9DE3BFA8U; /* save */
6776+ flush_dcache_page(vmf->page);
6777+ kunmap(vmf->page);
6778+ return VM_FAULT_MAJOR;
6779+}
6780+
6781+static const struct vm_operations_struct pax_vm_ops = {
6782+ .close = pax_emuplt_close,
6783+ .fault = pax_emuplt_fault
6784+};
6785+
6786+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
6787+{
6788+ int ret;
6789+
6790+ INIT_LIST_HEAD(&vma->anon_vma_chain);
6791+ vma->vm_mm = current->mm;
6792+ vma->vm_start = addr;
6793+ vma->vm_end = addr + PAGE_SIZE;
6794+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
6795+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
6796+ vma->vm_ops = &pax_vm_ops;
6797+
6798+ ret = insert_vm_struct(current->mm, vma);
6799+ if (ret)
6800+ return ret;
6801+
6802+ ++current->mm->total_vm;
6803+ return 0;
6804+}
6805+#endif
6806+
6807+/*
6808+ * PaX: decide what to do with offenders (regs->tpc = fault address)
6809+ *
6810+ * returns 1 when task should be killed
6811+ * 2 when patched PLT trampoline was detected
6812+ * 3 when unpatched PLT trampoline was detected
6813+ */
6814+static int pax_handle_fetch_fault(struct pt_regs *regs)
6815+{
6816+
6817+#ifdef CONFIG_PAX_EMUPLT
6818+ int err;
6819+
6820+ do { /* PaX: patched PLT emulation #1 */
6821+ unsigned int sethi1, sethi2, jmpl;
6822+
6823+ err = get_user(sethi1, (unsigned int *)regs->tpc);
6824+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
6825+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
6826+
6827+ if (err)
6828+ break;
6829+
6830+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
6831+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
6832+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
6833+ {
6834+ unsigned long addr;
6835+
6836+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
6837+ addr = regs->u_regs[UREG_G1];
6838+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
6839+
6840+ if (test_thread_flag(TIF_32BIT))
6841+ addr &= 0xFFFFFFFFUL;
6842+
6843+ regs->tpc = addr;
6844+ regs->tnpc = addr+4;
6845+ return 2;
6846+ }
6847+ } while (0);
6848+
6849+ { /* PaX: patched PLT emulation #2 */
6850+ unsigned int ba;
6851+
6852+ err = get_user(ba, (unsigned int *)regs->tpc);
6853+
6854+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
6855+ unsigned long addr;
6856+
6857+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
6858+
6859+ if (test_thread_flag(TIF_32BIT))
6860+ addr &= 0xFFFFFFFFUL;
6861+
6862+ regs->tpc = addr;
6863+ regs->tnpc = addr+4;
6864+ return 2;
6865+ }
6866+ }
6867+
6868+ do { /* PaX: patched PLT emulation #3 */
6869+ unsigned int sethi, jmpl, nop;
6870+
6871+ err = get_user(sethi, (unsigned int *)regs->tpc);
6872+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
6873+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
6874+
6875+ if (err)
6876+ break;
6877+
6878+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6879+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
6880+ nop == 0x01000000U)
6881+ {
6882+ unsigned long addr;
6883+
6884+ addr = (sethi & 0x003FFFFFU) << 10;
6885+ regs->u_regs[UREG_G1] = addr;
6886+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
6887+
6888+ if (test_thread_flag(TIF_32BIT))
6889+ addr &= 0xFFFFFFFFUL;
6890+
6891+ regs->tpc = addr;
6892+ regs->tnpc = addr+4;
6893+ return 2;
6894+ }
6895+ } while (0);
6896+
6897+ do { /* PaX: patched PLT emulation #4 */
6898+ unsigned int sethi, mov1, call, mov2;
6899+
6900+ err = get_user(sethi, (unsigned int *)regs->tpc);
6901+ err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
6902+ err |= get_user(call, (unsigned int *)(regs->tpc+8));
6903+ err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
6904+
6905+ if (err)
6906+ break;
6907+
6908+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6909+ mov1 == 0x8210000FU &&
6910+ (call & 0xC0000000U) == 0x40000000U &&
6911+ mov2 == 0x9E100001U)
6912+ {
6913+ unsigned long addr;
6914+
6915+ regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
6916+ addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
6917+
6918+ if (test_thread_flag(TIF_32BIT))
6919+ addr &= 0xFFFFFFFFUL;
6920+
6921+ regs->tpc = addr;
6922+ regs->tnpc = addr+4;
6923+ return 2;
6924+ }
6925+ } while (0);
6926+
6927+ do { /* PaX: patched PLT emulation #5 */
6928+ unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
6929+
6930+ err = get_user(sethi, (unsigned int *)regs->tpc);
6931+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
6932+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
6933+ err |= get_user(or1, (unsigned int *)(regs->tpc+12));
6934+ err |= get_user(or2, (unsigned int *)(regs->tpc+16));
6935+ err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
6936+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
6937+ err |= get_user(nop, (unsigned int *)(regs->tpc+28));
6938+
6939+ if (err)
6940+ break;
6941+
6942+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6943+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
6944+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
6945+ (or1 & 0xFFFFE000U) == 0x82106000U &&
6946+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
6947+ sllx == 0x83287020U &&
6948+ jmpl == 0x81C04005U &&
6949+ nop == 0x01000000U)
6950+ {
6951+ unsigned long addr;
6952+
6953+ regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
6954+ regs->u_regs[UREG_G1] <<= 32;
6955+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
6956+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
6957+ regs->tpc = addr;
6958+ regs->tnpc = addr+4;
6959+ return 2;
6960+ }
6961+ } while (0);
6962+
6963+ do { /* PaX: patched PLT emulation #6 */
6964+ unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
6965+
6966+ err = get_user(sethi, (unsigned int *)regs->tpc);
6967+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
6968+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
6969+ err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
6970+ err |= get_user(or, (unsigned int *)(regs->tpc+16));
6971+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
6972+ err |= get_user(nop, (unsigned int *)(regs->tpc+24));
6973+
6974+ if (err)
6975+ break;
6976+
6977+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6978+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
6979+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
6980+ sllx == 0x83287020U &&
6981+ (or & 0xFFFFE000U) == 0x8A116000U &&
6982+ jmpl == 0x81C04005U &&
6983+ nop == 0x01000000U)
6984+ {
6985+ unsigned long addr;
6986+
6987+ regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
6988+ regs->u_regs[UREG_G1] <<= 32;
6989+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
6990+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
6991+ regs->tpc = addr;
6992+ regs->tnpc = addr+4;
6993+ return 2;
6994+ }
6995+ } while (0);
6996+
6997+ do { /* PaX: unpatched PLT emulation step 1 */
6998+ unsigned int sethi, ba, nop;
6999+
7000+ err = get_user(sethi, (unsigned int *)regs->tpc);
7001+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
7002+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
7003+
7004+ if (err)
7005+ break;
7006+
7007+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
7008+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
7009+ nop == 0x01000000U)
7010+ {
7011+ unsigned long addr;
7012+ unsigned int save, call;
7013+ unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
7014+
7015+ if ((ba & 0xFFC00000U) == 0x30800000U)
7016+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
7017+ else
7018+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
7019+
7020+ if (test_thread_flag(TIF_32BIT))
7021+ addr &= 0xFFFFFFFFUL;
7022+
7023+ err = get_user(save, (unsigned int *)addr);
7024+ err |= get_user(call, (unsigned int *)(addr+4));
7025+ err |= get_user(nop, (unsigned int *)(addr+8));
7026+ if (err)
7027+ break;
7028+
7029+#ifdef CONFIG_PAX_DLRESOLVE
7030+ if (save == 0x9DE3BFA8U &&
7031+ (call & 0xC0000000U) == 0x40000000U &&
7032+ nop == 0x01000000U)
7033+ {
7034+ struct vm_area_struct *vma;
7035+ unsigned long call_dl_resolve;
7036+
7037+ down_read(&current->mm->mmap_sem);
7038+ call_dl_resolve = current->mm->call_dl_resolve;
7039+ up_read(&current->mm->mmap_sem);
7040+ if (likely(call_dl_resolve))
7041+ goto emulate;
7042+
7043+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
7044+
7045+ down_write(&current->mm->mmap_sem);
7046+ if (current->mm->call_dl_resolve) {
7047+ call_dl_resolve = current->mm->call_dl_resolve;
7048+ up_write(&current->mm->mmap_sem);
7049+ if (vma)
7050+ kmem_cache_free(vm_area_cachep, vma);
7051+ goto emulate;
7052+ }
7053+
7054+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
7055+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
7056+ up_write(&current->mm->mmap_sem);
7057+ if (vma)
7058+ kmem_cache_free(vm_area_cachep, vma);
7059+ return 1;
7060+ }
7061+
7062+ if (pax_insert_vma(vma, call_dl_resolve)) {
7063+ up_write(&current->mm->mmap_sem);
7064+ kmem_cache_free(vm_area_cachep, vma);
7065+ return 1;
7066+ }
7067+
7068+ current->mm->call_dl_resolve = call_dl_resolve;
7069+ up_write(&current->mm->mmap_sem);
7070+
7071+emulate:
7072+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7073+ regs->tpc = call_dl_resolve;
7074+ regs->tnpc = addr+4;
7075+ return 3;
7076+ }
7077+#endif
7078+
7079+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
7080+ if ((save & 0xFFC00000U) == 0x05000000U &&
7081+ (call & 0xFFFFE000U) == 0x85C0A000U &&
7082+ nop == 0x01000000U)
7083+ {
7084+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7085+ regs->u_regs[UREG_G2] = addr + 4;
7086+ addr = (save & 0x003FFFFFU) << 10;
7087+ addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
7088+
7089+ if (test_thread_flag(TIF_32BIT))
7090+ addr &= 0xFFFFFFFFUL;
7091+
7092+ regs->tpc = addr;
7093+ regs->tnpc = addr+4;
7094+ return 3;
7095+ }
7096+
7097+ /* PaX: 64-bit PLT stub */
7098+ err = get_user(sethi1, (unsigned int *)addr);
7099+ err |= get_user(sethi2, (unsigned int *)(addr+4));
7100+ err |= get_user(or1, (unsigned int *)(addr+8));
7101+ err |= get_user(or2, (unsigned int *)(addr+12));
7102+ err |= get_user(sllx, (unsigned int *)(addr+16));
7103+ err |= get_user(add, (unsigned int *)(addr+20));
7104+ err |= get_user(jmpl, (unsigned int *)(addr+24));
7105+ err |= get_user(nop, (unsigned int *)(addr+28));
7106+ if (err)
7107+ break;
7108+
7109+ if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
7110+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
7111+ (or1 & 0xFFFFE000U) == 0x88112000U &&
7112+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
7113+ sllx == 0x89293020U &&
7114+ add == 0x8A010005U &&
7115+ jmpl == 0x89C14000U &&
7116+ nop == 0x01000000U)
7117+ {
7118+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7119+ regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
7120+ regs->u_regs[UREG_G4] <<= 32;
7121+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
7122+ regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
7123+ regs->u_regs[UREG_G4] = addr + 24;
7124+ addr = regs->u_regs[UREG_G5];
7125+ regs->tpc = addr;
7126+ regs->tnpc = addr+4;
7127+ return 3;
7128+ }
7129+ }
7130+ } while (0);
7131+
7132+#ifdef CONFIG_PAX_DLRESOLVE
7133+ do { /* PaX: unpatched PLT emulation step 2 */
7134+ unsigned int save, call, nop;
7135+
7136+ err = get_user(save, (unsigned int *)(regs->tpc-4));
7137+ err |= get_user(call, (unsigned int *)regs->tpc);
7138+ err |= get_user(nop, (unsigned int *)(regs->tpc+4));
7139+ if (err)
7140+ break;
7141+
7142+ if (save == 0x9DE3BFA8U &&
7143+ (call & 0xC0000000U) == 0x40000000U &&
7144+ nop == 0x01000000U)
7145+ {
7146+ unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
7147+
7148+ if (test_thread_flag(TIF_32BIT))
7149+ dl_resolve &= 0xFFFFFFFFUL;
7150+
7151+ regs->u_regs[UREG_RETPC] = regs->tpc;
7152+ regs->tpc = dl_resolve;
7153+ regs->tnpc = dl_resolve+4;
7154+ return 3;
7155+ }
7156+ } while (0);
7157+#endif
7158+
7159+ do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
7160+ unsigned int sethi, ba, nop;
7161+
7162+ err = get_user(sethi, (unsigned int *)regs->tpc);
7163+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
7164+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
7165+
7166+ if (err)
7167+ break;
7168+
7169+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
7170+ (ba & 0xFFF00000U) == 0x30600000U &&
7171+ nop == 0x01000000U)
7172+ {
7173+ unsigned long addr;
7174+
7175+ addr = (sethi & 0x003FFFFFU) << 10;
7176+ regs->u_regs[UREG_G1] = addr;
7177+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
7178+
7179+ if (test_thread_flag(TIF_32BIT))
7180+ addr &= 0xFFFFFFFFUL;
7181+
7182+ regs->tpc = addr;
7183+ regs->tnpc = addr+4;
7184+ return 2;
7185+ }
7186+ } while (0);
7187+
7188+#endif
7189+
7190+ return 1;
7191+}
7192+
7193+void pax_report_insns(void *pc, void *sp)
7194+{
7195+ unsigned long i;
7196+
7197+ printk(KERN_ERR "PAX: bytes at PC: ");
7198+ for (i = 0; i < 8; i++) {
7199+ unsigned int c;
7200+ if (get_user(c, (unsigned int *)pc+i))
7201+ printk(KERN_CONT "???????? ");
7202+ else
7203+ printk(KERN_CONT "%08x ", c);
7204+ }
7205+ printk("\n");
7206+}
7207+#endif
7208+
7209 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
7210 {
7211 struct mm_struct *mm = current->mm;
7212@@ -340,6 +794,29 @@ asmlinkage void __kprobes do_sparc64_fau
7213 if (!vma)
7214 goto bad_area;
7215
7216+#ifdef CONFIG_PAX_PAGEEXEC
7217+ /* PaX: detect ITLB misses on non-exec pages */
7218+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
7219+ !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
7220+ {
7221+ if (address != regs->tpc)
7222+ goto good_area;
7223+
7224+ up_read(&mm->mmap_sem);
7225+ switch (pax_handle_fetch_fault(regs)) {
7226+
7227+#ifdef CONFIG_PAX_EMUPLT
7228+ case 2:
7229+ case 3:
7230+ return;
7231+#endif
7232+
7233+ }
7234+ pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
7235+ do_group_exit(SIGKILL);
7236+ }
7237+#endif
7238+
7239 /* Pure DTLB misses do not tell us whether the fault causing
7240 * load/store/atomic was a write or not, it only says that there
7241 * was no match. So in such a case we (carefully) read the
7242diff -urNp linux-2.6.39.1/arch/sparc/mm/hugetlbpage.c linux-2.6.39.1/arch/sparc/mm/hugetlbpage.c
7243--- linux-2.6.39.1/arch/sparc/mm/hugetlbpage.c 2011-05-19 00:06:34.000000000 -0400
7244+++ linux-2.6.39.1/arch/sparc/mm/hugetlbpage.c 2011-05-22 19:36:30.000000000 -0400
7245@@ -68,7 +68,7 @@ full_search:
7246 }
7247 return -ENOMEM;
7248 }
7249- if (likely(!vma || addr + len <= vma->vm_start)) {
7250+ if (likely(check_heap_stack_gap(vma, addr, len))) {
7251 /*
7252 * Remember the place where we stopped the search:
7253 */
7254@@ -107,7 +107,7 @@ hugetlb_get_unmapped_area_topdown(struct
7255 /* make sure it can fit in the remaining address space */
7256 if (likely(addr > len)) {
7257 vma = find_vma(mm, addr-len);
7258- if (!vma || addr <= vma->vm_start) {
7259+ if (check_heap_stack_gap(vma, addr - len, len)) {
7260 /* remember the address as a hint for next time */
7261 return (mm->free_area_cache = addr-len);
7262 }
7263@@ -116,16 +116,17 @@ hugetlb_get_unmapped_area_topdown(struct
7264 if (unlikely(mm->mmap_base < len))
7265 goto bottomup;
7266
7267- addr = (mm->mmap_base-len) & HPAGE_MASK;
7268+ addr = mm->mmap_base - len;
7269
7270 do {
7271+ addr &= HPAGE_MASK;
7272 /*
7273 * Lookup failure means no vma is above this address,
7274 * else if new region fits below vma->vm_start,
7275 * return with success:
7276 */
7277 vma = find_vma(mm, addr);
7278- if (likely(!vma || addr+len <= vma->vm_start)) {
7279+ if (likely(check_heap_stack_gap(vma, addr, len))) {
7280 /* remember the address as a hint for next time */
7281 return (mm->free_area_cache = addr);
7282 }
7283@@ -135,8 +136,8 @@ hugetlb_get_unmapped_area_topdown(struct
7284 mm->cached_hole_size = vma->vm_start - addr;
7285
7286 /* try just below the current vma->vm_start */
7287- addr = (vma->vm_start-len) & HPAGE_MASK;
7288- } while (likely(len < vma->vm_start));
7289+ addr = skip_heap_stack_gap(vma, len);
7290+ } while (!IS_ERR_VALUE(addr));
7291
7292 bottomup:
7293 /*
7294@@ -182,8 +183,7 @@ hugetlb_get_unmapped_area(struct file *f
7295 if (addr) {
7296 addr = ALIGN(addr, HPAGE_SIZE);
7297 vma = find_vma(mm, addr);
7298- if (task_size - len >= addr &&
7299- (!vma || addr + len <= vma->vm_start))
7300+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
7301 return addr;
7302 }
7303 if (mm->get_unmapped_area == arch_get_unmapped_area)
7304diff -urNp linux-2.6.39.1/arch/sparc/mm/init_32.c linux-2.6.39.1/arch/sparc/mm/init_32.c
7305--- linux-2.6.39.1/arch/sparc/mm/init_32.c 2011-05-19 00:06:34.000000000 -0400
7306+++ linux-2.6.39.1/arch/sparc/mm/init_32.c 2011-05-22 19:36:30.000000000 -0400
7307@@ -318,6 +318,9 @@ extern void device_scan(void);
7308 pgprot_t PAGE_SHARED __read_mostly;
7309 EXPORT_SYMBOL(PAGE_SHARED);
7310
7311+pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
7312+EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
7313+
7314 void __init paging_init(void)
7315 {
7316 switch(sparc_cpu_model) {
7317@@ -346,17 +349,17 @@ void __init paging_init(void)
7318
7319 /* Initialize the protection map with non-constant, MMU dependent values. */
7320 protection_map[0] = PAGE_NONE;
7321- protection_map[1] = PAGE_READONLY;
7322- protection_map[2] = PAGE_COPY;
7323- protection_map[3] = PAGE_COPY;
7324+ protection_map[1] = PAGE_READONLY_NOEXEC;
7325+ protection_map[2] = PAGE_COPY_NOEXEC;
7326+ protection_map[3] = PAGE_COPY_NOEXEC;
7327 protection_map[4] = PAGE_READONLY;
7328 protection_map[5] = PAGE_READONLY;
7329 protection_map[6] = PAGE_COPY;
7330 protection_map[7] = PAGE_COPY;
7331 protection_map[8] = PAGE_NONE;
7332- protection_map[9] = PAGE_READONLY;
7333- protection_map[10] = PAGE_SHARED;
7334- protection_map[11] = PAGE_SHARED;
7335+ protection_map[9] = PAGE_READONLY_NOEXEC;
7336+ protection_map[10] = PAGE_SHARED_NOEXEC;
7337+ protection_map[11] = PAGE_SHARED_NOEXEC;
7338 protection_map[12] = PAGE_READONLY;
7339 protection_map[13] = PAGE_READONLY;
7340 protection_map[14] = PAGE_SHARED;
7341diff -urNp linux-2.6.39.1/arch/sparc/mm/Makefile linux-2.6.39.1/arch/sparc/mm/Makefile
7342--- linux-2.6.39.1/arch/sparc/mm/Makefile 2011-05-19 00:06:34.000000000 -0400
7343+++ linux-2.6.39.1/arch/sparc/mm/Makefile 2011-05-22 19:36:30.000000000 -0400
7344@@ -2,7 +2,7 @@
7345 #
7346
7347 asflags-y := -ansi
7348-ccflags-y := -Werror
7349+#ccflags-y := -Werror
7350
7351 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o
7352 obj-y += fault_$(BITS).o
7353diff -urNp linux-2.6.39.1/arch/sparc/mm/srmmu.c linux-2.6.39.1/arch/sparc/mm/srmmu.c
7354--- linux-2.6.39.1/arch/sparc/mm/srmmu.c 2011-05-19 00:06:34.000000000 -0400
7355+++ linux-2.6.39.1/arch/sparc/mm/srmmu.c 2011-05-22 19:36:30.000000000 -0400
7356@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
7357 PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
7358 BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
7359 BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
7360+
7361+#ifdef CONFIG_PAX_PAGEEXEC
7362+ PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
7363+ BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
7364+ BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
7365+#endif
7366+
7367 BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
7368 page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
7369
7370diff -urNp linux-2.6.39.1/arch/tile/kernel/pci.c linux-2.6.39.1/arch/tile/kernel/pci.c
7371--- linux-2.6.39.1/arch/tile/kernel/pci.c 2011-05-19 00:06:34.000000000 -0400
7372+++ linux-2.6.39.1/arch/tile/kernel/pci.c 2011-05-22 19:36:30.000000000 -0400
7373@@ -60,7 +60,7 @@ int __write_once tile_plx_gen1;
7374 static struct pci_controller controllers[TILE_NUM_PCIE];
7375 static int num_controllers;
7376
7377-static struct pci_ops tile_cfg_ops;
7378+static const struct pci_ops tile_cfg_ops;
7379
7380
7381 /*
7382@@ -564,7 +564,7 @@ static int __devinit tile_cfg_write(stru
7383 }
7384
7385
7386-static struct pci_ops tile_cfg_ops = {
7387+static const struct pci_ops tile_cfg_ops = {
7388 .read = tile_cfg_read,
7389 .write = tile_cfg_write,
7390 };
7391diff -urNp linux-2.6.39.1/arch/um/include/asm/kmap_types.h linux-2.6.39.1/arch/um/include/asm/kmap_types.h
7392--- linux-2.6.39.1/arch/um/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
7393+++ linux-2.6.39.1/arch/um/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
7394@@ -23,6 +23,7 @@ enum km_type {
7395 KM_IRQ1,
7396 KM_SOFTIRQ0,
7397 KM_SOFTIRQ1,
7398+ KM_CLEARPAGE,
7399 KM_TYPE_NR
7400 };
7401
7402diff -urNp linux-2.6.39.1/arch/um/include/asm/page.h linux-2.6.39.1/arch/um/include/asm/page.h
7403--- linux-2.6.39.1/arch/um/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
7404+++ linux-2.6.39.1/arch/um/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
7405@@ -14,6 +14,9 @@
7406 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
7407 #define PAGE_MASK (~(PAGE_SIZE-1))
7408
7409+#define ktla_ktva(addr) (addr)
7410+#define ktva_ktla(addr) (addr)
7411+
7412 #ifndef __ASSEMBLY__
7413
7414 struct page;
7415diff -urNp linux-2.6.39.1/arch/um/kernel/process.c linux-2.6.39.1/arch/um/kernel/process.c
7416--- linux-2.6.39.1/arch/um/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
7417+++ linux-2.6.39.1/arch/um/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
7418@@ -404,22 +404,6 @@ int singlestepping(void * t)
7419 return 2;
7420 }
7421
7422-/*
7423- * Only x86 and x86_64 have an arch_align_stack().
7424- * All other arches have "#define arch_align_stack(x) (x)"
7425- * in their asm/system.h
7426- * As this is included in UML from asm-um/system-generic.h,
7427- * we can use it to behave as the subarch does.
7428- */
7429-#ifndef arch_align_stack
7430-unsigned long arch_align_stack(unsigned long sp)
7431-{
7432- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
7433- sp -= get_random_int() % 8192;
7434- return sp & ~0xf;
7435-}
7436-#endif
7437-
7438 unsigned long get_wchan(struct task_struct *p)
7439 {
7440 unsigned long stack_page, sp, ip;
7441diff -urNp linux-2.6.39.1/arch/um/sys-i386/syscalls.c linux-2.6.39.1/arch/um/sys-i386/syscalls.c
7442--- linux-2.6.39.1/arch/um/sys-i386/syscalls.c 2011-05-19 00:06:34.000000000 -0400
7443+++ linux-2.6.39.1/arch/um/sys-i386/syscalls.c 2011-05-22 19:36:30.000000000 -0400
7444@@ -11,6 +11,21 @@
7445 #include "asm/uaccess.h"
7446 #include "asm/unistd.h"
7447
7448+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
7449+{
7450+ unsigned long pax_task_size = TASK_SIZE;
7451+
7452+#ifdef CONFIG_PAX_SEGMEXEC
7453+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
7454+ pax_task_size = SEGMEXEC_TASK_SIZE;
7455+#endif
7456+
7457+ if (len > pax_task_size || addr > pax_task_size - len)
7458+ return -EINVAL;
7459+
7460+ return 0;
7461+}
7462+
7463 /*
7464 * The prototype on i386 is:
7465 *
7466diff -urNp linux-2.6.39.1/arch/unicore32/kernel/pci.c linux-2.6.39.1/arch/unicore32/kernel/pci.c
7467--- linux-2.6.39.1/arch/unicore32/kernel/pci.c 2011-05-19 00:06:34.000000000 -0400
7468+++ linux-2.6.39.1/arch/unicore32/kernel/pci.c 2011-05-22 19:36:30.000000000 -0400
7469@@ -66,7 +66,7 @@ puv3_write_config(struct pci_bus *bus, u
7470 return PCIBIOS_SUCCESSFUL;
7471 }
7472
7473-struct pci_ops pci_puv3_ops = {
7474+const struct pci_ops pci_puv3_ops = {
7475 .read = puv3_read_config,
7476 .write = puv3_write_config,
7477 };
7478diff -urNp linux-2.6.39.1/arch/x86/boot/bitops.h linux-2.6.39.1/arch/x86/boot/bitops.h
7479--- linux-2.6.39.1/arch/x86/boot/bitops.h 2011-05-19 00:06:34.000000000 -0400
7480+++ linux-2.6.39.1/arch/x86/boot/bitops.h 2011-05-22 19:36:30.000000000 -0400
7481@@ -26,7 +26,7 @@ static inline int variable_test_bit(int
7482 u8 v;
7483 const u32 *p = (const u32 *)addr;
7484
7485- asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
7486+ asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
7487 return v;
7488 }
7489
7490@@ -37,7 +37,7 @@ static inline int variable_test_bit(int
7491
7492 static inline void set_bit(int nr, void *addr)
7493 {
7494- asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
7495+ asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
7496 }
7497
7498 #endif /* BOOT_BITOPS_H */
7499diff -urNp linux-2.6.39.1/arch/x86/boot/boot.h linux-2.6.39.1/arch/x86/boot/boot.h
7500--- linux-2.6.39.1/arch/x86/boot/boot.h 2011-05-19 00:06:34.000000000 -0400
7501+++ linux-2.6.39.1/arch/x86/boot/boot.h 2011-05-22 19:36:30.000000000 -0400
7502@@ -85,7 +85,7 @@ static inline void io_delay(void)
7503 static inline u16 ds(void)
7504 {
7505 u16 seg;
7506- asm("movw %%ds,%0" : "=rm" (seg));
7507+ asm volatile("movw %%ds,%0" : "=rm" (seg));
7508 return seg;
7509 }
7510
7511@@ -181,7 +181,7 @@ static inline void wrgs32(u32 v, addr_t
7512 static inline int memcmp(const void *s1, const void *s2, size_t len)
7513 {
7514 u8 diff;
7515- asm("repe; cmpsb; setnz %0"
7516+ asm volatile("repe; cmpsb; setnz %0"
7517 : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
7518 return diff;
7519 }
7520diff -urNp linux-2.6.39.1/arch/x86/boot/compressed/head_32.S linux-2.6.39.1/arch/x86/boot/compressed/head_32.S
7521--- linux-2.6.39.1/arch/x86/boot/compressed/head_32.S 2011-05-19 00:06:34.000000000 -0400
7522+++ linux-2.6.39.1/arch/x86/boot/compressed/head_32.S 2011-05-22 19:36:30.000000000 -0400
7523@@ -76,7 +76,7 @@ ENTRY(startup_32)
7524 notl %eax
7525 andl %eax, %ebx
7526 #else
7527- movl $LOAD_PHYSICAL_ADDR, %ebx
7528+ movl $____LOAD_PHYSICAL_ADDR, %ebx
7529 #endif
7530
7531 /* Target address to relocate to for decompression */
7532@@ -162,7 +162,7 @@ relocated:
7533 * and where it was actually loaded.
7534 */
7535 movl %ebp, %ebx
7536- subl $LOAD_PHYSICAL_ADDR, %ebx
7537+ subl $____LOAD_PHYSICAL_ADDR, %ebx
7538 jz 2f /* Nothing to be done if loaded at compiled addr. */
7539 /*
7540 * Process relocations.
7541@@ -170,8 +170,7 @@ relocated:
7542
7543 1: subl $4, %edi
7544 movl (%edi), %ecx
7545- testl %ecx, %ecx
7546- jz 2f
7547+ jecxz 2f
7548 addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
7549 jmp 1b
7550 2:
7551diff -urNp linux-2.6.39.1/arch/x86/boot/compressed/head_64.S linux-2.6.39.1/arch/x86/boot/compressed/head_64.S
7552--- linux-2.6.39.1/arch/x86/boot/compressed/head_64.S 2011-05-19 00:06:34.000000000 -0400
7553+++ linux-2.6.39.1/arch/x86/boot/compressed/head_64.S 2011-05-22 19:36:30.000000000 -0400
7554@@ -91,7 +91,7 @@ ENTRY(startup_32)
7555 notl %eax
7556 andl %eax, %ebx
7557 #else
7558- movl $LOAD_PHYSICAL_ADDR, %ebx
7559+ movl $____LOAD_PHYSICAL_ADDR, %ebx
7560 #endif
7561
7562 /* Target address to relocate to for decompression */
7563@@ -233,7 +233,7 @@ ENTRY(startup_64)
7564 notq %rax
7565 andq %rax, %rbp
7566 #else
7567- movq $LOAD_PHYSICAL_ADDR, %rbp
7568+ movq $____LOAD_PHYSICAL_ADDR, %rbp
7569 #endif
7570
7571 /* Target address to relocate to for decompression */
7572diff -urNp linux-2.6.39.1/arch/x86/boot/compressed/misc.c linux-2.6.39.1/arch/x86/boot/compressed/misc.c
7573--- linux-2.6.39.1/arch/x86/boot/compressed/misc.c 2011-05-19 00:06:34.000000000 -0400
7574+++ linux-2.6.39.1/arch/x86/boot/compressed/misc.c 2011-05-22 19:36:30.000000000 -0400
7575@@ -310,7 +310,7 @@ static void parse_elf(void *output)
7576 case PT_LOAD:
7577 #ifdef CONFIG_RELOCATABLE
7578 dest = output;
7579- dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
7580+ dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
7581 #else
7582 dest = (void *)(phdr->p_paddr);
7583 #endif
7584@@ -363,7 +363,7 @@ asmlinkage void decompress_kernel(void *
7585 error("Destination address too large");
7586 #endif
7587 #ifndef CONFIG_RELOCATABLE
7588- if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
7589+ if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
7590 error("Wrong destination address");
7591 #endif
7592
7593diff -urNp linux-2.6.39.1/arch/x86/boot/compressed/relocs.c linux-2.6.39.1/arch/x86/boot/compressed/relocs.c
7594--- linux-2.6.39.1/arch/x86/boot/compressed/relocs.c 2011-05-19 00:06:34.000000000 -0400
7595+++ linux-2.6.39.1/arch/x86/boot/compressed/relocs.c 2011-05-22 19:36:30.000000000 -0400
7596@@ -13,8 +13,11 @@
7597
7598 static void die(char *fmt, ...);
7599
7600+#include "../../../../include/generated/autoconf.h"
7601+
7602 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
7603 static Elf32_Ehdr ehdr;
7604+static Elf32_Phdr *phdr;
7605 static unsigned long reloc_count, reloc_idx;
7606 static unsigned long *relocs;
7607
7608@@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp)
7609 }
7610 }
7611
7612+static void read_phdrs(FILE *fp)
7613+{
7614+ unsigned int i;
7615+
7616+ phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
7617+ if (!phdr) {
7618+ die("Unable to allocate %d program headers\n",
7619+ ehdr.e_phnum);
7620+ }
7621+ if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
7622+ die("Seek to %d failed: %s\n",
7623+ ehdr.e_phoff, strerror(errno));
7624+ }
7625+ if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
7626+ die("Cannot read ELF program headers: %s\n",
7627+ strerror(errno));
7628+ }
7629+ for(i = 0; i < ehdr.e_phnum; i++) {
7630+ phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
7631+ phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
7632+ phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
7633+ phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
7634+ phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
7635+ phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
7636+ phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
7637+ phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
7638+ }
7639+
7640+}
7641+
7642 static void read_shdrs(FILE *fp)
7643 {
7644- int i;
7645+ unsigned int i;
7646 Elf32_Shdr shdr;
7647
7648 secs = calloc(ehdr.e_shnum, sizeof(struct section));
7649@@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp)
7650
7651 static void read_strtabs(FILE *fp)
7652 {
7653- int i;
7654+ unsigned int i;
7655 for (i = 0; i < ehdr.e_shnum; i++) {
7656 struct section *sec = &secs[i];
7657 if (sec->shdr.sh_type != SHT_STRTAB) {
7658@@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp)
7659
7660 static void read_symtabs(FILE *fp)
7661 {
7662- int i,j;
7663+ unsigned int i,j;
7664 for (i = 0; i < ehdr.e_shnum; i++) {
7665 struct section *sec = &secs[i];
7666 if (sec->shdr.sh_type != SHT_SYMTAB) {
7667@@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp)
7668
7669 static void read_relocs(FILE *fp)
7670 {
7671- int i,j;
7672+ unsigned int i,j;
7673+ uint32_t base;
7674+
7675 for (i = 0; i < ehdr.e_shnum; i++) {
7676 struct section *sec = &secs[i];
7677 if (sec->shdr.sh_type != SHT_REL) {
7678@@ -385,9 +420,18 @@ static void read_relocs(FILE *fp)
7679 die("Cannot read symbol table: %s\n",
7680 strerror(errno));
7681 }
7682+ base = 0;
7683+ for (j = 0; j < ehdr.e_phnum; j++) {
7684+ if (phdr[j].p_type != PT_LOAD )
7685+ continue;
7686+ if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
7687+ continue;
7688+ base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
7689+ break;
7690+ }
7691 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
7692 Elf32_Rel *rel = &sec->reltab[j];
7693- rel->r_offset = elf32_to_cpu(rel->r_offset);
7694+ rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
7695 rel->r_info = elf32_to_cpu(rel->r_info);
7696 }
7697 }
7698@@ -396,14 +440,14 @@ static void read_relocs(FILE *fp)
7699
7700 static void print_absolute_symbols(void)
7701 {
7702- int i;
7703+ unsigned int i;
7704 printf("Absolute symbols\n");
7705 printf(" Num: Value Size Type Bind Visibility Name\n");
7706 for (i = 0; i < ehdr.e_shnum; i++) {
7707 struct section *sec = &secs[i];
7708 char *sym_strtab;
7709 Elf32_Sym *sh_symtab;
7710- int j;
7711+ unsigned int j;
7712
7713 if (sec->shdr.sh_type != SHT_SYMTAB) {
7714 continue;
7715@@ -431,14 +475,14 @@ static void print_absolute_symbols(void)
7716
7717 static void print_absolute_relocs(void)
7718 {
7719- int i, printed = 0;
7720+ unsigned int i, printed = 0;
7721
7722 for (i = 0; i < ehdr.e_shnum; i++) {
7723 struct section *sec = &secs[i];
7724 struct section *sec_applies, *sec_symtab;
7725 char *sym_strtab;
7726 Elf32_Sym *sh_symtab;
7727- int j;
7728+ unsigned int j;
7729 if (sec->shdr.sh_type != SHT_REL) {
7730 continue;
7731 }
7732@@ -499,13 +543,13 @@ static void print_absolute_relocs(void)
7733
7734 static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
7735 {
7736- int i;
7737+ unsigned int i;
7738 /* Walk through the relocations */
7739 for (i = 0; i < ehdr.e_shnum; i++) {
7740 char *sym_strtab;
7741 Elf32_Sym *sh_symtab;
7742 struct section *sec_applies, *sec_symtab;
7743- int j;
7744+ unsigned int j;
7745 struct section *sec = &secs[i];
7746
7747 if (sec->shdr.sh_type != SHT_REL) {
7748@@ -530,6 +574,22 @@ static void walk_relocs(void (*visit)(El
7749 !is_rel_reloc(sym_name(sym_strtab, sym))) {
7750 continue;
7751 }
7752+ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
7753+ if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
7754+ continue;
7755+
7756+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
7757+ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
7758+ if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
7759+ continue;
7760+ if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
7761+ continue;
7762+ if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
7763+ continue;
7764+ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
7765+ continue;
7766+#endif
7767+
7768 switch (r_type) {
7769 case R_386_NONE:
7770 case R_386_PC32:
7771@@ -571,7 +631,7 @@ static int cmp_relocs(const void *va, co
7772
7773 static void emit_relocs(int as_text)
7774 {
7775- int i;
7776+ unsigned int i;
7777 /* Count how many relocations I have and allocate space for them. */
7778 reloc_count = 0;
7779 walk_relocs(count_reloc);
7780@@ -665,6 +725,7 @@ int main(int argc, char **argv)
7781 fname, strerror(errno));
7782 }
7783 read_ehdr(fp);
7784+ read_phdrs(fp);
7785 read_shdrs(fp);
7786 read_strtabs(fp);
7787 read_symtabs(fp);
7788diff -urNp linux-2.6.39.1/arch/x86/boot/cpucheck.c linux-2.6.39.1/arch/x86/boot/cpucheck.c
7789--- linux-2.6.39.1/arch/x86/boot/cpucheck.c 2011-05-19 00:06:34.000000000 -0400
7790+++ linux-2.6.39.1/arch/x86/boot/cpucheck.c 2011-05-22 19:36:30.000000000 -0400
7791@@ -74,7 +74,7 @@ static int has_fpu(void)
7792 u16 fcw = -1, fsw = -1;
7793 u32 cr0;
7794
7795- asm("movl %%cr0,%0" : "=r" (cr0));
7796+ asm volatile("movl %%cr0,%0" : "=r" (cr0));
7797 if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
7798 cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
7799 asm volatile("movl %0,%%cr0" : : "r" (cr0));
7800@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
7801 {
7802 u32 f0, f1;
7803
7804- asm("pushfl ; "
7805+ asm volatile("pushfl ; "
7806 "pushfl ; "
7807 "popl %0 ; "
7808 "movl %0,%1 ; "
7809@@ -115,7 +115,7 @@ static void get_flags(void)
7810 set_bit(X86_FEATURE_FPU, cpu.flags);
7811
7812 if (has_eflag(X86_EFLAGS_ID)) {
7813- asm("cpuid"
7814+ asm volatile("cpuid"
7815 : "=a" (max_intel_level),
7816 "=b" (cpu_vendor[0]),
7817 "=d" (cpu_vendor[1]),
7818@@ -124,7 +124,7 @@ static void get_flags(void)
7819
7820 if (max_intel_level >= 0x00000001 &&
7821 max_intel_level <= 0x0000ffff) {
7822- asm("cpuid"
7823+ asm volatile("cpuid"
7824 : "=a" (tfms),
7825 "=c" (cpu.flags[4]),
7826 "=d" (cpu.flags[0])
7827@@ -136,7 +136,7 @@ static void get_flags(void)
7828 cpu.model += ((tfms >> 16) & 0xf) << 4;
7829 }
7830
7831- asm("cpuid"
7832+ asm volatile("cpuid"
7833 : "=a" (max_amd_level)
7834 : "a" (0x80000000)
7835 : "ebx", "ecx", "edx");
7836@@ -144,7 +144,7 @@ static void get_flags(void)
7837 if (max_amd_level >= 0x80000001 &&
7838 max_amd_level <= 0x8000ffff) {
7839 u32 eax = 0x80000001;
7840- asm("cpuid"
7841+ asm volatile("cpuid"
7842 : "+a" (eax),
7843 "=c" (cpu.flags[6]),
7844 "=d" (cpu.flags[1])
7845@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
7846 u32 ecx = MSR_K7_HWCR;
7847 u32 eax, edx;
7848
7849- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7850+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7851 eax &= ~(1 << 15);
7852- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7853+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7854
7855 get_flags(); /* Make sure it really did something */
7856 err = check_flags();
7857@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
7858 u32 ecx = MSR_VIA_FCR;
7859 u32 eax, edx;
7860
7861- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7862+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7863 eax |= (1<<1)|(1<<7);
7864- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7865+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7866
7867 set_bit(X86_FEATURE_CX8, cpu.flags);
7868 err = check_flags();
7869@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
7870 u32 eax, edx;
7871 u32 level = 1;
7872
7873- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7874- asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
7875- asm("cpuid"
7876+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7877+ asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
7878+ asm volatile("cpuid"
7879 : "+a" (level), "=d" (cpu.flags[0])
7880 : : "ecx", "ebx");
7881- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7882+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7883
7884 err = check_flags();
7885 }
7886diff -urNp linux-2.6.39.1/arch/x86/boot/header.S linux-2.6.39.1/arch/x86/boot/header.S
7887--- linux-2.6.39.1/arch/x86/boot/header.S 2011-05-19 00:06:34.000000000 -0400
7888+++ linux-2.6.39.1/arch/x86/boot/header.S 2011-05-22 19:36:30.000000000 -0400
7889@@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical
7890 # single linked list of
7891 # struct setup_data
7892
7893-pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
7894+pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
7895
7896 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
7897 #define VO_INIT_SIZE (VO__end - VO__text)
7898diff -urNp linux-2.6.39.1/arch/x86/boot/memory.c linux-2.6.39.1/arch/x86/boot/memory.c
7899--- linux-2.6.39.1/arch/x86/boot/memory.c 2011-05-19 00:06:34.000000000 -0400
7900+++ linux-2.6.39.1/arch/x86/boot/memory.c 2011-05-22 19:36:30.000000000 -0400
7901@@ -19,7 +19,7 @@
7902
7903 static int detect_memory_e820(void)
7904 {
7905- int count = 0;
7906+ unsigned int count = 0;
7907 struct biosregs ireg, oreg;
7908 struct e820entry *desc = boot_params.e820_map;
7909 static struct e820entry buf; /* static so it is zeroed */
7910diff -urNp linux-2.6.39.1/arch/x86/boot/video.c linux-2.6.39.1/arch/x86/boot/video.c
7911--- linux-2.6.39.1/arch/x86/boot/video.c 2011-05-19 00:06:34.000000000 -0400
7912+++ linux-2.6.39.1/arch/x86/boot/video.c 2011-05-22 19:36:30.000000000 -0400
7913@@ -96,7 +96,7 @@ static void store_mode_params(void)
7914 static unsigned int get_entry(void)
7915 {
7916 char entry_buf[4];
7917- int i, len = 0;
7918+ unsigned int i, len = 0;
7919 int key;
7920 unsigned int v;
7921
7922diff -urNp linux-2.6.39.1/arch/x86/boot/video-vesa.c linux-2.6.39.1/arch/x86/boot/video-vesa.c
7923--- linux-2.6.39.1/arch/x86/boot/video-vesa.c 2011-05-19 00:06:34.000000000 -0400
7924+++ linux-2.6.39.1/arch/x86/boot/video-vesa.c 2011-05-22 19:36:30.000000000 -0400
7925@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
7926
7927 boot_params.screen_info.vesapm_seg = oreg.es;
7928 boot_params.screen_info.vesapm_off = oreg.di;
7929+ boot_params.screen_info.vesapm_size = oreg.cx;
7930 }
7931
7932 /*
7933diff -urNp linux-2.6.39.1/arch/x86/ia32/ia32_aout.c linux-2.6.39.1/arch/x86/ia32/ia32_aout.c
7934--- linux-2.6.39.1/arch/x86/ia32/ia32_aout.c 2011-05-19 00:06:34.000000000 -0400
7935+++ linux-2.6.39.1/arch/x86/ia32/ia32_aout.c 2011-05-22 19:41:32.000000000 -0400
7936@@ -162,6 +162,8 @@ static int aout_core_dump(long signr, st
7937 unsigned long dump_start, dump_size;
7938 struct user32 dump;
7939
7940+ memset(&dump, 0, sizeof(dump));
7941+
7942 fs = get_fs();
7943 set_fs(KERNEL_DS);
7944 has_dumped = 1;
7945diff -urNp linux-2.6.39.1/arch/x86/ia32/ia32entry.S linux-2.6.39.1/arch/x86/ia32/ia32entry.S
7946--- linux-2.6.39.1/arch/x86/ia32/ia32entry.S 2011-05-19 00:06:34.000000000 -0400
7947+++ linux-2.6.39.1/arch/x86/ia32/ia32entry.S 2011-05-23 17:16:01.000000000 -0400
7948@@ -13,6 +13,7 @@
7949 #include <asm/thread_info.h>
7950 #include <asm/segment.h>
7951 #include <asm/irqflags.h>
7952+#include <asm/pgtable.h>
7953 #include <linux/linkage.h>
7954
7955 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
7956@@ -95,6 +96,32 @@ ENTRY(native_irq_enable_sysexit)
7957 ENDPROC(native_irq_enable_sysexit)
7958 #endif
7959
7960+ .macro pax_enter_kernel_user
7961+#ifdef CONFIG_PAX_MEMORY_UDEREF
7962+ call pax_enter_kernel_user
7963+#endif
7964+ .endm
7965+
7966+ .macro pax_exit_kernel_user
7967+#ifdef CONFIG_PAX_MEMORY_UDEREF
7968+ call pax_exit_kernel_user
7969+#endif
7970+#ifdef CONFIG_PAX_RANDKSTACK
7971+ pushq %rax
7972+ call pax_randomize_kstack
7973+ popq %rax
7974+#endif
7975+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
7976+ call pax_erase_kstack
7977+#endif
7978+ .endm
7979+
7980+ .macro pax_erase_kstack
7981+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
7982+ call pax_erase_kstack
7983+#endif
7984+ .endm
7985+
7986 /*
7987 * 32bit SYSENTER instruction entry.
7988 *
7989@@ -121,7 +148,7 @@ ENTRY(ia32_sysenter_target)
7990 CFI_REGISTER rsp,rbp
7991 SWAPGS_UNSAFE_STACK
7992 movq PER_CPU_VAR(kernel_stack), %rsp
7993- addq $(KERNEL_STACK_OFFSET),%rsp
7994+ pax_enter_kernel_user
7995 /*
7996 * No need to follow this irqs on/off section: the syscall
7997 * disabled irqs, here we enable it straight after entry:
7998@@ -134,7 +161,8 @@ ENTRY(ia32_sysenter_target)
7999 CFI_REL_OFFSET rsp,0
8000 pushfq_cfi
8001 /*CFI_REL_OFFSET rflags,0*/
8002- movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
8003+ GET_THREAD_INFO(%r10)
8004+ movl TI_sysenter_return(%r10), %r10d
8005 CFI_REGISTER rip,r10
8006 pushq_cfi $__USER32_CS
8007 /*CFI_REL_OFFSET cs,0*/
8008@@ -146,6 +174,12 @@ ENTRY(ia32_sysenter_target)
8009 SAVE_ARGS 0,0,1
8010 /* no need to do an access_ok check here because rbp has been
8011 32bit zero extended */
8012+
8013+#ifdef CONFIG_PAX_MEMORY_UDEREF
8014+ mov $PAX_USER_SHADOW_BASE,%r10
8015+ add %r10,%rbp
8016+#endif
8017+
8018 1: movl (%rbp),%ebp
8019 .section __ex_table,"a"
8020 .quad 1b,ia32_badarg
8021@@ -168,6 +202,7 @@ sysenter_dispatch:
8022 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
8023 jnz sysexit_audit
8024 sysexit_from_sys_call:
8025+ pax_exit_kernel_user
8026 andl $~TS_COMPAT,TI_status(%r10)
8027 /* clear IF, that popfq doesn't enable interrupts early */
8028 andl $~0x200,EFLAGS-R11(%rsp)
8029@@ -194,6 +229,9 @@ sysexit_from_sys_call:
8030 movl %eax,%esi /* 2nd arg: syscall number */
8031 movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
8032 call audit_syscall_entry
8033+
8034+ pax_erase_kstack
8035+
8036 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
8037 cmpq $(IA32_NR_syscalls-1),%rax
8038 ja ia32_badsys
8039@@ -246,6 +284,9 @@ sysenter_tracesys:
8040 movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
8041 movq %rsp,%rdi /* &pt_regs -> arg1 */
8042 call syscall_trace_enter
8043+
8044+ pax_erase_kstack
8045+
8046 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
8047 RESTORE_REST
8048 cmpq $(IA32_NR_syscalls-1),%rax
8049@@ -277,19 +318,24 @@ ENDPROC(ia32_sysenter_target)
8050 ENTRY(ia32_cstar_target)
8051 CFI_STARTPROC32 simple
8052 CFI_SIGNAL_FRAME
8053- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
8054+ CFI_DEF_CFA rsp,0
8055 CFI_REGISTER rip,rcx
8056 /*CFI_REGISTER rflags,r11*/
8057 SWAPGS_UNSAFE_STACK
8058 movl %esp,%r8d
8059 CFI_REGISTER rsp,r8
8060 movq PER_CPU_VAR(kernel_stack),%rsp
8061+
8062+#ifdef CONFIG_PAX_MEMORY_UDEREF
8063+ pax_enter_kernel_user
8064+#endif
8065+
8066 /*
8067 * No need to follow this irqs on/off section: the syscall
8068 * disabled irqs and here we enable it straight after entry:
8069 */
8070 ENABLE_INTERRUPTS(CLBR_NONE)
8071- SAVE_ARGS 8,1,1
8072+ SAVE_ARGS 8*6,1,1
8073 movl %eax,%eax /* zero extension */
8074 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
8075 movq %rcx,RIP-ARGOFFSET(%rsp)
8076@@ -305,6 +351,12 @@ ENTRY(ia32_cstar_target)
8077 /* no need to do an access_ok check here because r8 has been
8078 32bit zero extended */
8079 /* hardware stack frame is complete now */
8080+
8081+#ifdef CONFIG_PAX_MEMORY_UDEREF
8082+ mov $PAX_USER_SHADOW_BASE,%r10
8083+ add %r10,%r8
8084+#endif
8085+
8086 1: movl (%r8),%r9d
8087 .section __ex_table,"a"
8088 .quad 1b,ia32_badarg
8089@@ -327,6 +379,7 @@ cstar_dispatch:
8090 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
8091 jnz sysretl_audit
8092 sysretl_from_sys_call:
8093+ pax_exit_kernel_user
8094 andl $~TS_COMPAT,TI_status(%r10)
8095 RESTORE_ARGS 1,-ARG_SKIP,1,1,1
8096 movl RIP-ARGOFFSET(%rsp),%ecx
8097@@ -364,6 +417,9 @@ cstar_tracesys:
8098 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
8099 movq %rsp,%rdi /* &pt_regs -> arg1 */
8100 call syscall_trace_enter
8101+
8102+ pax_erase_kstack
8103+
8104 LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
8105 RESTORE_REST
8106 xchgl %ebp,%r9d
8107@@ -409,6 +465,7 @@ ENTRY(ia32_syscall)
8108 CFI_REL_OFFSET rip,RIP-RIP
8109 PARAVIRT_ADJUST_EXCEPTION_FRAME
8110 SWAPGS
8111+ pax_enter_kernel_user
8112 /*
8113 * No need to follow this irqs on/off section: the syscall
8114 * disabled irqs and here we enable it straight after entry:
8115@@ -441,6 +498,9 @@ ia32_tracesys:
8116 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
8117 movq %rsp,%rdi /* &pt_regs -> arg1 */
8118 call syscall_trace_enter
8119+
8120+ pax_erase_kstack
8121+
8122 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
8123 RESTORE_REST
8124 cmpq $(IA32_NR_syscalls-1),%rax
8125diff -urNp linux-2.6.39.1/arch/x86/ia32/ia32_signal.c linux-2.6.39.1/arch/x86/ia32/ia32_signal.c
8126--- linux-2.6.39.1/arch/x86/ia32/ia32_signal.c 2011-05-19 00:06:34.000000000 -0400
8127+++ linux-2.6.39.1/arch/x86/ia32/ia32_signal.c 2011-05-22 19:36:30.000000000 -0400
8128@@ -403,7 +403,7 @@ static void __user *get_sigframe(struct
8129 sp -= frame_size;
8130 /* Align the stack pointer according to the i386 ABI,
8131 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
8132- sp = ((sp + 4) & -16ul) - 4;
8133+ sp = ((sp - 12) & -16ul) - 4;
8134 return (void __user *) sp;
8135 }
8136
8137@@ -461,7 +461,7 @@ int ia32_setup_frame(int sig, struct k_s
8138 * These are actually not used anymore, but left because some
8139 * gdb versions depend on them as a marker.
8140 */
8141- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
8142+ put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode);
8143 } put_user_catch(err);
8144
8145 if (err)
8146@@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct
8147 0xb8,
8148 __NR_ia32_rt_sigreturn,
8149 0x80cd,
8150- 0,
8151+ 0
8152 };
8153
8154 frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
8155@@ -533,16 +533,18 @@ int ia32_setup_rt_frame(int sig, struct
8156
8157 if (ka->sa.sa_flags & SA_RESTORER)
8158 restorer = ka->sa.sa_restorer;
8159+ else if (current->mm->context.vdso)
8160+ /* Return stub is in 32bit vsyscall page */
8161+ restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
8162 else
8163- restorer = VDSO32_SYMBOL(current->mm->context.vdso,
8164- rt_sigreturn);
8165+ restorer = &frame->retcode;
8166 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
8167
8168 /*
8169 * Not actually used anymore, but left because some gdb
8170 * versions need it.
8171 */
8172- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
8173+ put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode);
8174 } put_user_catch(err);
8175
8176 if (err)
8177diff -urNp linux-2.6.39.1/arch/x86/include/asm/alternative.h linux-2.6.39.1/arch/x86/include/asm/alternative.h
8178--- linux-2.6.39.1/arch/x86/include/asm/alternative.h 2011-05-19 00:06:34.000000000 -0400
8179+++ linux-2.6.39.1/arch/x86/include/asm/alternative.h 2011-05-22 19:36:30.000000000 -0400
8180@@ -94,7 +94,7 @@ static inline int alternatives_text_rese
8181 ".section .discard,\"aw\",@progbits\n" \
8182 " .byte 0xff + (664f-663f) - (662b-661b)\n" /* rlen <= slen */ \
8183 ".previous\n" \
8184- ".section .altinstr_replacement, \"ax\"\n" \
8185+ ".section .altinstr_replacement, \"a\"\n" \
8186 "663:\n\t" newinstr "\n664:\n" /* replacement */ \
8187 ".previous"
8188
8189diff -urNp linux-2.6.39.1/arch/x86/include/asm/apm.h linux-2.6.39.1/arch/x86/include/asm/apm.h
8190--- linux-2.6.39.1/arch/x86/include/asm/apm.h 2011-05-19 00:06:34.000000000 -0400
8191+++ linux-2.6.39.1/arch/x86/include/asm/apm.h 2011-05-22 19:36:30.000000000 -0400
8192@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
8193 __asm__ __volatile__(APM_DO_ZERO_SEGS
8194 "pushl %%edi\n\t"
8195 "pushl %%ebp\n\t"
8196- "lcall *%%cs:apm_bios_entry\n\t"
8197+ "lcall *%%ss:apm_bios_entry\n\t"
8198 "setc %%al\n\t"
8199 "popl %%ebp\n\t"
8200 "popl %%edi\n\t"
8201@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
8202 __asm__ __volatile__(APM_DO_ZERO_SEGS
8203 "pushl %%edi\n\t"
8204 "pushl %%ebp\n\t"
8205- "lcall *%%cs:apm_bios_entry\n\t"
8206+ "lcall *%%ss:apm_bios_entry\n\t"
8207 "setc %%bl\n\t"
8208 "popl %%ebp\n\t"
8209 "popl %%edi\n\t"
8210diff -urNp linux-2.6.39.1/arch/x86/include/asm/atomic64_32.h linux-2.6.39.1/arch/x86/include/asm/atomic64_32.h
8211--- linux-2.6.39.1/arch/x86/include/asm/atomic64_32.h 2011-05-19 00:06:34.000000000 -0400
8212+++ linux-2.6.39.1/arch/x86/include/asm/atomic64_32.h 2011-05-22 19:36:30.000000000 -0400
8213@@ -12,6 +12,14 @@ typedef struct {
8214 u64 __aligned(8) counter;
8215 } atomic64_t;
8216
8217+#ifdef CONFIG_PAX_REFCOUNT
8218+typedef struct {
8219+ u64 __aligned(8) counter;
8220+} atomic64_unchecked_t;
8221+#else
8222+typedef atomic64_t atomic64_unchecked_t;
8223+#endif
8224+
8225 #define ATOMIC64_INIT(val) { (val) }
8226
8227 #ifdef CONFIG_X86_CMPXCHG64
8228@@ -38,6 +46,21 @@ static inline long long atomic64_cmpxchg
8229 }
8230
8231 /**
8232+ * atomic64_cmpxchg_unchecked - cmpxchg atomic64 variable
8233+ * @p: pointer to type atomic64_unchecked_t
8234+ * @o: expected value
8235+ * @n: new value
8236+ *
8237+ * Atomically sets @v to @n if it was equal to @o and returns
8238+ * the old value.
8239+ */
8240+
8241+static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long long o, long long n)
8242+{
8243+ return cmpxchg64(&v->counter, o, n);
8244+}
8245+
8246+/**
8247 * atomic64_xchg - xchg atomic64 variable
8248 * @v: pointer to type atomic64_t
8249 * @n: value to assign
8250@@ -77,6 +100,24 @@ static inline void atomic64_set(atomic64
8251 }
8252
8253 /**
8254+ * atomic64_set_unchecked - set atomic64 variable
8255+ * @v: pointer to type atomic64_unchecked_t
8256+ * @n: value to assign
8257+ *
8258+ * Atomically sets the value of @v to @n.
8259+ */
8260+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
8261+{
8262+ unsigned high = (unsigned)(i >> 32);
8263+ unsigned low = (unsigned)i;
8264+ asm volatile(ATOMIC64_ALTERNATIVE(set)
8265+ : "+b" (low), "+c" (high)
8266+ : "S" (v)
8267+ : "eax", "edx", "memory"
8268+ );
8269+}
8270+
8271+/**
8272 * atomic64_read - read atomic64 variable
8273 * @v: pointer to type atomic64_t
8274 *
8275@@ -93,6 +134,22 @@ static inline long long atomic64_read(at
8276 }
8277
8278 /**
8279+ * atomic64_read_unchecked - read atomic64 variable
8280+ * @v: pointer to type atomic64_unchecked_t
8281+ *
8282+ * Atomically reads the value of @v and returns it.
8283+ */
8284+static inline long long atomic64_read_unchecked(atomic64_unchecked_t *v)
8285+{
8286+ long long r;
8287+ asm volatile(ATOMIC64_ALTERNATIVE(read_unchecked)
8288+ : "=A" (r), "+c" (v)
8289+ : : "memory"
8290+ );
8291+ return r;
8292+ }
8293+
8294+/**
8295 * atomic64_add_return - add and return
8296 * @i: integer value to add
8297 * @v: pointer to type atomic64_t
8298@@ -108,6 +165,22 @@ static inline long long atomic64_add_ret
8299 return i;
8300 }
8301
8302+/**
8303+ * atomic64_add_return_unchecked - add and return
8304+ * @i: integer value to add
8305+ * @v: pointer to type atomic64_unchecked_t
8306+ *
8307+ * Atomically adds @i to @v and returns @i + *@v
8308+ */
8309+static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v)
8310+{
8311+ asm volatile(ATOMIC64_ALTERNATIVE(add_return_unchecked)
8312+ : "+A" (i), "+c" (v)
8313+ : : "memory"
8314+ );
8315+ return i;
8316+}
8317+
8318 /*
8319 * Other variants with different arithmetic operators:
8320 */
8321@@ -131,6 +204,17 @@ static inline long long atomic64_inc_ret
8322 return a;
8323 }
8324
8325+static inline long long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
8326+{
8327+ long long a;
8328+ asm volatile(ATOMIC64_ALTERNATIVE(inc_return_unchecked)
8329+ : "=A" (a)
8330+ : "S" (v)
8331+ : "memory", "ecx"
8332+ );
8333+ return a;
8334+}
8335+
8336 static inline long long atomic64_dec_return(atomic64_t *v)
8337 {
8338 long long a;
8339@@ -159,6 +243,22 @@ static inline long long atomic64_add(lon
8340 }
8341
8342 /**
8343+ * atomic64_add_unchecked - add integer to atomic64 variable
8344+ * @i: integer value to add
8345+ * @v: pointer to type atomic64_unchecked_t
8346+ *
8347+ * Atomically adds @i to @v.
8348+ */
8349+static inline long long atomic64_add_unchecked(long long i, atomic64_unchecked_t *v)
8350+{
8351+ asm volatile(ATOMIC64_ALTERNATIVE_(add_unchecked, add_return_unchecked)
8352+ : "+A" (i), "+c" (v)
8353+ : : "memory"
8354+ );
8355+ return i;
8356+}
8357+
8358+/**
8359 * atomic64_sub - subtract the atomic64 variable
8360 * @i: integer value to subtract
8361 * @v: pointer to type atomic64_t
8362diff -urNp linux-2.6.39.1/arch/x86/include/asm/atomic64_64.h linux-2.6.39.1/arch/x86/include/asm/atomic64_64.h
8363--- linux-2.6.39.1/arch/x86/include/asm/atomic64_64.h 2011-05-19 00:06:34.000000000 -0400
8364+++ linux-2.6.39.1/arch/x86/include/asm/atomic64_64.h 2011-05-22 19:36:30.000000000 -0400
8365@@ -18,7 +18,19 @@
8366 */
8367 static inline long atomic64_read(const atomic64_t *v)
8368 {
8369- return (*(volatile long *)&(v)->counter);
8370+ return (*(volatile const long *)&(v)->counter);
8371+}
8372+
8373+/**
8374+ * atomic64_read_unchecked - read atomic64 variable
8375+ * @v: pointer of type atomic64_unchecked_t
8376+ *
8377+ * Atomically reads the value of @v.
8378+ * Doesn't imply a read memory barrier.
8379+ */
8380+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
8381+{
8382+ return (*(volatile const long *)&(v)->counter);
8383 }
8384
8385 /**
8386@@ -34,6 +46,18 @@ static inline void atomic64_set(atomic64
8387 }
8388
8389 /**
8390+ * atomic64_set_unchecked - set atomic64 variable
8391+ * @v: pointer to type atomic64_unchecked_t
8392+ * @i: required value
8393+ *
8394+ * Atomically sets the value of @v to @i.
8395+ */
8396+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
8397+{
8398+ v->counter = i;
8399+}
8400+
8401+/**
8402 * atomic64_add - add integer to atomic64 variable
8403 * @i: integer value to add
8404 * @v: pointer to type atomic64_t
8405@@ -42,6 +66,28 @@ static inline void atomic64_set(atomic64
8406 */
8407 static inline void atomic64_add(long i, atomic64_t *v)
8408 {
8409+ asm volatile(LOCK_PREFIX "addq %1,%0\n"
8410+
8411+#ifdef CONFIG_PAX_REFCOUNT
8412+ "jno 0f\n"
8413+ LOCK_PREFIX "subq %1,%0\n"
8414+ "int $4\n0:\n"
8415+ _ASM_EXTABLE(0b, 0b)
8416+#endif
8417+
8418+ : "=m" (v->counter)
8419+ : "er" (i), "m" (v->counter));
8420+}
8421+
8422+/**
8423+ * atomic64_add_unchecked - add integer to atomic64 variable
8424+ * @i: integer value to add
8425+ * @v: pointer to type atomic64_unchecked_t
8426+ *
8427+ * Atomically adds @i to @v.
8428+ */
8429+static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
8430+{
8431 asm volatile(LOCK_PREFIX "addq %1,%0"
8432 : "=m" (v->counter)
8433 : "er" (i), "m" (v->counter));
8434@@ -56,7 +102,29 @@ static inline void atomic64_add(long i,
8435 */
8436 static inline void atomic64_sub(long i, atomic64_t *v)
8437 {
8438- asm volatile(LOCK_PREFIX "subq %1,%0"
8439+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
8440+
8441+#ifdef CONFIG_PAX_REFCOUNT
8442+ "jno 0f\n"
8443+ LOCK_PREFIX "addq %1,%0\n"
8444+ "int $4\n0:\n"
8445+ _ASM_EXTABLE(0b, 0b)
8446+#endif
8447+
8448+ : "=m" (v->counter)
8449+ : "er" (i), "m" (v->counter));
8450+}
8451+
8452+/**
8453+ * atomic64_sub_unchecked - subtract the atomic64 variable
8454+ * @i: integer value to subtract
8455+ * @v: pointer to type atomic64_unchecked_t
8456+ *
8457+ * Atomically subtracts @i from @v.
8458+ */
8459+static inline void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v)
8460+{
8461+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
8462 : "=m" (v->counter)
8463 : "er" (i), "m" (v->counter));
8464 }
8465@@ -74,7 +142,16 @@ static inline int atomic64_sub_and_test(
8466 {
8467 unsigned char c;
8468
8469- asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
8470+ asm volatile(LOCK_PREFIX "subq %2,%0\n"
8471+
8472+#ifdef CONFIG_PAX_REFCOUNT
8473+ "jno 0f\n"
8474+ LOCK_PREFIX "addq %2,%0\n"
8475+ "int $4\n0:\n"
8476+ _ASM_EXTABLE(0b, 0b)
8477+#endif
8478+
8479+ "sete %1\n"
8480 : "=m" (v->counter), "=qm" (c)
8481 : "er" (i), "m" (v->counter) : "memory");
8482 return c;
8483@@ -88,6 +165,27 @@ static inline int atomic64_sub_and_test(
8484 */
8485 static inline void atomic64_inc(atomic64_t *v)
8486 {
8487+ asm volatile(LOCK_PREFIX "incq %0\n"
8488+
8489+#ifdef CONFIG_PAX_REFCOUNT
8490+ "jno 0f\n"
8491+ LOCK_PREFIX "decq %0\n"
8492+ "int $4\n0:\n"
8493+ _ASM_EXTABLE(0b, 0b)
8494+#endif
8495+
8496+ : "=m" (v->counter)
8497+ : "m" (v->counter));
8498+}
8499+
8500+/**
8501+ * atomic64_inc_unchecked - increment atomic64 variable
8502+ * @v: pointer to type atomic64_unchecked_t
8503+ *
8504+ * Atomically increments @v by 1.
8505+ */
8506+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
8507+{
8508 asm volatile(LOCK_PREFIX "incq %0"
8509 : "=m" (v->counter)
8510 : "m" (v->counter));
8511@@ -101,7 +199,28 @@ static inline void atomic64_inc(atomic64
8512 */
8513 static inline void atomic64_dec(atomic64_t *v)
8514 {
8515- asm volatile(LOCK_PREFIX "decq %0"
8516+ asm volatile(LOCK_PREFIX "decq %0\n"
8517+
8518+#ifdef CONFIG_PAX_REFCOUNT
8519+ "jno 0f\n"
8520+ LOCK_PREFIX "incq %0\n"
8521+ "int $4\n0:\n"
8522+ _ASM_EXTABLE(0b, 0b)
8523+#endif
8524+
8525+ : "=m" (v->counter)
8526+ : "m" (v->counter));
8527+}
8528+
8529+/**
8530+ * atomic64_dec_unchecked - decrement atomic64 variable
8531+ * @v: pointer to type atomic64_t
8532+ *
8533+ * Atomically decrements @v by 1.
8534+ */
8535+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
8536+{
8537+ asm volatile(LOCK_PREFIX "decq %0\n"
8538 : "=m" (v->counter)
8539 : "m" (v->counter));
8540 }
8541@@ -118,7 +237,16 @@ static inline int atomic64_dec_and_test(
8542 {
8543 unsigned char c;
8544
8545- asm volatile(LOCK_PREFIX "decq %0; sete %1"
8546+ asm volatile(LOCK_PREFIX "decq %0\n"
8547+
8548+#ifdef CONFIG_PAX_REFCOUNT
8549+ "jno 0f\n"
8550+ LOCK_PREFIX "incq %0\n"
8551+ "int $4\n0:\n"
8552+ _ASM_EXTABLE(0b, 0b)
8553+#endif
8554+
8555+ "sete %1\n"
8556 : "=m" (v->counter), "=qm" (c)
8557 : "m" (v->counter) : "memory");
8558 return c != 0;
8559@@ -136,7 +264,16 @@ static inline int atomic64_inc_and_test(
8560 {
8561 unsigned char c;
8562
8563- asm volatile(LOCK_PREFIX "incq %0; sete %1"
8564+ asm volatile(LOCK_PREFIX "incq %0\n"
8565+
8566+#ifdef CONFIG_PAX_REFCOUNT
8567+ "jno 0f\n"
8568+ LOCK_PREFIX "decq %0\n"
8569+ "int $4\n0:\n"
8570+ _ASM_EXTABLE(0b, 0b)
8571+#endif
8572+
8573+ "sete %1\n"
8574 : "=m" (v->counter), "=qm" (c)
8575 : "m" (v->counter) : "memory");
8576 return c != 0;
8577@@ -155,7 +292,16 @@ static inline int atomic64_add_negative(
8578 {
8579 unsigned char c;
8580
8581- asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
8582+ asm volatile(LOCK_PREFIX "addq %2,%0\n"
8583+
8584+#ifdef CONFIG_PAX_REFCOUNT
8585+ "jno 0f\n"
8586+ LOCK_PREFIX "subq %2,%0\n"
8587+ "int $4\n0:\n"
8588+ _ASM_EXTABLE(0b, 0b)
8589+#endif
8590+
8591+ "sets %1\n"
8592 : "=m" (v->counter), "=qm" (c)
8593 : "er" (i), "m" (v->counter) : "memory");
8594 return c;
8595@@ -171,7 +317,31 @@ static inline int atomic64_add_negative(
8596 static inline long atomic64_add_return(long i, atomic64_t *v)
8597 {
8598 long __i = i;
8599- asm volatile(LOCK_PREFIX "xaddq %0, %1;"
8600+ asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
8601+
8602+#ifdef CONFIG_PAX_REFCOUNT
8603+ "jno 0f\n"
8604+ "movq %0, %1\n"
8605+ "int $4\n0:\n"
8606+ _ASM_EXTABLE(0b, 0b)
8607+#endif
8608+
8609+ : "+r" (i), "+m" (v->counter)
8610+ : : "memory");
8611+ return i + __i;
8612+}
8613+
8614+/**
8615+ * atomic64_add_return_unchecked - add and return
8616+ * @i: integer value to add
8617+ * @v: pointer to type atomic64_unchecked_t
8618+ *
8619+ * Atomically adds @i to @v and returns @i + @v
8620+ */
8621+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
8622+{
8623+ long __i = i;
8624+ asm volatile(LOCK_PREFIX "xaddq %0, %1"
8625 : "+r" (i), "+m" (v->counter)
8626 : : "memory");
8627 return i + __i;
8628@@ -183,6 +353,10 @@ static inline long atomic64_sub_return(l
8629 }
8630
8631 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
8632+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
8633+{
8634+ return atomic64_add_return_unchecked(1, v);
8635+}
8636 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
8637
8638 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
8639@@ -190,6 +364,11 @@ static inline long atomic64_cmpxchg(atom
8640 return cmpxchg(&v->counter, old, new);
8641 }
8642
8643+static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
8644+{
8645+ return cmpxchg(&v->counter, old, new);
8646+}
8647+
8648 static inline long atomic64_xchg(atomic64_t *v, long new)
8649 {
8650 return xchg(&v->counter, new);
8651@@ -206,17 +385,30 @@ static inline long atomic64_xchg(atomic6
8652 */
8653 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
8654 {
8655- long c, old;
8656+ long c, old, new;
8657 c = atomic64_read(v);
8658 for (;;) {
8659- if (unlikely(c == (u)))
8660+ if (unlikely(c == u))
8661 break;
8662- old = atomic64_cmpxchg((v), c, c + (a));
8663+
8664+ asm volatile("add %2,%0\n"
8665+
8666+#ifdef CONFIG_PAX_REFCOUNT
8667+ "jno 0f\n"
8668+ "sub %2,%0\n"
8669+ "int $4\n0:\n"
8670+ _ASM_EXTABLE(0b, 0b)
8671+#endif
8672+
8673+ : "=r" (new)
8674+ : "0" (c), "ir" (a));
8675+
8676+ old = atomic64_cmpxchg(v, c, new);
8677 if (likely(old == c))
8678 break;
8679 c = old;
8680 }
8681- return c != (u);
8682+ return c != u;
8683 }
8684
8685 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
8686diff -urNp linux-2.6.39.1/arch/x86/include/asm/atomic.h linux-2.6.39.1/arch/x86/include/asm/atomic.h
8687--- linux-2.6.39.1/arch/x86/include/asm/atomic.h 2011-05-19 00:06:34.000000000 -0400
8688+++ linux-2.6.39.1/arch/x86/include/asm/atomic.h 2011-05-22 19:36:30.000000000 -0400
8689@@ -22,7 +22,18 @@
8690 */
8691 static inline int atomic_read(const atomic_t *v)
8692 {
8693- return (*(volatile int *)&(v)->counter);
8694+ return (*(volatile const int *)&(v)->counter);
8695+}
8696+
8697+/**
8698+ * atomic_read_unchecked - read atomic variable
8699+ * @v: pointer of type atomic_unchecked_t
8700+ *
8701+ * Atomically reads the value of @v.
8702+ */
8703+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
8704+{
8705+ return (*(volatile const int *)&(v)->counter);
8706 }
8707
8708 /**
8709@@ -38,6 +49,18 @@ static inline void atomic_set(atomic_t *
8710 }
8711
8712 /**
8713+ * atomic_set_unchecked - set atomic variable
8714+ * @v: pointer of type atomic_unchecked_t
8715+ * @i: required value
8716+ *
8717+ * Atomically sets the value of @v to @i.
8718+ */
8719+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
8720+{
8721+ v->counter = i;
8722+}
8723+
8724+/**
8725 * atomic_add - add integer to atomic variable
8726 * @i: integer value to add
8727 * @v: pointer of type atomic_t
8728@@ -46,7 +69,29 @@ static inline void atomic_set(atomic_t *
8729 */
8730 static inline void atomic_add(int i, atomic_t *v)
8731 {
8732- asm volatile(LOCK_PREFIX "addl %1,%0"
8733+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
8734+
8735+#ifdef CONFIG_PAX_REFCOUNT
8736+ "jno 0f\n"
8737+ LOCK_PREFIX "subl %1,%0\n"
8738+ "int $4\n0:\n"
8739+ _ASM_EXTABLE(0b, 0b)
8740+#endif
8741+
8742+ : "+m" (v->counter)
8743+ : "ir" (i));
8744+}
8745+
8746+/**
8747+ * atomic_add_unchecked - add integer to atomic variable
8748+ * @i: integer value to add
8749+ * @v: pointer of type atomic_unchecked_t
8750+ *
8751+ * Atomically adds @i to @v.
8752+ */
8753+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
8754+{
8755+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
8756 : "+m" (v->counter)
8757 : "ir" (i));
8758 }
8759@@ -60,7 +105,29 @@ static inline void atomic_add(int i, ato
8760 */
8761 static inline void atomic_sub(int i, atomic_t *v)
8762 {
8763- asm volatile(LOCK_PREFIX "subl %1,%0"
8764+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
8765+
8766+#ifdef CONFIG_PAX_REFCOUNT
8767+ "jno 0f\n"
8768+ LOCK_PREFIX "addl %1,%0\n"
8769+ "int $4\n0:\n"
8770+ _ASM_EXTABLE(0b, 0b)
8771+#endif
8772+
8773+ : "+m" (v->counter)
8774+ : "ir" (i));
8775+}
8776+
8777+/**
8778+ * atomic_sub_unchecked - subtract integer from atomic variable
8779+ * @i: integer value to subtract
8780+ * @v: pointer of type atomic_unchecked_t
8781+ *
8782+ * Atomically subtracts @i from @v.
8783+ */
8784+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
8785+{
8786+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
8787 : "+m" (v->counter)
8788 : "ir" (i));
8789 }
8790@@ -78,7 +145,16 @@ static inline int atomic_sub_and_test(in
8791 {
8792 unsigned char c;
8793
8794- asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
8795+ asm volatile(LOCK_PREFIX "subl %2,%0\n"
8796+
8797+#ifdef CONFIG_PAX_REFCOUNT
8798+ "jno 0f\n"
8799+ LOCK_PREFIX "addl %2,%0\n"
8800+ "int $4\n0:\n"
8801+ _ASM_EXTABLE(0b, 0b)
8802+#endif
8803+
8804+ "sete %1\n"
8805 : "+m" (v->counter), "=qm" (c)
8806 : "ir" (i) : "memory");
8807 return c;
8808@@ -92,7 +168,27 @@ static inline int atomic_sub_and_test(in
8809 */
8810 static inline void atomic_inc(atomic_t *v)
8811 {
8812- asm volatile(LOCK_PREFIX "incl %0"
8813+ asm volatile(LOCK_PREFIX "incl %0\n"
8814+
8815+#ifdef CONFIG_PAX_REFCOUNT
8816+ "jno 0f\n"
8817+ LOCK_PREFIX "decl %0\n"
8818+ "int $4\n0:\n"
8819+ _ASM_EXTABLE(0b, 0b)
8820+#endif
8821+
8822+ : "+m" (v->counter));
8823+}
8824+
8825+/**
8826+ * atomic_inc_unchecked - increment atomic variable
8827+ * @v: pointer of type atomic_unchecked_t
8828+ *
8829+ * Atomically increments @v by 1.
8830+ */
8831+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
8832+{
8833+ asm volatile(LOCK_PREFIX "incl %0\n"
8834 : "+m" (v->counter));
8835 }
8836
8837@@ -104,7 +200,27 @@ static inline void atomic_inc(atomic_t *
8838 */
8839 static inline void atomic_dec(atomic_t *v)
8840 {
8841- asm volatile(LOCK_PREFIX "decl %0"
8842+ asm volatile(LOCK_PREFIX "decl %0\n"
8843+
8844+#ifdef CONFIG_PAX_REFCOUNT
8845+ "jno 0f\n"
8846+ LOCK_PREFIX "incl %0\n"
8847+ "int $4\n0:\n"
8848+ _ASM_EXTABLE(0b, 0b)
8849+#endif
8850+
8851+ : "+m" (v->counter));
8852+}
8853+
8854+/**
8855+ * atomic_dec_unchecked - decrement atomic variable
8856+ * @v: pointer of type atomic_unchecked_t
8857+ *
8858+ * Atomically decrements @v by 1.
8859+ */
8860+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
8861+{
8862+ asm volatile(LOCK_PREFIX "decl %0\n"
8863 : "+m" (v->counter));
8864 }
8865
8866@@ -120,7 +236,16 @@ static inline int atomic_dec_and_test(at
8867 {
8868 unsigned char c;
8869
8870- asm volatile(LOCK_PREFIX "decl %0; sete %1"
8871+ asm volatile(LOCK_PREFIX "decl %0\n"
8872+
8873+#ifdef CONFIG_PAX_REFCOUNT
8874+ "jno 0f\n"
8875+ LOCK_PREFIX "incl %0\n"
8876+ "int $4\n0:\n"
8877+ _ASM_EXTABLE(0b, 0b)
8878+#endif
8879+
8880+ "sete %1\n"
8881 : "+m" (v->counter), "=qm" (c)
8882 : : "memory");
8883 return c != 0;
8884@@ -138,7 +263,35 @@ static inline int atomic_inc_and_test(at
8885 {
8886 unsigned char c;
8887
8888- asm volatile(LOCK_PREFIX "incl %0; sete %1"
8889+ asm volatile(LOCK_PREFIX "incl %0\n"
8890+
8891+#ifdef CONFIG_PAX_REFCOUNT
8892+ "jno 0f\n"
8893+ LOCK_PREFIX "decl %0\n"
8894+ "int $4\n0:\n"
8895+ _ASM_EXTABLE(0b, 0b)
8896+#endif
8897+
8898+ "sete %1\n"
8899+ : "+m" (v->counter), "=qm" (c)
8900+ : : "memory");
8901+ return c != 0;
8902+}
8903+
8904+/**
8905+ * atomic_inc_and_test_unchecked - increment and test
8906+ * @v: pointer of type atomic_unchecked_t
8907+ *
8908+ * Atomically increments @v by 1
8909+ * and returns true if the result is zero, or false for all
8910+ * other cases.
8911+ */
8912+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
8913+{
8914+ unsigned char c;
8915+
8916+ asm volatile(LOCK_PREFIX "incl %0\n"
8917+ "sete %1\n"
8918 : "+m" (v->counter), "=qm" (c)
8919 : : "memory");
8920 return c != 0;
8921@@ -157,7 +310,16 @@ static inline int atomic_add_negative(in
8922 {
8923 unsigned char c;
8924
8925- asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
8926+ asm volatile(LOCK_PREFIX "addl %2,%0\n"
8927+
8928+#ifdef CONFIG_PAX_REFCOUNT
8929+ "jno 0f\n"
8930+ LOCK_PREFIX "subl %2,%0\n"
8931+ "int $4\n0:\n"
8932+ _ASM_EXTABLE(0b, 0b)
8933+#endif
8934+
8935+ "sets %1\n"
8936 : "+m" (v->counter), "=qm" (c)
8937 : "ir" (i) : "memory");
8938 return c;
8939@@ -180,6 +342,46 @@ static inline int atomic_add_return(int
8940 #endif
8941 /* Modern 486+ processor */
8942 __i = i;
8943+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
8944+
8945+#ifdef CONFIG_PAX_REFCOUNT
8946+ "jno 0f\n"
8947+ "movl %0, %1\n"
8948+ "int $4\n0:\n"
8949+ _ASM_EXTABLE(0b, 0b)
8950+#endif
8951+
8952+ : "+r" (i), "+m" (v->counter)
8953+ : : "memory");
8954+ return i + __i;
8955+
8956+#ifdef CONFIG_M386
8957+no_xadd: /* Legacy 386 processor */
8958+ local_irq_save(flags);
8959+ __i = atomic_read(v);
8960+ atomic_set(v, i + __i);
8961+ local_irq_restore(flags);
8962+ return i + __i;
8963+#endif
8964+}
8965+
8966+/**
8967+ * atomic_add_return_unchecked - add integer and return
8968+ * @v: pointer of type atomic_unchecked_t
8969+ * @i: integer value to add
8970+ *
8971+ * Atomically adds @i to @v and returns @i + @v
8972+ */
8973+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
8974+{
8975+ int __i;
8976+#ifdef CONFIG_M386
8977+ unsigned long flags;
8978+ if (unlikely(boot_cpu_data.x86 <= 3))
8979+ goto no_xadd;
8980+#endif
8981+ /* Modern 486+ processor */
8982+ __i = i;
8983 asm volatile(LOCK_PREFIX "xaddl %0, %1"
8984 : "+r" (i), "+m" (v->counter)
8985 : : "memory");
8986@@ -208,6 +410,10 @@ static inline int atomic_sub_return(int
8987 }
8988
8989 #define atomic_inc_return(v) (atomic_add_return(1, v))
8990+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
8991+{
8992+ return atomic_add_return_unchecked(1, v);
8993+}
8994 #define atomic_dec_return(v) (atomic_sub_return(1, v))
8995
8996 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
8997@@ -215,11 +421,21 @@ static inline int atomic_cmpxchg(atomic_
8998 return cmpxchg(&v->counter, old, new);
8999 }
9000
9001+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
9002+{
9003+ return cmpxchg(&v->counter, old, new);
9004+}
9005+
9006 static inline int atomic_xchg(atomic_t *v, int new)
9007 {
9008 return xchg(&v->counter, new);
9009 }
9010
9011+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
9012+{
9013+ return xchg(&v->counter, new);
9014+}
9015+
9016 /**
9017 * atomic_add_unless - add unless the number is already a given value
9018 * @v: pointer of type atomic_t
9019@@ -231,21 +447,77 @@ static inline int atomic_xchg(atomic_t *
9020 */
9021 static inline int atomic_add_unless(atomic_t *v, int a, int u)
9022 {
9023- int c, old;
9024+ int c, old, new;
9025 c = atomic_read(v);
9026 for (;;) {
9027- if (unlikely(c == (u)))
9028+ if (unlikely(c == u))
9029 break;
9030- old = atomic_cmpxchg((v), c, c + (a));
9031+
9032+ asm volatile("addl %2,%0\n"
9033+
9034+#ifdef CONFIG_PAX_REFCOUNT
9035+ "jno 0f\n"
9036+ "subl %2,%0\n"
9037+ "int $4\n0:\n"
9038+ _ASM_EXTABLE(0b, 0b)
9039+#endif
9040+
9041+ : "=r" (new)
9042+ : "0" (c), "ir" (a));
9043+
9044+ old = atomic_cmpxchg(v, c, new);
9045 if (likely(old == c))
9046 break;
9047 c = old;
9048 }
9049- return c != (u);
9050+ return c != u;
9051 }
9052
9053 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
9054
9055+/**
9056+ * atomic_inc_not_zero_hint - increment if not null
9057+ * @v: pointer of type atomic_t
9058+ * @hint: probable value of the atomic before the increment
9059+ *
9060+ * This version of atomic_inc_not_zero() gives a hint of probable
9061+ * value of the atomic. This helps processor to not read the memory
9062+ * before doing the atomic read/modify/write cycle, lowering
9063+ * number of bus transactions on some arches.
9064+ *
9065+ * Returns: 0 if increment was not done, 1 otherwise.
9066+ */
9067+#define atomic_inc_not_zero_hint atomic_inc_not_zero_hint
9068+static inline int atomic_inc_not_zero_hint(atomic_t *v, int hint)
9069+{
9070+ int val, c = hint, new;
9071+
9072+ /* sanity test, should be removed by compiler if hint is a constant */
9073+ if (!hint)
9074+ return atomic_inc_not_zero(v);
9075+
9076+ do {
9077+ asm volatile("incl %0\n"
9078+
9079+#ifdef CONFIG_PAX_REFCOUNT
9080+ "jno 0f\n"
9081+ "decl %0\n"
9082+ "int $4\n0:\n"
9083+ _ASM_EXTABLE(0b, 0b)
9084+#endif
9085+
9086+ : "=r" (new)
9087+ : "0" (c));
9088+
9089+ val = atomic_cmpxchg(v, c, new);
9090+ if (val == c)
9091+ return 1;
9092+ c = val;
9093+ } while (c);
9094+
9095+ return 0;
9096+}
9097+
9098 /*
9099 * atomic_dec_if_positive - decrement by 1 if old value positive
9100 * @v: pointer of type atomic_t
9101diff -urNp linux-2.6.39.1/arch/x86/include/asm/bitops.h linux-2.6.39.1/arch/x86/include/asm/bitops.h
9102--- linux-2.6.39.1/arch/x86/include/asm/bitops.h 2011-05-19 00:06:34.000000000 -0400
9103+++ linux-2.6.39.1/arch/x86/include/asm/bitops.h 2011-05-22 19:36:30.000000000 -0400
9104@@ -38,7 +38,7 @@
9105 * a mask operation on a byte.
9106 */
9107 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
9108-#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
9109+#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
9110 #define CONST_MASK(nr) (1 << ((nr) & 7))
9111
9112 /**
9113diff -urNp linux-2.6.39.1/arch/x86/include/asm/boot.h linux-2.6.39.1/arch/x86/include/asm/boot.h
9114--- linux-2.6.39.1/arch/x86/include/asm/boot.h 2011-05-19 00:06:34.000000000 -0400
9115+++ linux-2.6.39.1/arch/x86/include/asm/boot.h 2011-05-22 19:36:30.000000000 -0400
9116@@ -11,10 +11,15 @@
9117 #include <asm/pgtable_types.h>
9118
9119 /* Physical address where kernel should be loaded. */
9120-#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
9121+#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
9122 + (CONFIG_PHYSICAL_ALIGN - 1)) \
9123 & ~(CONFIG_PHYSICAL_ALIGN - 1))
9124
9125+#ifndef __ASSEMBLY__
9126+extern unsigned char __LOAD_PHYSICAL_ADDR[];
9127+#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
9128+#endif
9129+
9130 /* Minimum kernel alignment, as a power of two */
9131 #ifdef CONFIG_X86_64
9132 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
9133diff -urNp linux-2.6.39.1/arch/x86/include/asm/cacheflush.h linux-2.6.39.1/arch/x86/include/asm/cacheflush.h
9134--- linux-2.6.39.1/arch/x86/include/asm/cacheflush.h 2011-05-19 00:06:34.000000000 -0400
9135+++ linux-2.6.39.1/arch/x86/include/asm/cacheflush.h 2011-05-22 19:36:30.000000000 -0400
9136@@ -26,7 +26,7 @@ static inline unsigned long get_page_mem
9137 unsigned long pg_flags = pg->flags & _PGMT_MASK;
9138
9139 if (pg_flags == _PGMT_DEFAULT)
9140- return -1;
9141+ return ~0UL;
9142 else if (pg_flags == _PGMT_WC)
9143 return _PAGE_CACHE_WC;
9144 else if (pg_flags == _PGMT_UC_MINUS)
9145diff -urNp linux-2.6.39.1/arch/x86/include/asm/cache.h linux-2.6.39.1/arch/x86/include/asm/cache.h
9146--- linux-2.6.39.1/arch/x86/include/asm/cache.h 2011-05-19 00:06:34.000000000 -0400
9147+++ linux-2.6.39.1/arch/x86/include/asm/cache.h 2011-05-22 19:36:30.000000000 -0400
9148@@ -5,12 +5,13 @@
9149
9150 /* L1 cache line size */
9151 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
9152-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
9153+#define L1_CACHE_BYTES (_AC(1,U) << L1_CACHE_SHIFT)
9154
9155 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
9156+#define __read_only __attribute__((__section__(".data..read_only")))
9157
9158 #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT
9159-#define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
9160+#define INTERNODE_CACHE_BYTES (_AC(1,U) << INTERNODE_CACHE_SHIFT)
9161
9162 #ifdef CONFIG_X86_VSMP
9163 #ifdef CONFIG_SMP
9164diff -urNp linux-2.6.39.1/arch/x86/include/asm/checksum_32.h linux-2.6.39.1/arch/x86/include/asm/checksum_32.h
9165--- linux-2.6.39.1/arch/x86/include/asm/checksum_32.h 2011-05-19 00:06:34.000000000 -0400
9166+++ linux-2.6.39.1/arch/x86/include/asm/checksum_32.h 2011-05-22 19:36:30.000000000 -0400
9167@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
9168 int len, __wsum sum,
9169 int *src_err_ptr, int *dst_err_ptr);
9170
9171+asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
9172+ int len, __wsum sum,
9173+ int *src_err_ptr, int *dst_err_ptr);
9174+
9175+asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
9176+ int len, __wsum sum,
9177+ int *src_err_ptr, int *dst_err_ptr);
9178+
9179 /*
9180 * Note: when you get a NULL pointer exception here this means someone
9181 * passed in an incorrect kernel address to one of these functions.
9182@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
9183 int *err_ptr)
9184 {
9185 might_sleep();
9186- return csum_partial_copy_generic((__force void *)src, dst,
9187+ return csum_partial_copy_generic_from_user((__force void *)src, dst,
9188 len, sum, err_ptr, NULL);
9189 }
9190
9191@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
9192 {
9193 might_sleep();
9194 if (access_ok(VERIFY_WRITE, dst, len))
9195- return csum_partial_copy_generic(src, (__force void *)dst,
9196+ return csum_partial_copy_generic_to_user(src, (__force void *)dst,
9197 len, sum, NULL, err_ptr);
9198
9199 if (len)
9200diff -urNp linux-2.6.39.1/arch/x86/include/asm/cpufeature.h linux-2.6.39.1/arch/x86/include/asm/cpufeature.h
9201--- linux-2.6.39.1/arch/x86/include/asm/cpufeature.h 2011-06-03 00:04:13.000000000 -0400
9202+++ linux-2.6.39.1/arch/x86/include/asm/cpufeature.h 2011-06-03 00:32:04.000000000 -0400
9203@@ -351,7 +351,7 @@ static __always_inline __pure bool __sta
9204 ".section .discard,\"aw\",@progbits\n"
9205 " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
9206 ".previous\n"
9207- ".section .altinstr_replacement,\"ax\"\n"
9208+ ".section .altinstr_replacement,\"a\"\n"
9209 "3: movb $1,%0\n"
9210 "4:\n"
9211 ".previous\n"
9212diff -urNp linux-2.6.39.1/arch/x86/include/asm/desc_defs.h linux-2.6.39.1/arch/x86/include/asm/desc_defs.h
9213--- linux-2.6.39.1/arch/x86/include/asm/desc_defs.h 2011-05-19 00:06:34.000000000 -0400
9214+++ linux-2.6.39.1/arch/x86/include/asm/desc_defs.h 2011-05-22 19:36:30.000000000 -0400
9215@@ -31,6 +31,12 @@ struct desc_struct {
9216 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
9217 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
9218 };
9219+ struct {
9220+ u16 offset_low;
9221+ u16 seg;
9222+ unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
9223+ unsigned offset_high: 16;
9224+ } gate;
9225 };
9226 } __attribute__((packed));
9227
9228diff -urNp linux-2.6.39.1/arch/x86/include/asm/desc.h linux-2.6.39.1/arch/x86/include/asm/desc.h
9229--- linux-2.6.39.1/arch/x86/include/asm/desc.h 2011-05-19 00:06:34.000000000 -0400
9230+++ linux-2.6.39.1/arch/x86/include/asm/desc.h 2011-05-22 19:36:30.000000000 -0400
9231@@ -4,6 +4,7 @@
9232 #include <asm/desc_defs.h>
9233 #include <asm/ldt.h>
9234 #include <asm/mmu.h>
9235+#include <asm/pgtable.h>
9236 #include <linux/smp.h>
9237
9238 static inline void fill_ldt(struct desc_struct *desc,
9239@@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_
9240 desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
9241 desc->type = (info->read_exec_only ^ 1) << 1;
9242 desc->type |= info->contents << 2;
9243+ desc->type |= info->seg_not_present ^ 1;
9244 desc->s = 1;
9245 desc->dpl = 0x3;
9246 desc->p = info->seg_not_present ^ 1;
9247@@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_
9248 }
9249
9250 extern struct desc_ptr idt_descr;
9251-extern gate_desc idt_table[];
9252-
9253-struct gdt_page {
9254- struct desc_struct gdt[GDT_ENTRIES];
9255-} __attribute__((aligned(PAGE_SIZE)));
9256-DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
9257+extern gate_desc idt_table[256];
9258
9259+extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
9260 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
9261 {
9262- return per_cpu(gdt_page, cpu).gdt;
9263+ return cpu_gdt_table[cpu];
9264 }
9265
9266 #ifdef CONFIG_X86_64
9267@@ -65,9 +63,14 @@ static inline void pack_gate(gate_desc *
9268 unsigned long base, unsigned dpl, unsigned flags,
9269 unsigned short seg)
9270 {
9271- gate->a = (seg << 16) | (base & 0xffff);
9272- gate->b = (base & 0xffff0000) |
9273- (((0x80 | type | (dpl << 5)) & 0xff) << 8);
9274+ gate->gate.offset_low = base;
9275+ gate->gate.seg = seg;
9276+ gate->gate.reserved = 0;
9277+ gate->gate.type = type;
9278+ gate->gate.s = 0;
9279+ gate->gate.dpl = dpl;
9280+ gate->gate.p = 1;
9281+ gate->gate.offset_high = base >> 16;
9282 }
9283
9284 #endif
9285@@ -115,13 +118,17 @@ static inline void paravirt_free_ldt(str
9286 static inline void native_write_idt_entry(gate_desc *idt, int entry,
9287 const gate_desc *gate)
9288 {
9289+ pax_open_kernel();
9290 memcpy(&idt[entry], gate, sizeof(*gate));
9291+ pax_close_kernel();
9292 }
9293
9294 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
9295 const void *desc)
9296 {
9297+ pax_open_kernel();
9298 memcpy(&ldt[entry], desc, 8);
9299+ pax_close_kernel();
9300 }
9301
9302 static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
9303@@ -139,7 +146,10 @@ static inline void native_write_gdt_entr
9304 size = sizeof(struct desc_struct);
9305 break;
9306 }
9307+
9308+ pax_open_kernel();
9309 memcpy(&gdt[entry], desc, size);
9310+ pax_close_kernel();
9311 }
9312
9313 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
9314@@ -211,7 +221,9 @@ static inline void native_set_ldt(const
9315
9316 static inline void native_load_tr_desc(void)
9317 {
9318+ pax_open_kernel();
9319 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
9320+ pax_close_kernel();
9321 }
9322
9323 static inline void native_load_gdt(const struct desc_ptr *dtr)
9324@@ -246,8 +258,10 @@ static inline void native_load_tls(struc
9325 unsigned int i;
9326 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
9327
9328+ pax_open_kernel();
9329 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
9330 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
9331+ pax_close_kernel();
9332 }
9333
9334 #define _LDT_empty(info) \
9335@@ -309,7 +323,7 @@ static inline void set_desc_limit(struct
9336 desc->limit = (limit >> 16) & 0xf;
9337 }
9338
9339-static inline void _set_gate(int gate, unsigned type, void *addr,
9340+static inline void _set_gate(int gate, unsigned type, const void *addr,
9341 unsigned dpl, unsigned ist, unsigned seg)
9342 {
9343 gate_desc s;
9344@@ -327,7 +341,7 @@ static inline void _set_gate(int gate, u
9345 * Pentium F0 0F bugfix can have resulted in the mapped
9346 * IDT being write-protected.
9347 */
9348-static inline void set_intr_gate(unsigned int n, void *addr)
9349+static inline void set_intr_gate(unsigned int n, const void *addr)
9350 {
9351 BUG_ON((unsigned)n > 0xFF);
9352 _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
9353@@ -356,19 +370,19 @@ static inline void alloc_intr_gate(unsig
9354 /*
9355 * This routine sets up an interrupt gate at directory privilege level 3.
9356 */
9357-static inline void set_system_intr_gate(unsigned int n, void *addr)
9358+static inline void set_system_intr_gate(unsigned int n, const void *addr)
9359 {
9360 BUG_ON((unsigned)n > 0xFF);
9361 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
9362 }
9363
9364-static inline void set_system_trap_gate(unsigned int n, void *addr)
9365+static inline void set_system_trap_gate(unsigned int n, const void *addr)
9366 {
9367 BUG_ON((unsigned)n > 0xFF);
9368 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
9369 }
9370
9371-static inline void set_trap_gate(unsigned int n, void *addr)
9372+static inline void set_trap_gate(unsigned int n, const void *addr)
9373 {
9374 BUG_ON((unsigned)n > 0xFF);
9375 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
9376@@ -377,19 +391,31 @@ static inline void set_trap_gate(unsigne
9377 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
9378 {
9379 BUG_ON((unsigned)n > 0xFF);
9380- _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
9381+ _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
9382 }
9383
9384-static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
9385+static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
9386 {
9387 BUG_ON((unsigned)n > 0xFF);
9388 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
9389 }
9390
9391-static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
9392+static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
9393 {
9394 BUG_ON((unsigned)n > 0xFF);
9395 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
9396 }
9397
9398+#ifdef CONFIG_X86_32
9399+static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
9400+{
9401+ struct desc_struct d;
9402+
9403+ if (likely(limit))
9404+ limit = (limit - 1UL) >> PAGE_SHIFT;
9405+ pack_descriptor(&d, base, limit, 0xFB, 0xC);
9406+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
9407+}
9408+#endif
9409+
9410 #endif /* _ASM_X86_DESC_H */
9411diff -urNp linux-2.6.39.1/arch/x86/include/asm/device.h linux-2.6.39.1/arch/x86/include/asm/device.h
9412--- linux-2.6.39.1/arch/x86/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
9413+++ linux-2.6.39.1/arch/x86/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
9414@@ -6,7 +6,7 @@ struct dev_archdata {
9415 void *acpi_handle;
9416 #endif
9417 #ifdef CONFIG_X86_64
9418-struct dma_map_ops *dma_ops;
9419+ const struct dma_map_ops *dma_ops;
9420 #endif
9421 #if defined(CONFIG_DMAR) || defined(CONFIG_AMD_IOMMU)
9422 void *iommu; /* hook for IOMMU specific extension */
9423diff -urNp linux-2.6.39.1/arch/x86/include/asm/dma-mapping.h linux-2.6.39.1/arch/x86/include/asm/dma-mapping.h
9424--- linux-2.6.39.1/arch/x86/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
9425+++ linux-2.6.39.1/arch/x86/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
9426@@ -26,9 +26,9 @@ extern int iommu_merge;
9427 extern struct device x86_dma_fallback_dev;
9428 extern int panic_on_overflow;
9429
9430-extern struct dma_map_ops *dma_ops;
9431+extern const struct dma_map_ops *dma_ops;
9432
9433-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
9434+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
9435 {
9436 #ifdef CONFIG_X86_32
9437 return dma_ops;
9438@@ -45,7 +45,7 @@ static inline struct dma_map_ops *get_dm
9439 /* Make sure we keep the same behaviour */
9440 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
9441 {
9442- struct dma_map_ops *ops = get_dma_ops(dev);
9443+ const struct dma_map_ops *ops = get_dma_ops(dev);
9444 if (ops->mapping_error)
9445 return ops->mapping_error(dev, dma_addr);
9446
9447@@ -115,7 +115,7 @@ static inline void *
9448 dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
9449 gfp_t gfp)
9450 {
9451- struct dma_map_ops *ops = get_dma_ops(dev);
9452+ const struct dma_map_ops *ops = get_dma_ops(dev);
9453 void *memory;
9454
9455 gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
9456@@ -142,7 +142,7 @@ dma_alloc_coherent(struct device *dev, s
9457 static inline void dma_free_coherent(struct device *dev, size_t size,
9458 void *vaddr, dma_addr_t bus)
9459 {
9460- struct dma_map_ops *ops = get_dma_ops(dev);
9461+ const struct dma_map_ops *ops = get_dma_ops(dev);
9462
9463 WARN_ON(irqs_disabled()); /* for portability */
9464
9465diff -urNp linux-2.6.39.1/arch/x86/include/asm/e820.h linux-2.6.39.1/arch/x86/include/asm/e820.h
9466--- linux-2.6.39.1/arch/x86/include/asm/e820.h 2011-05-19 00:06:34.000000000 -0400
9467+++ linux-2.6.39.1/arch/x86/include/asm/e820.h 2011-05-22 19:36:30.000000000 -0400
9468@@ -69,7 +69,7 @@ struct e820map {
9469 #define ISA_START_ADDRESS 0xa0000
9470 #define ISA_END_ADDRESS 0x100000
9471
9472-#define BIOS_BEGIN 0x000a0000
9473+#define BIOS_BEGIN 0x000c0000
9474 #define BIOS_END 0x00100000
9475
9476 #define BIOS_ROM_BASE 0xffe00000
9477diff -urNp linux-2.6.39.1/arch/x86/include/asm/elf.h linux-2.6.39.1/arch/x86/include/asm/elf.h
9478--- linux-2.6.39.1/arch/x86/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
9479+++ linux-2.6.39.1/arch/x86/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
9480@@ -237,7 +237,25 @@ extern int force_personality32;
9481 the loader. We need to make sure that it is out of the way of the program
9482 that it will "exec", and that there is sufficient room for the brk. */
9483
9484+#ifdef CONFIG_PAX_SEGMEXEC
9485+#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
9486+#else
9487 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
9488+#endif
9489+
9490+#ifdef CONFIG_PAX_ASLR
9491+#ifdef CONFIG_X86_32
9492+#define PAX_ELF_ET_DYN_BASE 0x10000000UL
9493+
9494+#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
9495+#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
9496+#else
9497+#define PAX_ELF_ET_DYN_BASE 0x400000UL
9498+
9499+#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
9500+#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
9501+#endif
9502+#endif
9503
9504 /* This yields a mask that user programs can use to figure out what
9505 instruction set this CPU supports. This could be done in user space,
9506@@ -291,8 +309,7 @@ do { \
9507 #define ARCH_DLINFO \
9508 do { \
9509 if (vdso_enabled) \
9510- NEW_AUX_ENT(AT_SYSINFO_EHDR, \
9511- (unsigned long)current->mm->context.vdso); \
9512+ NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso);\
9513 } while (0)
9514
9515 #define AT_SYSINFO 32
9516@@ -303,7 +320,7 @@ do { \
9517
9518 #endif /* !CONFIG_X86_32 */
9519
9520-#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
9521+#define VDSO_CURRENT_BASE (current->mm->context.vdso)
9522
9523 #define VDSO_ENTRY \
9524 ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
9525@@ -317,7 +334,4 @@ extern int arch_setup_additional_pages(s
9526 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
9527 #define compat_arch_setup_additional_pages syscall32_setup_pages
9528
9529-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
9530-#define arch_randomize_brk arch_randomize_brk
9531-
9532 #endif /* _ASM_X86_ELF_H */
9533diff -urNp linux-2.6.39.1/arch/x86/include/asm/emergency-restart.h linux-2.6.39.1/arch/x86/include/asm/emergency-restart.h
9534--- linux-2.6.39.1/arch/x86/include/asm/emergency-restart.h 2011-05-19 00:06:34.000000000 -0400
9535+++ linux-2.6.39.1/arch/x86/include/asm/emergency-restart.h 2011-05-22 19:36:30.000000000 -0400
9536@@ -15,6 +15,6 @@ enum reboot_type {
9537
9538 extern enum reboot_type reboot_type;
9539
9540-extern void machine_emergency_restart(void);
9541+extern void machine_emergency_restart(void) __noreturn;
9542
9543 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
9544diff -urNp linux-2.6.39.1/arch/x86/include/asm/futex.h linux-2.6.39.1/arch/x86/include/asm/futex.h
9545--- linux-2.6.39.1/arch/x86/include/asm/futex.h 2011-05-19 00:06:34.000000000 -0400
9546+++ linux-2.6.39.1/arch/x86/include/asm/futex.h 2011-05-22 19:36:30.000000000 -0400
9547@@ -12,16 +12,18 @@
9548 #include <asm/system.h>
9549
9550 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
9551+ typecheck(u32 *, uaddr); \
9552 asm volatile("1:\t" insn "\n" \
9553 "2:\t.section .fixup,\"ax\"\n" \
9554 "3:\tmov\t%3, %1\n" \
9555 "\tjmp\t2b\n" \
9556 "\t.previous\n" \
9557 _ASM_EXTABLE(1b, 3b) \
9558- : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
9559+ : "=r" (oldval), "=r" (ret), "+m" (*(u32 *)____m(uaddr))\
9560 : "i" (-EFAULT), "0" (oparg), "1" (0))
9561
9562 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
9563+ typecheck(u32 *, uaddr); \
9564 asm volatile("1:\tmovl %2, %0\n" \
9565 "\tmovl\t%0, %3\n" \
9566 "\t" insn "\n" \
9567@@ -34,7 +36,7 @@
9568 _ASM_EXTABLE(1b, 4b) \
9569 _ASM_EXTABLE(2b, 4b) \
9570 : "=&a" (oldval), "=&r" (ret), \
9571- "+m" (*uaddr), "=&r" (tem) \
9572+ "+m" (*(u32 *)____m(uaddr)), "=&r" (tem) \
9573 : "r" (oparg), "i" (-EFAULT), "1" (0))
9574
9575 static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
9576@@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser
9577
9578 switch (op) {
9579 case FUTEX_OP_SET:
9580- __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
9581+ __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
9582 break;
9583 case FUTEX_OP_ADD:
9584- __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
9585+ __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
9586 uaddr, oparg);
9587 break;
9588 case FUTEX_OP_OR:
9589@@ -123,13 +125,13 @@ static inline int futex_atomic_cmpxchg_i
9590 if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
9591 return -EFAULT;
9592
9593- asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n"
9594+ asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %4, %2\n"
9595 "2:\t.section .fixup, \"ax\"\n"
9596 "3:\tmov %3, %0\n"
9597 "\tjmp 2b\n"
9598 "\t.previous\n"
9599 _ASM_EXTABLE(1b, 3b)
9600- : "+r" (ret), "=a" (oldval), "+m" (*uaddr)
9601+ : "+r" (ret), "=a" (oldval), "+m" (*(u32 *)____m(uaddr))
9602 : "i" (-EFAULT), "r" (newval), "1" (oldval)
9603 : "memory"
9604 );
9605diff -urNp linux-2.6.39.1/arch/x86/include/asm/hw_irq.h linux-2.6.39.1/arch/x86/include/asm/hw_irq.h
9606--- linux-2.6.39.1/arch/x86/include/asm/hw_irq.h 2011-05-19 00:06:34.000000000 -0400
9607+++ linux-2.6.39.1/arch/x86/include/asm/hw_irq.h 2011-05-22 19:36:30.000000000 -0400
9608@@ -137,8 +137,8 @@ extern void setup_ioapic_dest(void);
9609 extern void enable_IO_APIC(void);
9610
9611 /* Statistics */
9612-extern atomic_t irq_err_count;
9613-extern atomic_t irq_mis_count;
9614+extern atomic_unchecked_t irq_err_count;
9615+extern atomic_unchecked_t irq_mis_count;
9616
9617 /* EISA */
9618 extern void eisa_set_level_irq(unsigned int irq);
9619diff -urNp linux-2.6.39.1/arch/x86/include/asm/i387.h linux-2.6.39.1/arch/x86/include/asm/i387.h
9620--- linux-2.6.39.1/arch/x86/include/asm/i387.h 2011-05-19 00:06:34.000000000 -0400
9621+++ linux-2.6.39.1/arch/x86/include/asm/i387.h 2011-05-22 19:36:30.000000000 -0400
9622@@ -92,6 +92,11 @@ static inline int fxrstor_checking(struc
9623 {
9624 int err;
9625
9626+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9627+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
9628+ fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE);
9629+#endif
9630+
9631 /* See comment in fxsave() below. */
9632 #ifdef CONFIG_AS_FXSAVEQ
9633 asm volatile("1: fxrstorq %[fx]\n\t"
9634@@ -121,6 +126,11 @@ static inline int fxsave_user(struct i38
9635 {
9636 int err;
9637
9638+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9639+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
9640+ fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
9641+#endif
9642+
9643 /*
9644 * Clear the bytes not touched by the fxsave and reserved
9645 * for the SW usage.
9646@@ -213,13 +223,8 @@ static inline void fpu_fxsave(struct fpu
9647 #endif /* CONFIG_X86_64 */
9648
9649 /* We need a safe address that is cheap to find and that is already
9650- in L1 during context switch. The best choices are unfortunately
9651- different for UP and SMP */
9652-#ifdef CONFIG_SMP
9653-#define safe_address (__per_cpu_offset[0])
9654-#else
9655-#define safe_address (kstat_cpu(0).cpustat.user)
9656-#endif
9657+ in L1 during context switch. */
9658+#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
9659
9660 /*
9661 * These must be called with preempt disabled
9662@@ -312,7 +317,7 @@ static inline void kernel_fpu_begin(void
9663 struct thread_info *me = current_thread_info();
9664 preempt_disable();
9665 if (me->status & TS_USEDFPU)
9666- __save_init_fpu(me->task);
9667+ __save_init_fpu(current);
9668 else
9669 clts();
9670 }
9671diff -urNp linux-2.6.39.1/arch/x86/include/asm/io.h linux-2.6.39.1/arch/x86/include/asm/io.h
9672--- linux-2.6.39.1/arch/x86/include/asm/io.h 2011-05-19 00:06:34.000000000 -0400
9673+++ linux-2.6.39.1/arch/x86/include/asm/io.h 2011-05-22 19:36:30.000000000 -0400
9674@@ -216,6 +216,17 @@ extern void set_iounmap_nonlazy(void);
9675
9676 #include <linux/vmalloc.h>
9677
9678+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
9679+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
9680+{
9681+ return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
9682+}
9683+
9684+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
9685+{
9686+ return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
9687+}
9688+
9689 /*
9690 * Convert a virtual cached pointer to an uncached pointer
9691 */
9692diff -urNp linux-2.6.39.1/arch/x86/include/asm/iommu.h linux-2.6.39.1/arch/x86/include/asm/iommu.h
9693--- linux-2.6.39.1/arch/x86/include/asm/iommu.h 2011-05-19 00:06:34.000000000 -0400
9694+++ linux-2.6.39.1/arch/x86/include/asm/iommu.h 2011-05-22 19:36:30.000000000 -0400
9695@@ -1,7 +1,7 @@
9696 #ifndef _ASM_X86_IOMMU_H
9697 #define _ASM_X86_IOMMU_H
9698
9699-extern struct dma_map_ops nommu_dma_ops;
9700+extern const struct dma_map_ops nommu_dma_ops;
9701 extern int force_iommu, no_iommu;
9702 extern int iommu_detected;
9703 extern int iommu_pass_through;
9704diff -urNp linux-2.6.39.1/arch/x86/include/asm/irqflags.h linux-2.6.39.1/arch/x86/include/asm/irqflags.h
9705--- linux-2.6.39.1/arch/x86/include/asm/irqflags.h 2011-05-19 00:06:34.000000000 -0400
9706+++ linux-2.6.39.1/arch/x86/include/asm/irqflags.h 2011-05-22 19:36:30.000000000 -0400
9707@@ -140,6 +140,11 @@ static inline unsigned long arch_local_i
9708 sti; \
9709 sysexit
9710
9711+#define GET_CR0_INTO_RDI mov %cr0, %rdi
9712+#define SET_RDI_INTO_CR0 mov %rdi, %cr0
9713+#define GET_CR3_INTO_RDI mov %cr3, %rdi
9714+#define SET_RDI_INTO_CR3 mov %rdi, %cr3
9715+
9716 #else
9717 #define INTERRUPT_RETURN iret
9718 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
9719diff -urNp linux-2.6.39.1/arch/x86/include/asm/kprobes.h linux-2.6.39.1/arch/x86/include/asm/kprobes.h
9720--- linux-2.6.39.1/arch/x86/include/asm/kprobes.h 2011-05-19 00:06:34.000000000 -0400
9721+++ linux-2.6.39.1/arch/x86/include/asm/kprobes.h 2011-05-22 19:36:30.000000000 -0400
9722@@ -37,13 +37,8 @@ typedef u8 kprobe_opcode_t;
9723 #define RELATIVEJUMP_SIZE 5
9724 #define RELATIVECALL_OPCODE 0xe8
9725 #define RELATIVE_ADDR_SIZE 4
9726-#define MAX_STACK_SIZE 64
9727-#define MIN_STACK_SIZE(ADDR) \
9728- (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
9729- THREAD_SIZE - (unsigned long)(ADDR))) \
9730- ? (MAX_STACK_SIZE) \
9731- : (((unsigned long)current_thread_info()) + \
9732- THREAD_SIZE - (unsigned long)(ADDR)))
9733+#define MAX_STACK_SIZE 64UL
9734+#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
9735
9736 #define flush_insn_slot(p) do { } while (0)
9737
9738diff -urNp linux-2.6.39.1/arch/x86/include/asm/kvm_host.h linux-2.6.39.1/arch/x86/include/asm/kvm_host.h
9739--- linux-2.6.39.1/arch/x86/include/asm/kvm_host.h 2011-05-19 00:06:34.000000000 -0400
9740+++ linux-2.6.39.1/arch/x86/include/asm/kvm_host.h 2011-05-22 19:36:30.000000000 -0400
9741@@ -419,7 +419,7 @@ struct kvm_arch {
9742 unsigned int n_used_mmu_pages;
9743 unsigned int n_requested_mmu_pages;
9744 unsigned int n_max_mmu_pages;
9745- atomic_t invlpg_counter;
9746+ atomic_unchecked_t invlpg_counter;
9747 struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
9748 /*
9749 * Hash table of struct kvm_mmu_page.
9750@@ -599,7 +599,7 @@ struct kvm_arch_async_pf {
9751 bool direct_map;
9752 };
9753
9754-extern struct kvm_x86_ops *kvm_x86_ops;
9755+extern const struct kvm_x86_ops *kvm_x86_ops;
9756
9757 int kvm_mmu_module_init(void);
9758 void kvm_mmu_module_exit(void);
9759diff -urNp linux-2.6.39.1/arch/x86/include/asm/local.h linux-2.6.39.1/arch/x86/include/asm/local.h
9760--- linux-2.6.39.1/arch/x86/include/asm/local.h 2011-05-19 00:06:34.000000000 -0400
9761+++ linux-2.6.39.1/arch/x86/include/asm/local.h 2011-05-22 19:36:30.000000000 -0400
9762@@ -18,26 +18,58 @@ typedef struct {
9763
9764 static inline void local_inc(local_t *l)
9765 {
9766- asm volatile(_ASM_INC "%0"
9767+ asm volatile(_ASM_INC "%0\n"
9768+
9769+#ifdef CONFIG_PAX_REFCOUNT
9770+ "jno 0f\n"
9771+ _ASM_DEC "%0\n"
9772+ "int $4\n0:\n"
9773+ _ASM_EXTABLE(0b, 0b)
9774+#endif
9775+
9776 : "+m" (l->a.counter));
9777 }
9778
9779 static inline void local_dec(local_t *l)
9780 {
9781- asm volatile(_ASM_DEC "%0"
9782+ asm volatile(_ASM_DEC "%0\n"
9783+
9784+#ifdef CONFIG_PAX_REFCOUNT
9785+ "jno 0f\n"
9786+ _ASM_INC "%0\n"
9787+ "int $4\n0:\n"
9788+ _ASM_EXTABLE(0b, 0b)
9789+#endif
9790+
9791 : "+m" (l->a.counter));
9792 }
9793
9794 static inline void local_add(long i, local_t *l)
9795 {
9796- asm volatile(_ASM_ADD "%1,%0"
9797+ asm volatile(_ASM_ADD "%1,%0\n"
9798+
9799+#ifdef CONFIG_PAX_REFCOUNT
9800+ "jno 0f\n"
9801+ _ASM_SUB "%1,%0\n"
9802+ "int $4\n0:\n"
9803+ _ASM_EXTABLE(0b, 0b)
9804+#endif
9805+
9806 : "+m" (l->a.counter)
9807 : "ir" (i));
9808 }
9809
9810 static inline void local_sub(long i, local_t *l)
9811 {
9812- asm volatile(_ASM_SUB "%1,%0"
9813+ asm volatile(_ASM_SUB "%1,%0\n"
9814+
9815+#ifdef CONFIG_PAX_REFCOUNT
9816+ "jno 0f\n"
9817+ _ASM_ADD "%1,%0\n"
9818+ "int $4\n0:\n"
9819+ _ASM_EXTABLE(0b, 0b)
9820+#endif
9821+
9822 : "+m" (l->a.counter)
9823 : "ir" (i));
9824 }
9825@@ -55,7 +87,16 @@ static inline int local_sub_and_test(lon
9826 {
9827 unsigned char c;
9828
9829- asm volatile(_ASM_SUB "%2,%0; sete %1"
9830+ asm volatile(_ASM_SUB "%2,%0\n"
9831+
9832+#ifdef CONFIG_PAX_REFCOUNT
9833+ "jno 0f\n"
9834+ _ASM_ADD "%2,%0\n"
9835+ "int $4\n0:\n"
9836+ _ASM_EXTABLE(0b, 0b)
9837+#endif
9838+
9839+ "sete %1\n"
9840 : "+m" (l->a.counter), "=qm" (c)
9841 : "ir" (i) : "memory");
9842 return c;
9843@@ -73,7 +114,16 @@ static inline int local_dec_and_test(loc
9844 {
9845 unsigned char c;
9846
9847- asm volatile(_ASM_DEC "%0; sete %1"
9848+ asm volatile(_ASM_DEC "%0\n"
9849+
9850+#ifdef CONFIG_PAX_REFCOUNT
9851+ "jno 0f\n"
9852+ _ASM_INC "%0\n"
9853+ "int $4\n0:\n"
9854+ _ASM_EXTABLE(0b, 0b)
9855+#endif
9856+
9857+ "sete %1\n"
9858 : "+m" (l->a.counter), "=qm" (c)
9859 : : "memory");
9860 return c != 0;
9861@@ -91,7 +141,16 @@ static inline int local_inc_and_test(loc
9862 {
9863 unsigned char c;
9864
9865- asm volatile(_ASM_INC "%0; sete %1"
9866+ asm volatile(_ASM_INC "%0\n"
9867+
9868+#ifdef CONFIG_PAX_REFCOUNT
9869+ "jno 0f\n"
9870+ _ASM_DEC "%0\n"
9871+ "int $4\n0:\n"
9872+ _ASM_EXTABLE(0b, 0b)
9873+#endif
9874+
9875+ "sete %1\n"
9876 : "+m" (l->a.counter), "=qm" (c)
9877 : : "memory");
9878 return c != 0;
9879@@ -110,7 +169,16 @@ static inline int local_add_negative(lon
9880 {
9881 unsigned char c;
9882
9883- asm volatile(_ASM_ADD "%2,%0; sets %1"
9884+ asm volatile(_ASM_ADD "%2,%0\n"
9885+
9886+#ifdef CONFIG_PAX_REFCOUNT
9887+ "jno 0f\n"
9888+ _ASM_SUB "%2,%0\n"
9889+ "int $4\n0:\n"
9890+ _ASM_EXTABLE(0b, 0b)
9891+#endif
9892+
9893+ "sets %1\n"
9894 : "+m" (l->a.counter), "=qm" (c)
9895 : "ir" (i) : "memory");
9896 return c;
9897@@ -133,7 +201,15 @@ static inline long local_add_return(long
9898 #endif
9899 /* Modern 486+ processor */
9900 __i = i;
9901- asm volatile(_ASM_XADD "%0, %1;"
9902+ asm volatile(_ASM_XADD "%0, %1\n"
9903+
9904+#ifdef CONFIG_PAX_REFCOUNT
9905+ "jno 0f\n"
9906+ _ASM_MOV "%0,%1\n"
9907+ "int $4\n0:\n"
9908+ _ASM_EXTABLE(0b, 0b)
9909+#endif
9910+
9911 : "+r" (i), "+m" (l->a.counter)
9912 : : "memory");
9913 return i + __i;
9914diff -urNp linux-2.6.39.1/arch/x86/include/asm/mce.h linux-2.6.39.1/arch/x86/include/asm/mce.h
9915--- linux-2.6.39.1/arch/x86/include/asm/mce.h 2011-05-19 00:06:34.000000000 -0400
9916+++ linux-2.6.39.1/arch/x86/include/asm/mce.h 2011-05-22 19:36:30.000000000 -0400
9917@@ -198,7 +198,7 @@ int mce_notify_irq(void);
9918 void mce_notify_process(void);
9919
9920 DECLARE_PER_CPU(struct mce, injectm);
9921-extern struct file_operations mce_chrdev_ops;
9922+extern struct file_operations mce_chrdev_ops; /* cannot be const, see arch/x86/kernel/cpu/mcheck/mce. */
9923
9924 /*
9925 * Exception handler
9926diff -urNp linux-2.6.39.1/arch/x86/include/asm/microcode.h linux-2.6.39.1/arch/x86/include/asm/microcode.h
9927--- linux-2.6.39.1/arch/x86/include/asm/microcode.h 2011-05-19 00:06:34.000000000 -0400
9928+++ linux-2.6.39.1/arch/x86/include/asm/microcode.h 2011-05-22 19:36:30.000000000 -0400
9929@@ -12,13 +12,13 @@ struct device;
9930 enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
9931
9932 struct microcode_ops {
9933- enum ucode_state (*request_microcode_user) (int cpu,
9934+ enum ucode_state (* const request_microcode_user) (int cpu,
9935 const void __user *buf, size_t size);
9936
9937- enum ucode_state (*request_microcode_fw) (int cpu,
9938+ enum ucode_state (* const request_microcode_fw) (int cpu,
9939 struct device *device);
9940
9941- void (*microcode_fini_cpu) (int cpu);
9942+ void (* const microcode_fini_cpu) (int cpu);
9943
9944 /*
9945 * The generic 'microcode_core' part guarantees that
9946@@ -38,16 +38,16 @@ struct ucode_cpu_info {
9947 extern struct ucode_cpu_info ucode_cpu_info[];
9948
9949 #ifdef CONFIG_MICROCODE_INTEL
9950-extern struct microcode_ops * __init init_intel_microcode(void);
9951+extern const struct microcode_ops * __init init_intel_microcode(void);
9952 #else
9953-static inline struct microcode_ops * __init init_intel_microcode(void)
9954+static inline const struct microcode_ops * __init init_intel_microcode(void)
9955 {
9956 return NULL;
9957 }
9958 #endif /* CONFIG_MICROCODE_INTEL */
9959
9960 #ifdef CONFIG_MICROCODE_AMD
9961-extern struct microcode_ops * __init init_amd_microcode(void);
9962+extern const struct microcode_ops * __init init_amd_microcode(void);
9963
9964 static inline void get_ucode_data(void *to, const u8 *from, size_t n)
9965 {
9966@@ -55,7 +55,7 @@ static inline void get_ucode_data(void *
9967 }
9968
9969 #else
9970-static inline struct microcode_ops * __init init_amd_microcode(void)
9971+static inline const struct microcode_ops * __init init_amd_microcode(void)
9972 {
9973 return NULL;
9974 }
9975diff -urNp linux-2.6.39.1/arch/x86/include/asm/mman.h linux-2.6.39.1/arch/x86/include/asm/mman.h
9976--- linux-2.6.39.1/arch/x86/include/asm/mman.h 2011-05-19 00:06:34.000000000 -0400
9977+++ linux-2.6.39.1/arch/x86/include/asm/mman.h 2011-05-22 19:36:30.000000000 -0400
9978@@ -5,4 +5,14 @@
9979
9980 #include <asm-generic/mman.h>
9981
9982+#ifdef __KERNEL__
9983+#ifndef __ASSEMBLY__
9984+#ifdef CONFIG_X86_32
9985+#define arch_mmap_check i386_mmap_check
9986+int i386_mmap_check(unsigned long addr, unsigned long len,
9987+ unsigned long flags);
9988+#endif
9989+#endif
9990+#endif
9991+
9992 #endif /* _ASM_X86_MMAN_H */
9993diff -urNp linux-2.6.39.1/arch/x86/include/asm/mmu_context.h linux-2.6.39.1/arch/x86/include/asm/mmu_context.h
9994--- linux-2.6.39.1/arch/x86/include/asm/mmu_context.h 2011-05-19 00:06:34.000000000 -0400
9995+++ linux-2.6.39.1/arch/x86/include/asm/mmu_context.h 2011-05-22 19:36:30.000000000 -0400
9996@@ -24,6 +24,21 @@ void destroy_context(struct mm_struct *m
9997
9998 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
9999 {
10000+
10001+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10002+ unsigned int i;
10003+ pgd_t *pgd;
10004+
10005+ pax_open_kernel();
10006+ pgd = get_cpu_pgd(smp_processor_id());
10007+ for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
10008+ if (paravirt_enabled())
10009+ set_pgd(pgd+i, native_make_pgd(0));
10010+ else
10011+ pgd[i] = native_make_pgd(0);
10012+ pax_close_kernel();
10013+#endif
10014+
10015 #ifdef CONFIG_SMP
10016 if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
10017 percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
10018@@ -34,16 +49,30 @@ static inline void switch_mm(struct mm_s
10019 struct task_struct *tsk)
10020 {
10021 unsigned cpu = smp_processor_id();
10022+#if defined(CONFIG_X86_32) && defined(CONFIG_SMP)
10023+ int tlbstate = TLBSTATE_OK;
10024+#endif
10025
10026 if (likely(prev != next)) {
10027 #ifdef CONFIG_SMP
10028+#ifdef CONFIG_X86_32
10029+ tlbstate = percpu_read(cpu_tlbstate.state);
10030+#endif
10031 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
10032 percpu_write(cpu_tlbstate.active_mm, next);
10033 #endif
10034 cpumask_set_cpu(cpu, mm_cpumask(next));
10035
10036 /* Re-load page tables */
10037+#ifdef CONFIG_PAX_PER_CPU_PGD
10038+ pax_open_kernel();
10039+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
10040+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
10041+ pax_close_kernel();
10042+ load_cr3(get_cpu_pgd(cpu));
10043+#else
10044 load_cr3(next->pgd);
10045+#endif
10046
10047 /* stop flush ipis for the previous mm */
10048 cpumask_clear_cpu(cpu, mm_cpumask(prev));
10049@@ -53,9 +82,38 @@ static inline void switch_mm(struct mm_s
10050 */
10051 if (unlikely(prev->context.ldt != next->context.ldt))
10052 load_LDT_nolock(&next->context);
10053- }
10054+
10055+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
10056+ if (!(__supported_pte_mask & _PAGE_NX)) {
10057+ smp_mb__before_clear_bit();
10058+ cpu_clear(cpu, prev->context.cpu_user_cs_mask);
10059+ smp_mb__after_clear_bit();
10060+ cpu_set(cpu, next->context.cpu_user_cs_mask);
10061+ }
10062+#endif
10063+
10064+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
10065+ if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
10066+ prev->context.user_cs_limit != next->context.user_cs_limit))
10067+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
10068 #ifdef CONFIG_SMP
10069+ else if (unlikely(tlbstate != TLBSTATE_OK))
10070+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
10071+#endif
10072+#endif
10073+
10074+ }
10075 else {
10076+
10077+#ifdef CONFIG_PAX_PER_CPU_PGD
10078+ pax_open_kernel();
10079+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
10080+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
10081+ pax_close_kernel();
10082+ load_cr3(get_cpu_pgd(cpu));
10083+#endif
10084+
10085+#ifdef CONFIG_SMP
10086 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
10087 BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
10088
10089@@ -64,11 +122,28 @@ static inline void switch_mm(struct mm_s
10090 * tlb flush IPI delivery. We must reload CR3
10091 * to make sure to use no freed page tables.
10092 */
10093+
10094+#ifndef CONFIG_PAX_PER_CPU_PGD
10095 load_cr3(next->pgd);
10096+#endif
10097+
10098 load_LDT_nolock(&next->context);
10099+
10100+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
10101+ if (!(__supported_pte_mask & _PAGE_NX))
10102+ cpu_set(cpu, next->context.cpu_user_cs_mask);
10103+#endif
10104+
10105+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
10106+#ifdef CONFIG_PAX_PAGEEXEC
10107+ if (!((next->pax_flags & MF_PAX_PAGEEXEC) && (__supported_pte_mask & _PAGE_NX)))
10108+#endif
10109+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
10110+#endif
10111+
10112 }
10113- }
10114 #endif
10115+ }
10116 }
10117
10118 #define activate_mm(prev, next) \
10119diff -urNp linux-2.6.39.1/arch/x86/include/asm/mmu.h linux-2.6.39.1/arch/x86/include/asm/mmu.h
10120--- linux-2.6.39.1/arch/x86/include/asm/mmu.h 2011-05-19 00:06:34.000000000 -0400
10121+++ linux-2.6.39.1/arch/x86/include/asm/mmu.h 2011-05-22 19:36:30.000000000 -0400
10122@@ -9,10 +9,22 @@
10123 * we put the segment information here.
10124 */
10125 typedef struct {
10126- void *ldt;
10127+ struct desc_struct *ldt;
10128 int size;
10129 struct mutex lock;
10130- void *vdso;
10131+ unsigned long vdso;
10132+
10133+#ifdef CONFIG_X86_32
10134+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
10135+ unsigned long user_cs_base;
10136+ unsigned long user_cs_limit;
10137+
10138+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
10139+ cpumask_t cpu_user_cs_mask;
10140+#endif
10141+
10142+#endif
10143+#endif
10144
10145 #ifdef CONFIG_X86_64
10146 /* True if mm supports a task running in 32 bit compatibility mode. */
10147diff -urNp linux-2.6.39.1/arch/x86/include/asm/module.h linux-2.6.39.1/arch/x86/include/asm/module.h
10148--- linux-2.6.39.1/arch/x86/include/asm/module.h 2011-05-19 00:06:34.000000000 -0400
10149+++ linux-2.6.39.1/arch/x86/include/asm/module.h 2011-05-22 19:41:32.000000000 -0400
10150@@ -5,6 +5,7 @@
10151
10152 #ifdef CONFIG_X86_64
10153 /* X86_64 does not define MODULE_PROC_FAMILY */
10154+#define MODULE_PROC_FAMILY ""
10155 #elif defined CONFIG_M386
10156 #define MODULE_PROC_FAMILY "386 "
10157 #elif defined CONFIG_M486
10158@@ -59,8 +60,30 @@
10159 #error unknown processor family
10160 #endif
10161
10162-#ifdef CONFIG_X86_32
10163-# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY
10164+#ifdef CONFIG_PAX_MEMORY_UDEREF
10165+#define MODULE_PAX_UDEREF "UDEREF "
10166+#else
10167+#define MODULE_PAX_UDEREF ""
10168+#endif
10169+
10170+#ifdef CONFIG_PAX_KERNEXEC
10171+#define MODULE_PAX_KERNEXEC "KERNEXEC "
10172+#else
10173+#define MODULE_PAX_KERNEXEC ""
10174 #endif
10175
10176+#ifdef CONFIG_PAX_REFCOUNT
10177+#define MODULE_PAX_REFCOUNT "REFCOUNT "
10178+#else
10179+#define MODULE_PAX_REFCOUNT ""
10180+#endif
10181+
10182+#ifdef CONFIG_GRKERNSEC
10183+#define MODULE_GRSEC "GRSECURITY "
10184+#else
10185+#define MODULE_GRSEC ""
10186+#endif
10187+
10188+#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF MODULE_PAX_REFCOUNT
10189+
10190 #endif /* _ASM_X86_MODULE_H */
10191diff -urNp linux-2.6.39.1/arch/x86/include/asm/page_64_types.h linux-2.6.39.1/arch/x86/include/asm/page_64_types.h
10192--- linux-2.6.39.1/arch/x86/include/asm/page_64_types.h 2011-05-19 00:06:34.000000000 -0400
10193+++ linux-2.6.39.1/arch/x86/include/asm/page_64_types.h 2011-05-22 19:36:30.000000000 -0400
10194@@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
10195
10196 /* duplicated to the one in bootmem.h */
10197 extern unsigned long max_pfn;
10198-extern unsigned long phys_base;
10199+extern const unsigned long phys_base;
10200
10201 extern unsigned long __phys_addr(unsigned long);
10202 #define __phys_reloc_hide(x) (x)
10203diff -urNp linux-2.6.39.1/arch/x86/include/asm/paravirt.h linux-2.6.39.1/arch/x86/include/asm/paravirt.h
10204--- linux-2.6.39.1/arch/x86/include/asm/paravirt.h 2011-05-19 00:06:34.000000000 -0400
10205+++ linux-2.6.39.1/arch/x86/include/asm/paravirt.h 2011-05-22 19:36:30.000000000 -0400
10206@@ -739,6 +739,21 @@ static inline void __set_fixmap(unsigned
10207 pv_mmu_ops.set_fixmap(idx, phys, flags);
10208 }
10209
10210+#ifdef CONFIG_PAX_KERNEXEC
10211+static inline unsigned long pax_open_kernel(void)
10212+{
10213+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
10214+}
10215+
10216+static inline unsigned long pax_close_kernel(void)
10217+{
10218+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
10219+}
10220+#else
10221+static inline unsigned long pax_open_kernel(void) { return 0; }
10222+static inline unsigned long pax_close_kernel(void) { return 0; }
10223+#endif
10224+
10225 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
10226
10227 static inline int arch_spin_is_locked(struct arch_spinlock *lock)
10228@@ -955,7 +970,7 @@ extern void default_banner(void);
10229
10230 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
10231 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
10232-#define PARA_INDIRECT(addr) *%cs:addr
10233+#define PARA_INDIRECT(addr) *%ss:addr
10234 #endif
10235
10236 #define INTERRUPT_RETURN \
10237@@ -1032,6 +1047,21 @@ extern void default_banner(void);
10238 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
10239 CLBR_NONE, \
10240 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
10241+
10242+#define GET_CR0_INTO_RDI \
10243+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
10244+ mov %rax,%rdi
10245+
10246+#define SET_RDI_INTO_CR0 \
10247+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
10248+
10249+#define GET_CR3_INTO_RDI \
10250+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
10251+ mov %rax,%rdi
10252+
10253+#define SET_RDI_INTO_CR3 \
10254+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
10255+
10256 #endif /* CONFIG_X86_32 */
10257
10258 #endif /* __ASSEMBLY__ */
10259diff -urNp linux-2.6.39.1/arch/x86/include/asm/paravirt_types.h linux-2.6.39.1/arch/x86/include/asm/paravirt_types.h
10260--- linux-2.6.39.1/arch/x86/include/asm/paravirt_types.h 2011-05-19 00:06:34.000000000 -0400
10261+++ linux-2.6.39.1/arch/x86/include/asm/paravirt_types.h 2011-05-22 19:36:30.000000000 -0400
10262@@ -317,6 +317,12 @@ struct pv_mmu_ops {
10263 an mfn. We can tell which is which from the index. */
10264 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
10265 phys_addr_t phys, pgprot_t flags);
10266+
10267+#ifdef CONFIG_PAX_KERNEXEC
10268+ unsigned long (*pax_open_kernel)(void);
10269+ unsigned long (*pax_close_kernel)(void);
10270+#endif
10271+
10272 };
10273
10274 struct arch_spinlock;
10275diff -urNp linux-2.6.39.1/arch/x86/include/asm/pci_x86.h linux-2.6.39.1/arch/x86/include/asm/pci_x86.h
10276--- linux-2.6.39.1/arch/x86/include/asm/pci_x86.h 2011-05-19 00:06:34.000000000 -0400
10277+++ linux-2.6.39.1/arch/x86/include/asm/pci_x86.h 2011-05-22 19:36:30.000000000 -0400
10278@@ -93,16 +93,16 @@ extern int (*pcibios_enable_irq)(struct
10279 extern void (*pcibios_disable_irq)(struct pci_dev *dev);
10280
10281 struct pci_raw_ops {
10282- int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
10283+ int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
10284 int reg, int len, u32 *val);
10285- int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
10286+ int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
10287 int reg, int len, u32 val);
10288 };
10289
10290-extern struct pci_raw_ops *raw_pci_ops;
10291-extern struct pci_raw_ops *raw_pci_ext_ops;
10292+extern const struct pci_raw_ops *raw_pci_ops;
10293+extern const struct pci_raw_ops *raw_pci_ext_ops;
10294
10295-extern struct pci_raw_ops pci_direct_conf1;
10296+extern const struct pci_raw_ops pci_direct_conf1;
10297 extern bool port_cf9_safe;
10298
10299 /* arch_initcall level */
10300diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgalloc.h linux-2.6.39.1/arch/x86/include/asm/pgalloc.h
10301--- linux-2.6.39.1/arch/x86/include/asm/pgalloc.h 2011-05-19 00:06:34.000000000 -0400
10302+++ linux-2.6.39.1/arch/x86/include/asm/pgalloc.h 2011-05-22 19:36:30.000000000 -0400
10303@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
10304 pmd_t *pmd, pte_t *pte)
10305 {
10306 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
10307+ set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
10308+}
10309+
10310+static inline void pmd_populate_user(struct mm_struct *mm,
10311+ pmd_t *pmd, pte_t *pte)
10312+{
10313+ paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
10314 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
10315 }
10316
10317diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgtable-2level.h linux-2.6.39.1/arch/x86/include/asm/pgtable-2level.h
10318--- linux-2.6.39.1/arch/x86/include/asm/pgtable-2level.h 2011-05-19 00:06:34.000000000 -0400
10319+++ linux-2.6.39.1/arch/x86/include/asm/pgtable-2level.h 2011-05-22 19:36:30.000000000 -0400
10320@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t
10321
10322 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
10323 {
10324+ pax_open_kernel();
10325 *pmdp = pmd;
10326+ pax_close_kernel();
10327 }
10328
10329 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
10330diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgtable_32.h linux-2.6.39.1/arch/x86/include/asm/pgtable_32.h
10331--- linux-2.6.39.1/arch/x86/include/asm/pgtable_32.h 2011-05-19 00:06:34.000000000 -0400
10332+++ linux-2.6.39.1/arch/x86/include/asm/pgtable_32.h 2011-05-22 19:36:30.000000000 -0400
10333@@ -25,9 +25,6 @@
10334 struct mm_struct;
10335 struct vm_area_struct;
10336
10337-extern pgd_t swapper_pg_dir[1024];
10338-extern pgd_t initial_page_table[1024];
10339-
10340 static inline void pgtable_cache_init(void) { }
10341 static inline void check_pgt_cache(void) { }
10342 void paging_init(void);
10343@@ -48,6 +45,12 @@ extern void set_pmd_pfn(unsigned long, u
10344 # include <asm/pgtable-2level.h>
10345 #endif
10346
10347+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
10348+extern pgd_t initial_page_table[PTRS_PER_PGD];
10349+#ifdef CONFIG_X86_PAE
10350+extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
10351+#endif
10352+
10353 #if defined(CONFIG_HIGHPTE)
10354 #define pte_offset_map(dir, address) \
10355 ((pte_t *)kmap_atomic(pmd_page(*(dir))) + \
10356@@ -62,7 +65,9 @@ extern void set_pmd_pfn(unsigned long, u
10357 /* Clear a kernel PTE and flush it from the TLB */
10358 #define kpte_clear_flush(ptep, vaddr) \
10359 do { \
10360+ pax_open_kernel(); \
10361 pte_clear(&init_mm, (vaddr), (ptep)); \
10362+ pax_close_kernel(); \
10363 __flush_tlb_one((vaddr)); \
10364 } while (0)
10365
10366@@ -74,6 +79,9 @@ do { \
10367
10368 #endif /* !__ASSEMBLY__ */
10369
10370+#define HAVE_ARCH_UNMAPPED_AREA
10371+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
10372+
10373 /*
10374 * kern_addr_valid() is (1) for FLATMEM and (0) for
10375 * SPARSEMEM and DISCONTIGMEM
10376diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgtable_32_types.h linux-2.6.39.1/arch/x86/include/asm/pgtable_32_types.h
10377--- linux-2.6.39.1/arch/x86/include/asm/pgtable_32_types.h 2011-05-19 00:06:34.000000000 -0400
10378+++ linux-2.6.39.1/arch/x86/include/asm/pgtable_32_types.h 2011-05-22 19:36:30.000000000 -0400
10379@@ -8,7 +8,7 @@
10380 */
10381 #ifdef CONFIG_X86_PAE
10382 # include <asm/pgtable-3level_types.h>
10383-# define PMD_SIZE (1UL << PMD_SHIFT)
10384+# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
10385 # define PMD_MASK (~(PMD_SIZE - 1))
10386 #else
10387 # include <asm/pgtable-2level_types.h>
10388@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set
10389 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
10390 #endif
10391
10392+#ifdef CONFIG_PAX_KERNEXEC
10393+#ifndef __ASSEMBLY__
10394+extern unsigned char MODULES_EXEC_VADDR[];
10395+extern unsigned char MODULES_EXEC_END[];
10396+#endif
10397+#include <asm/boot.h>
10398+#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
10399+#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
10400+#else
10401+#define ktla_ktva(addr) (addr)
10402+#define ktva_ktla(addr) (addr)
10403+#endif
10404+
10405 #define MODULES_VADDR VMALLOC_START
10406 #define MODULES_END VMALLOC_END
10407 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
10408diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgtable-3level.h linux-2.6.39.1/arch/x86/include/asm/pgtable-3level.h
10409--- linux-2.6.39.1/arch/x86/include/asm/pgtable-3level.h 2011-05-19 00:06:34.000000000 -0400
10410+++ linux-2.6.39.1/arch/x86/include/asm/pgtable-3level.h 2011-05-22 19:36:30.000000000 -0400
10411@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
10412
10413 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
10414 {
10415+ pax_open_kernel();
10416 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
10417+ pax_close_kernel();
10418 }
10419
10420 static inline void native_set_pud(pud_t *pudp, pud_t pud)
10421 {
10422+ pax_open_kernel();
10423 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
10424+ pax_close_kernel();
10425 }
10426
10427 /*
10428diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgtable_64.h linux-2.6.39.1/arch/x86/include/asm/pgtable_64.h
10429--- linux-2.6.39.1/arch/x86/include/asm/pgtable_64.h 2011-05-19 00:06:34.000000000 -0400
10430+++ linux-2.6.39.1/arch/x86/include/asm/pgtable_64.h 2011-05-22 19:36:30.000000000 -0400
10431@@ -16,10 +16,13 @@
10432
10433 extern pud_t level3_kernel_pgt[512];
10434 extern pud_t level3_ident_pgt[512];
10435+extern pud_t level3_vmalloc_pgt[512];
10436+extern pud_t level3_vmemmap_pgt[512];
10437+extern pud_t level2_vmemmap_pgt[512];
10438 extern pmd_t level2_kernel_pgt[512];
10439 extern pmd_t level2_fixmap_pgt[512];
10440-extern pmd_t level2_ident_pgt[512];
10441-extern pgd_t init_level4_pgt[];
10442+extern pmd_t level2_ident_pgt[512*2];
10443+extern pgd_t init_level4_pgt[512];
10444
10445 #define swapper_pg_dir init_level4_pgt
10446
10447@@ -61,7 +64,9 @@ static inline void native_set_pte_atomic
10448
10449 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
10450 {
10451+ pax_open_kernel();
10452 *pmdp = pmd;
10453+ pax_close_kernel();
10454 }
10455
10456 static inline void native_pmd_clear(pmd_t *pmd)
10457@@ -107,7 +112,9 @@ static inline void native_pud_clear(pud_
10458
10459 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
10460 {
10461+ pax_open_kernel();
10462 *pgdp = pgd;
10463+ pax_close_kernel();
10464 }
10465
10466 static inline void native_pgd_clear(pgd_t *pgd)
10467diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgtable_64_types.h linux-2.6.39.1/arch/x86/include/asm/pgtable_64_types.h
10468--- linux-2.6.39.1/arch/x86/include/asm/pgtable_64_types.h 2011-05-19 00:06:34.000000000 -0400
10469+++ linux-2.6.39.1/arch/x86/include/asm/pgtable_64_types.h 2011-05-22 19:36:30.000000000 -0400
10470@@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
10471 #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
10472 #define MODULES_END _AC(0xffffffffff000000, UL)
10473 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
10474+#define MODULES_EXEC_VADDR MODULES_VADDR
10475+#define MODULES_EXEC_END MODULES_END
10476+
10477+#define ktla_ktva(addr) (addr)
10478+#define ktva_ktla(addr) (addr)
10479
10480 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
10481diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgtable.h linux-2.6.39.1/arch/x86/include/asm/pgtable.h
10482--- linux-2.6.39.1/arch/x86/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
10483+++ linux-2.6.39.1/arch/x86/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
10484@@ -81,12 +81,51 @@ extern struct mm_struct *pgd_page_get_mm
10485
10486 #define arch_end_context_switch(prev) do {} while(0)
10487
10488+#define pax_open_kernel() native_pax_open_kernel()
10489+#define pax_close_kernel() native_pax_close_kernel()
10490 #endif /* CONFIG_PARAVIRT */
10491
10492+#define __HAVE_ARCH_PAX_OPEN_KERNEL
10493+#define __HAVE_ARCH_PAX_CLOSE_KERNEL
10494+
10495+#ifdef CONFIG_PAX_KERNEXEC
10496+static inline unsigned long native_pax_open_kernel(void)
10497+{
10498+ unsigned long cr0;
10499+
10500+ preempt_disable();
10501+ barrier();
10502+ cr0 = read_cr0() ^ X86_CR0_WP;
10503+ BUG_ON(unlikely(cr0 & X86_CR0_WP));
10504+ write_cr0(cr0);
10505+ return cr0 ^ X86_CR0_WP;
10506+}
10507+
10508+static inline unsigned long native_pax_close_kernel(void)
10509+{
10510+ unsigned long cr0;
10511+
10512+ cr0 = read_cr0() ^ X86_CR0_WP;
10513+ BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
10514+ write_cr0(cr0);
10515+ barrier();
10516+ preempt_enable_no_resched();
10517+ return cr0 ^ X86_CR0_WP;
10518+}
10519+#else
10520+static inline unsigned long native_pax_open_kernel(void) { return 0; }
10521+static inline unsigned long native_pax_close_kernel(void) { return 0; }
10522+#endif
10523+
10524 /*
10525 * The following only work if pte_present() is true.
10526 * Undefined behaviour if not..
10527 */
10528+static inline int pte_user(pte_t pte)
10529+{
10530+ return pte_val(pte) & _PAGE_USER;
10531+}
10532+
10533 static inline int pte_dirty(pte_t pte)
10534 {
10535 return pte_flags(pte) & _PAGE_DIRTY;
10536@@ -196,9 +235,29 @@ static inline pte_t pte_wrprotect(pte_t
10537 return pte_clear_flags(pte, _PAGE_RW);
10538 }
10539
10540+static inline pte_t pte_mkread(pte_t pte)
10541+{
10542+ return __pte(pte_val(pte) | _PAGE_USER);
10543+}
10544+
10545 static inline pte_t pte_mkexec(pte_t pte)
10546 {
10547- return pte_clear_flags(pte, _PAGE_NX);
10548+#ifdef CONFIG_X86_PAE
10549+ if (__supported_pte_mask & _PAGE_NX)
10550+ return pte_clear_flags(pte, _PAGE_NX);
10551+ else
10552+#endif
10553+ return pte_set_flags(pte, _PAGE_USER);
10554+}
10555+
10556+static inline pte_t pte_exprotect(pte_t pte)
10557+{
10558+#ifdef CONFIG_X86_PAE
10559+ if (__supported_pte_mask & _PAGE_NX)
10560+ return pte_set_flags(pte, _PAGE_NX);
10561+ else
10562+#endif
10563+ return pte_clear_flags(pte, _PAGE_USER);
10564 }
10565
10566 static inline pte_t pte_mkdirty(pte_t pte)
10567@@ -390,6 +449,15 @@ pte_t *populate_extra_pte(unsigned long
10568 #endif
10569
10570 #ifndef __ASSEMBLY__
10571+
10572+#ifdef CONFIG_PAX_PER_CPU_PGD
10573+extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
10574+static inline pgd_t *get_cpu_pgd(unsigned int cpu)
10575+{
10576+ return cpu_pgd[cpu];
10577+}
10578+#endif
10579+
10580 #include <linux/mm_types.h>
10581
10582 static inline int pte_none(pte_t pte)
10583@@ -560,7 +628,7 @@ static inline pud_t *pud_offset(pgd_t *p
10584
10585 static inline int pgd_bad(pgd_t pgd)
10586 {
10587- return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
10588+ return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
10589 }
10590
10591 static inline int pgd_none(pgd_t pgd)
10592@@ -583,7 +651,12 @@ static inline int pgd_none(pgd_t pgd)
10593 * pgd_offset() returns a (pgd_t *)
10594 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
10595 */
10596-#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
10597+#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
10598+
10599+#ifdef CONFIG_PAX_PER_CPU_PGD
10600+#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
10601+#endif
10602+
10603 /*
10604 * a shortcut which implies the use of the kernel's pgd, instead
10605 * of a process's
10606@@ -594,6 +667,20 @@ static inline int pgd_none(pgd_t pgd)
10607 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
10608 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
10609
10610+#ifdef CONFIG_X86_32
10611+#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
10612+#else
10613+#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
10614+#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
10615+
10616+#ifdef CONFIG_PAX_MEMORY_UDEREF
10617+#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
10618+#else
10619+#define PAX_USER_SHADOW_BASE (_AC(0,UL))
10620+#endif
10621+
10622+#endif
10623+
10624 #ifndef __ASSEMBLY__
10625
10626 extern int direct_gbpages;
10627@@ -758,11 +845,23 @@ static inline void pmdp_set_wrprotect(st
10628 * dst and src can be on the same page, but the range must not overlap,
10629 * and must not cross a page boundary.
10630 */
10631-static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
10632+static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
10633 {
10634- memcpy(dst, src, count * sizeof(pgd_t));
10635+ pax_open_kernel();
10636+ while (count--)
10637+ *dst++ = *src++;
10638+ pax_close_kernel();
10639 }
10640
10641+#ifdef CONFIG_PAX_PER_CPU_PGD
10642+extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
10643+#endif
10644+
10645+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10646+extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
10647+#else
10648+static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
10649+#endif
10650
10651 #include <asm-generic/pgtable.h>
10652 #endif /* __ASSEMBLY__ */
10653diff -urNp linux-2.6.39.1/arch/x86/include/asm/pgtable_types.h linux-2.6.39.1/arch/x86/include/asm/pgtable_types.h
10654--- linux-2.6.39.1/arch/x86/include/asm/pgtable_types.h 2011-05-19 00:06:34.000000000 -0400
10655+++ linux-2.6.39.1/arch/x86/include/asm/pgtable_types.h 2011-05-22 19:36:30.000000000 -0400
10656@@ -16,13 +16,12 @@
10657 #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
10658 #define _PAGE_BIT_PAT 7 /* on 4KB pages */
10659 #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
10660-#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
10661+#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
10662 #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
10663 #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
10664 #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
10665-#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
10666-#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
10667-#define _PAGE_BIT_SPLITTING _PAGE_BIT_UNUSED1 /* only valid on a PSE pmd */
10668+#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
10669+#define _PAGE_BIT_SPLITTING _PAGE_BIT_SPECIAL /* only valid on a PSE pmd */
10670 #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
10671
10672 /* If _PAGE_BIT_PRESENT is clear, we use these: */
10673@@ -40,7 +39,6 @@
10674 #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
10675 #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
10676 #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
10677-#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
10678 #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
10679 #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
10680 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
10681@@ -57,8 +55,10 @@
10682
10683 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
10684 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
10685-#else
10686+#elif defined(CONFIG_KMEMCHECK)
10687 #define _PAGE_NX (_AT(pteval_t, 0))
10688+#else
10689+#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
10690 #endif
10691
10692 #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
10693@@ -96,6 +96,9 @@
10694 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
10695 _PAGE_ACCESSED)
10696
10697+#define PAGE_READONLY_NOEXEC PAGE_READONLY
10698+#define PAGE_SHARED_NOEXEC PAGE_SHARED
10699+
10700 #define __PAGE_KERNEL_EXEC \
10701 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
10702 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
10703@@ -106,8 +109,8 @@
10704 #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
10705 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
10706 #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
10707-#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
10708-#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
10709+#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
10710+#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
10711 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
10712 #define __PAGE_KERNEL_LARGE_NOCACHE (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
10713 #define __PAGE_KERNEL_LARGE_EXEC (__PAGE_KERNEL_EXEC | _PAGE_PSE)
10714@@ -166,8 +169,8 @@
10715 * bits are combined, this will alow user to access the high address mapped
10716 * VDSO in the presence of CONFIG_COMPAT_VDSO
10717 */
10718-#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
10719-#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
10720+#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
10721+#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
10722 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
10723 #endif
10724
10725@@ -205,7 +208,17 @@ static inline pgdval_t pgd_flags(pgd_t p
10726 {
10727 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
10728 }
10729+#endif
10730
10731+#if PAGETABLE_LEVELS == 3
10732+#include <asm-generic/pgtable-nopud.h>
10733+#endif
10734+
10735+#if PAGETABLE_LEVELS == 2
10736+#include <asm-generic/pgtable-nopmd.h>
10737+#endif
10738+
10739+#ifndef __ASSEMBLY__
10740 #if PAGETABLE_LEVELS > 3
10741 typedef struct { pudval_t pud; } pud_t;
10742
10743@@ -219,8 +232,6 @@ static inline pudval_t native_pud_val(pu
10744 return pud.pud;
10745 }
10746 #else
10747-#include <asm-generic/pgtable-nopud.h>
10748-
10749 static inline pudval_t native_pud_val(pud_t pud)
10750 {
10751 return native_pgd_val(pud.pgd);
10752@@ -240,8 +251,6 @@ static inline pmdval_t native_pmd_val(pm
10753 return pmd.pmd;
10754 }
10755 #else
10756-#include <asm-generic/pgtable-nopmd.h>
10757-
10758 static inline pmdval_t native_pmd_val(pmd_t pmd)
10759 {
10760 return native_pgd_val(pmd.pud.pgd);
10761@@ -281,7 +290,6 @@ typedef struct page *pgtable_t;
10762
10763 extern pteval_t __supported_pte_mask;
10764 extern void set_nx(void);
10765-extern int nx_enabled;
10766
10767 #define pgprot_writecombine pgprot_writecombine
10768 extern pgprot_t pgprot_writecombine(pgprot_t prot);
10769diff -urNp linux-2.6.39.1/arch/x86/include/asm/processor.h linux-2.6.39.1/arch/x86/include/asm/processor.h
10770--- linux-2.6.39.1/arch/x86/include/asm/processor.h 2011-05-19 00:06:34.000000000 -0400
10771+++ linux-2.6.39.1/arch/x86/include/asm/processor.h 2011-05-22 19:36:30.000000000 -0400
10772@@ -266,7 +266,7 @@ struct tss_struct {
10773
10774 } ____cacheline_aligned;
10775
10776-DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
10777+extern struct tss_struct init_tss[NR_CPUS];
10778
10779 /*
10780 * Save the original ist values for checking stack pointers during debugging
10781@@ -860,11 +860,18 @@ static inline void spin_lock_prefetch(co
10782 */
10783 #define TASK_SIZE PAGE_OFFSET
10784 #define TASK_SIZE_MAX TASK_SIZE
10785+
10786+#ifdef CONFIG_PAX_SEGMEXEC
10787+#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
10788+#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
10789+#else
10790 #define STACK_TOP TASK_SIZE
10791-#define STACK_TOP_MAX STACK_TOP
10792+#endif
10793+
10794+#define STACK_TOP_MAX TASK_SIZE
10795
10796 #define INIT_THREAD { \
10797- .sp0 = sizeof(init_stack) + (long)&init_stack, \
10798+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
10799 .vm86_info = NULL, \
10800 .sysenter_cs = __KERNEL_CS, \
10801 .io_bitmap_ptr = NULL, \
10802@@ -878,7 +885,7 @@ static inline void spin_lock_prefetch(co
10803 */
10804 #define INIT_TSS { \
10805 .x86_tss = { \
10806- .sp0 = sizeof(init_stack) + (long)&init_stack, \
10807+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
10808 .ss0 = __KERNEL_DS, \
10809 .ss1 = __KERNEL_CS, \
10810 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
10811@@ -889,11 +896,7 @@ static inline void spin_lock_prefetch(co
10812 extern unsigned long thread_saved_pc(struct task_struct *tsk);
10813
10814 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
10815-#define KSTK_TOP(info) \
10816-({ \
10817- unsigned long *__ptr = (unsigned long *)(info); \
10818- (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
10819-})
10820+#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
10821
10822 /*
10823 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
10824@@ -908,7 +911,7 @@ extern unsigned long thread_saved_pc(str
10825 #define task_pt_regs(task) \
10826 ({ \
10827 struct pt_regs *__regs__; \
10828- __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
10829+ __regs__ = (struct pt_regs *)((task)->thread.sp0); \
10830 __regs__ - 1; \
10831 })
10832
10833@@ -918,13 +921,13 @@ extern unsigned long thread_saved_pc(str
10834 /*
10835 * User space process size. 47bits minus one guard page.
10836 */
10837-#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
10838+#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
10839
10840 /* This decides where the kernel will search for a free chunk of vm
10841 * space during mmap's.
10842 */
10843 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
10844- 0xc0000000 : 0xFFFFe000)
10845+ 0xc0000000 : 0xFFFFf000)
10846
10847 #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
10848 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
10849@@ -935,11 +938,11 @@ extern unsigned long thread_saved_pc(str
10850 #define STACK_TOP_MAX TASK_SIZE_MAX
10851
10852 #define INIT_THREAD { \
10853- .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
10854+ .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
10855 }
10856
10857 #define INIT_TSS { \
10858- .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
10859+ .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
10860 }
10861
10862 /*
10863@@ -961,6 +964,10 @@ extern void start_thread(struct pt_regs
10864 */
10865 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
10866
10867+#ifdef CONFIG_PAX_SEGMEXEC
10868+#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
10869+#endif
10870+
10871 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
10872
10873 /* Get/set a process' ability to use the timestamp counter instruction */
10874diff -urNp linux-2.6.39.1/arch/x86/include/asm/ptrace.h linux-2.6.39.1/arch/x86/include/asm/ptrace.h
10875--- linux-2.6.39.1/arch/x86/include/asm/ptrace.h 2011-05-19 00:06:34.000000000 -0400
10876+++ linux-2.6.39.1/arch/x86/include/asm/ptrace.h 2011-05-22 19:36:30.000000000 -0400
10877@@ -152,28 +152,29 @@ static inline unsigned long regs_return_
10878 }
10879
10880 /*
10881- * user_mode_vm(regs) determines whether a register set came from user mode.
10882+ * user_mode(regs) determines whether a register set came from user mode.
10883 * This is true if V8086 mode was enabled OR if the register set was from
10884 * protected mode with RPL-3 CS value. This tricky test checks that with
10885 * one comparison. Many places in the kernel can bypass this full check
10886- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
10887+ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
10888+ * be used.
10889 */
10890-static inline int user_mode(struct pt_regs *regs)
10891+static inline int user_mode_novm(struct pt_regs *regs)
10892 {
10893 #ifdef CONFIG_X86_32
10894 return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
10895 #else
10896- return !!(regs->cs & 3);
10897+ return !!(regs->cs & SEGMENT_RPL_MASK);
10898 #endif
10899 }
10900
10901-static inline int user_mode_vm(struct pt_regs *regs)
10902+static inline int user_mode(struct pt_regs *regs)
10903 {
10904 #ifdef CONFIG_X86_32
10905 return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
10906 USER_RPL;
10907 #else
10908- return user_mode(regs);
10909+ return user_mode_novm(regs);
10910 #endif
10911 }
10912
10913diff -urNp linux-2.6.39.1/arch/x86/include/asm/reboot.h linux-2.6.39.1/arch/x86/include/asm/reboot.h
10914--- linux-2.6.39.1/arch/x86/include/asm/reboot.h 2011-05-19 00:06:34.000000000 -0400
10915+++ linux-2.6.39.1/arch/x86/include/asm/reboot.h 2011-05-22 19:36:30.000000000 -0400
10916@@ -6,19 +6,19 @@
10917 struct pt_regs;
10918
10919 struct machine_ops {
10920- void (*restart)(char *cmd);
10921- void (*halt)(void);
10922- void (*power_off)(void);
10923+ void (* __noreturn restart)(char *cmd);
10924+ void (* __noreturn halt)(void);
10925+ void (* __noreturn power_off)(void);
10926 void (*shutdown)(void);
10927 void (*crash_shutdown)(struct pt_regs *);
10928- void (*emergency_restart)(void);
10929+ void (* __noreturn emergency_restart)(void);
10930 };
10931
10932 extern struct machine_ops machine_ops;
10933
10934 void native_machine_crash_shutdown(struct pt_regs *regs);
10935 void native_machine_shutdown(void);
10936-void machine_real_restart(unsigned int type);
10937+void machine_real_restart(unsigned int type) __noreturn;
10938 /* These must match dispatch_table in reboot_32.S */
10939 #define MRR_BIOS 0
10940 #define MRR_APM 1
10941diff -urNp linux-2.6.39.1/arch/x86/include/asm/rwsem.h linux-2.6.39.1/arch/x86/include/asm/rwsem.h
10942--- linux-2.6.39.1/arch/x86/include/asm/rwsem.h 2011-05-19 00:06:34.000000000 -0400
10943+++ linux-2.6.39.1/arch/x86/include/asm/rwsem.h 2011-05-22 19:36:30.000000000 -0400
10944@@ -64,6 +64,14 @@ static inline void __down_read(struct rw
10945 {
10946 asm volatile("# beginning down_read\n\t"
10947 LOCK_PREFIX _ASM_INC "(%1)\n\t"
10948+
10949+#ifdef CONFIG_PAX_REFCOUNT
10950+ "jno 0f\n"
10951+ LOCK_PREFIX _ASM_DEC "(%1)\n"
10952+ "int $4\n0:\n"
10953+ _ASM_EXTABLE(0b, 0b)
10954+#endif
10955+
10956 /* adds 0x00000001 */
10957 " jns 1f\n"
10958 " call call_rwsem_down_read_failed\n"
10959@@ -85,6 +93,14 @@ static inline int __down_read_trylock(st
10960 "1:\n\t"
10961 " mov %1,%2\n\t"
10962 " add %3,%2\n\t"
10963+
10964+#ifdef CONFIG_PAX_REFCOUNT
10965+ "jno 0f\n"
10966+ "sub %3,%2\n"
10967+ "int $4\n0:\n"
10968+ _ASM_EXTABLE(0b, 0b)
10969+#endif
10970+
10971 " jle 2f\n\t"
10972 LOCK_PREFIX " cmpxchg %2,%0\n\t"
10973 " jnz 1b\n\t"
10974@@ -104,6 +120,14 @@ static inline void __down_write_nested(s
10975 long tmp;
10976 asm volatile("# beginning down_write\n\t"
10977 LOCK_PREFIX " xadd %1,(%2)\n\t"
10978+
10979+#ifdef CONFIG_PAX_REFCOUNT
10980+ "jno 0f\n"
10981+ "mov %1,(%2)\n"
10982+ "int $4\n0:\n"
10983+ _ASM_EXTABLE(0b, 0b)
10984+#endif
10985+
10986 /* adds 0xffff0001, returns the old value */
10987 " test %1,%1\n\t"
10988 /* was the count 0 before? */
10989@@ -141,6 +165,14 @@ static inline void __up_read(struct rw_s
10990 long tmp;
10991 asm volatile("# beginning __up_read\n\t"
10992 LOCK_PREFIX " xadd %1,(%2)\n\t"
10993+
10994+#ifdef CONFIG_PAX_REFCOUNT
10995+ "jno 0f\n"
10996+ "mov %1,(%2)\n"
10997+ "int $4\n0:\n"
10998+ _ASM_EXTABLE(0b, 0b)
10999+#endif
11000+
11001 /* subtracts 1, returns the old value */
11002 " jns 1f\n\t"
11003 " call call_rwsem_wake\n" /* expects old value in %edx */
11004@@ -159,6 +191,14 @@ static inline void __up_write(struct rw_
11005 long tmp;
11006 asm volatile("# beginning __up_write\n\t"
11007 LOCK_PREFIX " xadd %1,(%2)\n\t"
11008+
11009+#ifdef CONFIG_PAX_REFCOUNT
11010+ "jno 0f\n"
11011+ "mov %1,(%2)\n"
11012+ "int $4\n0:\n"
11013+ _ASM_EXTABLE(0b, 0b)
11014+#endif
11015+
11016 /* subtracts 0xffff0001, returns the old value */
11017 " jns 1f\n\t"
11018 " call call_rwsem_wake\n" /* expects old value in %edx */
11019@@ -176,6 +216,14 @@ static inline void __downgrade_write(str
11020 {
11021 asm volatile("# beginning __downgrade_write\n\t"
11022 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
11023+
11024+#ifdef CONFIG_PAX_REFCOUNT
11025+ "jno 0f\n"
11026+ LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
11027+ "int $4\n0:\n"
11028+ _ASM_EXTABLE(0b, 0b)
11029+#endif
11030+
11031 /*
11032 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
11033 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
11034@@ -194,7 +242,15 @@ static inline void __downgrade_write(str
11035 */
11036 static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
11037 {
11038- asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
11039+ asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
11040+
11041+#ifdef CONFIG_PAX_REFCOUNT
11042+ "jno 0f\n"
11043+ LOCK_PREFIX _ASM_SUB "%1,%0\n"
11044+ "int $4\n0:\n"
11045+ _ASM_EXTABLE(0b, 0b)
11046+#endif
11047+
11048 : "+m" (sem->count)
11049 : "er" (delta));
11050 }
11051@@ -206,7 +262,15 @@ static inline long rwsem_atomic_update(l
11052 {
11053 long tmp = delta;
11054
11055- asm volatile(LOCK_PREFIX "xadd %0,%1"
11056+ asm volatile(LOCK_PREFIX "xadd %0,%1\n"
11057+
11058+#ifdef CONFIG_PAX_REFCOUNT
11059+ "jno 0f\n"
11060+ "mov %0,%1\n"
11061+ "int $4\n0:\n"
11062+ _ASM_EXTABLE(0b, 0b)
11063+#endif
11064+
11065 : "+r" (tmp), "+m" (sem->count)
11066 : : "memory");
11067
11068diff -urNp linux-2.6.39.1/arch/x86/include/asm/segment.h linux-2.6.39.1/arch/x86/include/asm/segment.h
11069--- linux-2.6.39.1/arch/x86/include/asm/segment.h 2011-05-19 00:06:34.000000000 -0400
11070+++ linux-2.6.39.1/arch/x86/include/asm/segment.h 2011-05-22 19:36:30.000000000 -0400
11071@@ -64,8 +64,8 @@
11072 * 26 - ESPFIX small SS
11073 * 27 - per-cpu [ offset to per-cpu data area ]
11074 * 28 - stack_canary-20 [ for stack protector ]
11075- * 29 - unused
11076- * 30 - unused
11077+ * 29 - PCI BIOS CS
11078+ * 30 - PCI BIOS DS
11079 * 31 - TSS for double fault handler
11080 */
11081 #define GDT_ENTRY_TLS_MIN 6
11082@@ -79,6 +79,8 @@
11083
11084 #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE+0)
11085
11086+#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
11087+
11088 #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE+1)
11089
11090 #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE+4)
11091@@ -104,6 +106,12 @@
11092 #define __KERNEL_STACK_CANARY 0
11093 #endif
11094
11095+#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE+17)
11096+#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
11097+
11098+#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE+18)
11099+#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
11100+
11101 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
11102
11103 /*
11104@@ -141,7 +149,7 @@
11105 */
11106
11107 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
11108-#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
11109+#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
11110
11111
11112 #else
11113@@ -165,6 +173,8 @@
11114 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
11115 #define __USER32_DS __USER_DS
11116
11117+#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
11118+
11119 #define GDT_ENTRY_TSS 8 /* needs two entries */
11120 #define GDT_ENTRY_LDT 10 /* needs two entries */
11121 #define GDT_ENTRY_TLS_MIN 12
11122@@ -185,6 +195,7 @@
11123 #endif
11124
11125 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS*8)
11126+#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS*8)
11127 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8)
11128 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8+3)
11129 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS*8+3)
11130diff -urNp linux-2.6.39.1/arch/x86/include/asm/smp.h linux-2.6.39.1/arch/x86/include/asm/smp.h
11131--- linux-2.6.39.1/arch/x86/include/asm/smp.h 2011-05-19 00:06:34.000000000 -0400
11132+++ linux-2.6.39.1/arch/x86/include/asm/smp.h 2011-05-22 19:36:30.000000000 -0400
11133@@ -36,7 +36,7 @@ DECLARE_PER_CPU(cpumask_var_t, cpu_core_
11134 /* cpus sharing the last level cache: */
11135 DECLARE_PER_CPU(cpumask_var_t, cpu_llc_shared_map);
11136 DECLARE_PER_CPU(u16, cpu_llc_id);
11137-DECLARE_PER_CPU(int, cpu_number);
11138+DECLARE_PER_CPU(unsigned int, cpu_number);
11139
11140 static inline struct cpumask *cpu_sibling_mask(int cpu)
11141 {
11142@@ -192,14 +192,8 @@ extern unsigned disabled_cpus __cpuinitd
11143 extern int safe_smp_processor_id(void);
11144
11145 #elif defined(CONFIG_X86_64_SMP)
11146-#define raw_smp_processor_id() (percpu_read(cpu_number))
11147-
11148-#define stack_smp_processor_id() \
11149-({ \
11150- struct thread_info *ti; \
11151- __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
11152- ti->cpu; \
11153-})
11154+#define raw_smp_processor_id() (percpu_read(cpu_number))
11155+#define stack_smp_processor_id() raw_smp_processor_id()
11156 #define safe_smp_processor_id() smp_processor_id()
11157
11158 #endif
11159diff -urNp linux-2.6.39.1/arch/x86/include/asm/spinlock.h linux-2.6.39.1/arch/x86/include/asm/spinlock.h
11160--- linux-2.6.39.1/arch/x86/include/asm/spinlock.h 2011-05-19 00:06:34.000000000 -0400
11161+++ linux-2.6.39.1/arch/x86/include/asm/spinlock.h 2011-05-22 19:36:30.000000000 -0400
11162@@ -249,6 +249,14 @@ static inline int arch_write_can_lock(ar
11163 static inline void arch_read_lock(arch_rwlock_t *rw)
11164 {
11165 asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
11166+
11167+#ifdef CONFIG_PAX_REFCOUNT
11168+ "jno 0f\n"
11169+ LOCK_PREFIX " addl $1,(%0)\n"
11170+ "int $4\n0:\n"
11171+ _ASM_EXTABLE(0b, 0b)
11172+#endif
11173+
11174 "jns 1f\n"
11175 "call __read_lock_failed\n\t"
11176 "1:\n"
11177@@ -258,6 +266,14 @@ static inline void arch_read_lock(arch_r
11178 static inline void arch_write_lock(arch_rwlock_t *rw)
11179 {
11180 asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
11181+
11182+#ifdef CONFIG_PAX_REFCOUNT
11183+ "jno 0f\n"
11184+ LOCK_PREFIX " addl %1,(%0)\n"
11185+ "int $4\n0:\n"
11186+ _ASM_EXTABLE(0b, 0b)
11187+#endif
11188+
11189 "jz 1f\n"
11190 "call __write_lock_failed\n\t"
11191 "1:\n"
11192@@ -286,12 +302,29 @@ static inline int arch_write_trylock(arc
11193
11194 static inline void arch_read_unlock(arch_rwlock_t *rw)
11195 {
11196- asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
11197+ asm volatile(LOCK_PREFIX "incl %0\n"
11198+
11199+#ifdef CONFIG_PAX_REFCOUNT
11200+ "jno 0f\n"
11201+ LOCK_PREFIX "decl %0\n"
11202+ "int $4\n0:\n"
11203+ _ASM_EXTABLE(0b, 0b)
11204+#endif
11205+
11206+ :"+m" (rw->lock) : : "memory");
11207 }
11208
11209 static inline void arch_write_unlock(arch_rwlock_t *rw)
11210 {
11211- asm volatile(LOCK_PREFIX "addl %1, %0"
11212+ asm volatile(LOCK_PREFIX "addl %1, %0\n"
11213+
11214+#ifdef CONFIG_PAX_REFCOUNT
11215+ "jno 0f\n"
11216+ LOCK_PREFIX "subl %1, %0\n"
11217+ "int $4\n0:\n"
11218+ _ASM_EXTABLE(0b, 0b)
11219+#endif
11220+
11221 : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
11222 }
11223
11224diff -urNp linux-2.6.39.1/arch/x86/include/asm/stackprotector.h linux-2.6.39.1/arch/x86/include/asm/stackprotector.h
11225--- linux-2.6.39.1/arch/x86/include/asm/stackprotector.h 2011-05-19 00:06:34.000000000 -0400
11226+++ linux-2.6.39.1/arch/x86/include/asm/stackprotector.h 2011-05-22 19:36:30.000000000 -0400
11227@@ -113,7 +113,7 @@ static inline void setup_stack_canary_se
11228
11229 static inline void load_stack_canary_segment(void)
11230 {
11231-#ifdef CONFIG_X86_32
11232+#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
11233 asm volatile ("mov %0, %%gs" : : "r" (0));
11234 #endif
11235 }
11236diff -urNp linux-2.6.39.1/arch/x86/include/asm/stacktrace.h linux-2.6.39.1/arch/x86/include/asm/stacktrace.h
11237--- linux-2.6.39.1/arch/x86/include/asm/stacktrace.h 2011-05-19 00:06:34.000000000 -0400
11238+++ linux-2.6.39.1/arch/x86/include/asm/stacktrace.h 2011-05-22 19:36:30.000000000 -0400
11239@@ -11,28 +11,20 @@
11240
11241 extern int kstack_depth_to_print;
11242
11243-struct thread_info;
11244+struct task_struct;
11245 struct stacktrace_ops;
11246
11247-typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
11248- unsigned long *stack,
11249- unsigned long bp,
11250- const struct stacktrace_ops *ops,
11251- void *data,
11252- unsigned long *end,
11253- int *graph);
11254-
11255-extern unsigned long
11256-print_context_stack(struct thread_info *tinfo,
11257- unsigned long *stack, unsigned long bp,
11258- const struct stacktrace_ops *ops, void *data,
11259- unsigned long *end, int *graph);
11260-
11261-extern unsigned long
11262-print_context_stack_bp(struct thread_info *tinfo,
11263- unsigned long *stack, unsigned long bp,
11264- const struct stacktrace_ops *ops, void *data,
11265- unsigned long *end, int *graph);
11266+typedef unsigned long walk_stack_t(struct task_struct *task,
11267+ void *stack_start,
11268+ unsigned long *stack,
11269+ unsigned long bp,
11270+ const struct stacktrace_ops *ops,
11271+ void *data,
11272+ unsigned long *end,
11273+ int *graph);
11274+
11275+extern walk_stack_t print_context_stack;
11276+extern walk_stack_t print_context_stack_bp;
11277
11278 /* Generic stack tracer with callbacks */
11279
11280@@ -43,7 +35,7 @@ struct stacktrace_ops {
11281 void (*address)(void *data, unsigned long address, int reliable);
11282 /* On negative return stop dumping */
11283 int (*stack)(void *data, char *name);
11284- walk_stack_t walk_stack;
11285+ walk_stack_t *walk_stack;
11286 };
11287
11288 void dump_trace(struct task_struct *tsk, struct pt_regs *regs,
11289diff -urNp linux-2.6.39.1/arch/x86/include/asm/system.h linux-2.6.39.1/arch/x86/include/asm/system.h
11290--- linux-2.6.39.1/arch/x86/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
11291+++ linux-2.6.39.1/arch/x86/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
11292@@ -129,7 +129,7 @@ do { \
11293 "call __switch_to\n\t" \
11294 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
11295 __switch_canary \
11296- "movq %P[thread_info](%%rsi),%%r8\n\t" \
11297+ "movq "__percpu_arg([thread_info])",%%r8\n\t" \
11298 "movq %%rax,%%rdi\n\t" \
11299 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
11300 "jnz ret_from_fork\n\t" \
11301@@ -140,7 +140,7 @@ do { \
11302 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
11303 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
11304 [_tif_fork] "i" (_TIF_FORK), \
11305- [thread_info] "i" (offsetof(struct task_struct, stack)), \
11306+ [thread_info] "m" (current_tinfo), \
11307 [current_task] "m" (current_task) \
11308 __switch_canary_iparam \
11309 : "memory", "cc" __EXTRA_CLOBBER)
11310@@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
11311 {
11312 unsigned long __limit;
11313 asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
11314- return __limit + 1;
11315+ return __limit;
11316 }
11317
11318 static inline void native_clts(void)
11319@@ -340,12 +340,12 @@ void enable_hlt(void);
11320
11321 void cpu_idle_wait(void);
11322
11323-extern unsigned long arch_align_stack(unsigned long sp);
11324+#define arch_align_stack(x) ((x) & ~0xfUL)
11325 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
11326
11327 void default_idle(void);
11328
11329-void stop_this_cpu(void *dummy);
11330+void stop_this_cpu(void *dummy) __noreturn;
11331
11332 /*
11333 * Force strict CPU ordering.
11334diff -urNp linux-2.6.39.1/arch/x86/include/asm/thread_info.h linux-2.6.39.1/arch/x86/include/asm/thread_info.h
11335--- linux-2.6.39.1/arch/x86/include/asm/thread_info.h 2011-05-19 00:06:34.000000000 -0400
11336+++ linux-2.6.39.1/arch/x86/include/asm/thread_info.h 2011-05-22 19:36:30.000000000 -0400
11337@@ -10,6 +10,7 @@
11338 #include <linux/compiler.h>
11339 #include <asm/page.h>
11340 #include <asm/types.h>
11341+#include <asm/percpu.h>
11342
11343 /*
11344 * low level task data that entry.S needs immediate access to
11345@@ -24,7 +25,6 @@ struct exec_domain;
11346 #include <asm/atomic.h>
11347
11348 struct thread_info {
11349- struct task_struct *task; /* main task structure */
11350 struct exec_domain *exec_domain; /* execution domain */
11351 __u32 flags; /* low level flags */
11352 __u32 status; /* thread synchronous flags */
11353@@ -34,18 +34,12 @@ struct thread_info {
11354 mm_segment_t addr_limit;
11355 struct restart_block restart_block;
11356 void __user *sysenter_return;
11357-#ifdef CONFIG_X86_32
11358- unsigned long previous_esp; /* ESP of the previous stack in
11359- case of nested (IRQ) stacks
11360- */
11361- __u8 supervisor_stack[0];
11362-#endif
11363+ unsigned long lowest_stack;
11364 int uaccess_err;
11365 };
11366
11367-#define INIT_THREAD_INFO(tsk) \
11368+#define INIT_THREAD_INFO \
11369 { \
11370- .task = &tsk, \
11371 .exec_domain = &default_exec_domain, \
11372 .flags = 0, \
11373 .cpu = 0, \
11374@@ -56,7 +50,7 @@ struct thread_info {
11375 }, \
11376 }
11377
11378-#define init_thread_info (init_thread_union.thread_info)
11379+#define init_thread_info (init_thread_union.stack)
11380 #define init_stack (init_thread_union.stack)
11381
11382 #else /* !__ASSEMBLY__ */
11383@@ -170,6 +164,23 @@ struct thread_info {
11384 ret; \
11385 })
11386
11387+#ifdef __ASSEMBLY__
11388+/* how to get the thread information struct from ASM */
11389+#define GET_THREAD_INFO(reg) \
11390+ mov PER_CPU_VAR(current_tinfo), reg
11391+
11392+/* use this one if reg already contains %esp */
11393+#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
11394+#else
11395+/* how to get the thread information struct from C */
11396+DECLARE_PER_CPU(struct thread_info *, current_tinfo);
11397+
11398+static __always_inline struct thread_info *current_thread_info(void)
11399+{
11400+ return percpu_read_stable(current_tinfo);
11401+}
11402+#endif
11403+
11404 #ifdef CONFIG_X86_32
11405
11406 #define STACK_WARN (THREAD_SIZE/8)
11407@@ -180,35 +191,13 @@ struct thread_info {
11408 */
11409 #ifndef __ASSEMBLY__
11410
11411-
11412 /* how to get the current stack pointer from C */
11413 register unsigned long current_stack_pointer asm("esp") __used;
11414
11415-/* how to get the thread information struct from C */
11416-static inline struct thread_info *current_thread_info(void)
11417-{
11418- return (struct thread_info *)
11419- (current_stack_pointer & ~(THREAD_SIZE - 1));
11420-}
11421-
11422-#else /* !__ASSEMBLY__ */
11423-
11424-/* how to get the thread information struct from ASM */
11425-#define GET_THREAD_INFO(reg) \
11426- movl $-THREAD_SIZE, reg; \
11427- andl %esp, reg
11428-
11429-/* use this one if reg already contains %esp */
11430-#define GET_THREAD_INFO_WITH_ESP(reg) \
11431- andl $-THREAD_SIZE, reg
11432-
11433 #endif
11434
11435 #else /* X86_32 */
11436
11437-#include <asm/percpu.h>
11438-#define KERNEL_STACK_OFFSET (5*8)
11439-
11440 /*
11441 * macros/functions for gaining access to the thread information structure
11442 * preempt_count needs to be 1 initially, until the scheduler is functional.
11443@@ -216,21 +205,8 @@ static inline struct thread_info *curren
11444 #ifndef __ASSEMBLY__
11445 DECLARE_PER_CPU(unsigned long, kernel_stack);
11446
11447-static inline struct thread_info *current_thread_info(void)
11448-{
11449- struct thread_info *ti;
11450- ti = (void *)(percpu_read_stable(kernel_stack) +
11451- KERNEL_STACK_OFFSET - THREAD_SIZE);
11452- return ti;
11453-}
11454-
11455-#else /* !__ASSEMBLY__ */
11456-
11457-/* how to get the thread information struct from ASM */
11458-#define GET_THREAD_INFO(reg) \
11459- movq PER_CPU_VAR(kernel_stack),reg ; \
11460- subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
11461-
11462+/* how to get the current stack pointer from C */
11463+register unsigned long current_stack_pointer asm("rsp") __used;
11464 #endif
11465
11466 #endif /* !X86_32 */
11467@@ -266,5 +242,16 @@ extern void arch_task_cache_init(void);
11468 extern void free_thread_info(struct thread_info *ti);
11469 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
11470 #define arch_task_cache_init arch_task_cache_init
11471+
11472+#define __HAVE_THREAD_FUNCTIONS
11473+#define task_thread_info(task) (&(task)->tinfo)
11474+#define task_stack_page(task) ((task)->stack)
11475+#define setup_thread_stack(p, org) do {} while (0)
11476+#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
11477+
11478+#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
11479+extern struct task_struct *alloc_task_struct_node(int node);
11480+extern void free_task_struct(struct task_struct *);
11481+
11482 #endif
11483 #endif /* _ASM_X86_THREAD_INFO_H */
11484diff -urNp linux-2.6.39.1/arch/x86/include/asm/uaccess_32.h linux-2.6.39.1/arch/x86/include/asm/uaccess_32.h
11485--- linux-2.6.39.1/arch/x86/include/asm/uaccess_32.h 2011-05-19 00:06:34.000000000 -0400
11486+++ linux-2.6.39.1/arch/x86/include/asm/uaccess_32.h 2011-05-22 19:36:30.000000000 -0400
11487@@ -44,6 +44,11 @@ unsigned long __must_check __copy_from_u
11488 static __always_inline unsigned long __must_check
11489 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
11490 {
11491+ pax_track_stack();
11492+
11493+ if ((long)n < 0)
11494+ return n;
11495+
11496 if (__builtin_constant_p(n)) {
11497 unsigned long ret;
11498
11499@@ -62,6 +67,8 @@ __copy_to_user_inatomic(void __user *to,
11500 return ret;
11501 }
11502 }
11503+ if (!__builtin_constant_p(n))
11504+ check_object_size(from, n, true);
11505 return __copy_to_user_ll(to, from, n);
11506 }
11507
11508@@ -83,12 +90,16 @@ static __always_inline unsigned long __m
11509 __copy_to_user(void __user *to, const void *from, unsigned long n)
11510 {
11511 might_fault();
11512+
11513 return __copy_to_user_inatomic(to, from, n);
11514 }
11515
11516 static __always_inline unsigned long
11517 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
11518 {
11519+ if ((long)n < 0)
11520+ return n;
11521+
11522 /* Avoid zeroing the tail if the copy fails..
11523 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
11524 * but as the zeroing behaviour is only significant when n is not
11525@@ -138,6 +149,12 @@ static __always_inline unsigned long
11526 __copy_from_user(void *to, const void __user *from, unsigned long n)
11527 {
11528 might_fault();
11529+
11530+ pax_track_stack();
11531+
11532+ if ((long)n < 0)
11533+ return n;
11534+
11535 if (__builtin_constant_p(n)) {
11536 unsigned long ret;
11537
11538@@ -153,6 +170,8 @@ __copy_from_user(void *to, const void __
11539 return ret;
11540 }
11541 }
11542+ if (!__builtin_constant_p(n))
11543+ check_object_size(to, n, false);
11544 return __copy_from_user_ll(to, from, n);
11545 }
11546
11547@@ -160,6 +179,10 @@ static __always_inline unsigned long __c
11548 const void __user *from, unsigned long n)
11549 {
11550 might_fault();
11551+
11552+ if ((long)n < 0)
11553+ return n;
11554+
11555 if (__builtin_constant_p(n)) {
11556 unsigned long ret;
11557
11558@@ -182,15 +205,19 @@ static __always_inline unsigned long
11559 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
11560 unsigned long n)
11561 {
11562- return __copy_from_user_ll_nocache_nozero(to, from, n);
11563-}
11564+ if ((long)n < 0)
11565+ return n;
11566
11567-unsigned long __must_check copy_to_user(void __user *to,
11568- const void *from, unsigned long n);
11569-unsigned long __must_check _copy_from_user(void *to,
11570- const void __user *from,
11571- unsigned long n);
11572+ return __copy_from_user_ll_nocache_nozero(to, from, n);
11573+}
11574
11575+extern void copy_to_user_overflow(void)
11576+#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
11577+ __compiletime_error("copy_to_user() buffer size is not provably correct")
11578+#else
11579+ __compiletime_warning("copy_to_user() buffer size is not provably correct")
11580+#endif
11581+;
11582
11583 extern void copy_from_user_overflow(void)
11584 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
11585@@ -200,17 +227,61 @@ extern void copy_from_user_overflow(void
11586 #endif
11587 ;
11588
11589-static inline unsigned long __must_check copy_from_user(void *to,
11590- const void __user *from,
11591- unsigned long n)
11592+/**
11593+ * copy_to_user: - Copy a block of data into user space.
11594+ * @to: Destination address, in user space.
11595+ * @from: Source address, in kernel space.
11596+ * @n: Number of bytes to copy.
11597+ *
11598+ * Context: User context only. This function may sleep.
11599+ *
11600+ * Copy data from kernel space to user space.
11601+ *
11602+ * Returns number of bytes that could not be copied.
11603+ * On success, this will be zero.
11604+ */
11605+static inline unsigned long __must_check
11606+copy_to_user(void __user *to, const void *from, unsigned long n)
11607+{
11608+ int sz = __compiletime_object_size(from);
11609+
11610+ if (unlikely(sz != -1 && sz < n))
11611+ copy_to_user_overflow();
11612+ else if (access_ok(VERIFY_WRITE, to, n))
11613+ n = __copy_to_user(to, from, n);
11614+ return n;
11615+}
11616+
11617+/**
11618+ * copy_from_user: - Copy a block of data from user space.
11619+ * @to: Destination address, in kernel space.
11620+ * @from: Source address, in user space.
11621+ * @n: Number of bytes to copy.
11622+ *
11623+ * Context: User context only. This function may sleep.
11624+ *
11625+ * Copy data from user space to kernel space.
11626+ *
11627+ * Returns number of bytes that could not be copied.
11628+ * On success, this will be zero.
11629+ *
11630+ * If some data could not be copied, this function will pad the copied
11631+ * data to the requested size using zero bytes.
11632+ */
11633+static inline unsigned long __must_check
11634+copy_from_user(void *to, const void __user *from, unsigned long n)
11635 {
11636 int sz = __compiletime_object_size(to);
11637
11638- if (likely(sz == -1 || sz >= n))
11639- n = _copy_from_user(to, from, n);
11640- else
11641+ if (unlikely(sz != -1 && sz < n))
11642 copy_from_user_overflow();
11643-
11644+ else if (access_ok(VERIFY_READ, from, n))
11645+ n = __copy_from_user(to, from, n);
11646+ else if ((long)n > 0) {
11647+ if (!__builtin_constant_p(n))
11648+ check_object_size(to, n, false);
11649+ memset(to, 0, n);
11650+ }
11651 return n;
11652 }
11653
11654diff -urNp linux-2.6.39.1/arch/x86/include/asm/uaccess_64.h linux-2.6.39.1/arch/x86/include/asm/uaccess_64.h
11655--- linux-2.6.39.1/arch/x86/include/asm/uaccess_64.h 2011-05-19 00:06:34.000000000 -0400
11656+++ linux-2.6.39.1/arch/x86/include/asm/uaccess_64.h 2011-05-22 19:36:30.000000000 -0400
11657@@ -11,6 +11,9 @@
11658 #include <asm/alternative.h>
11659 #include <asm/cpufeature.h>
11660 #include <asm/page.h>
11661+#include <asm/pgtable.h>
11662+
11663+#define set_fs(x) (current_thread_info()->addr_limit = (x))
11664
11665 /*
11666 * Copy To/From Userspace
11667@@ -37,26 +40,26 @@ copy_user_generic(void *to, const void *
11668 return ret;
11669 }
11670
11671-__must_check unsigned long
11672-_copy_to_user(void __user *to, const void *from, unsigned len);
11673-__must_check unsigned long
11674-_copy_from_user(void *to, const void __user *from, unsigned len);
11675+static __always_inline __must_check unsigned long
11676+__copy_to_user(void __user *to, const void *from, unsigned len);
11677+static __always_inline __must_check unsigned long
11678+__copy_from_user(void *to, const void __user *from, unsigned len);
11679 __must_check unsigned long
11680 copy_in_user(void __user *to, const void __user *from, unsigned len);
11681
11682 static inline unsigned long __must_check copy_from_user(void *to,
11683 const void __user *from,
11684- unsigned long n)
11685+ unsigned n)
11686 {
11687- int sz = __compiletime_object_size(to);
11688-
11689 might_fault();
11690- if (likely(sz == -1 || sz >= n))
11691- n = _copy_from_user(to, from, n);
11692-#ifdef CONFIG_DEBUG_VM
11693- else
11694- WARN(1, "Buffer overflow detected!\n");
11695-#endif
11696+
11697+ if (access_ok(VERIFY_READ, from, n))
11698+ n = __copy_from_user(to, from, n);
11699+ else if ((int)n > 0) {
11700+ if (!__builtin_constant_p(n))
11701+ check_object_size(to, n, false);
11702+ memset(to, 0, n);
11703+ }
11704 return n;
11705 }
11706
11707@@ -65,110 +68,198 @@ int copy_to_user(void __user *dst, const
11708 {
11709 might_fault();
11710
11711- return _copy_to_user(dst, src, size);
11712+ if (access_ok(VERIFY_WRITE, dst, size))
11713+ size = __copy_to_user(dst, src, size);
11714+ return size;
11715 }
11716
11717 static __always_inline __must_check
11718-int __copy_from_user(void *dst, const void __user *src, unsigned size)
11719+unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
11720 {
11721- int ret = 0;
11722+ int sz = __compiletime_object_size(dst);
11723+ unsigned ret = 0;
11724
11725 might_fault();
11726- if (!__builtin_constant_p(size))
11727- return copy_user_generic(dst, (__force void *)src, size);
11728+
11729+ pax_track_stack();
11730+
11731+ if ((int)size < 0)
11732+ return size;
11733+
11734+#ifdef CONFIG_PAX_MEMORY_UDEREF
11735+ if (!__access_ok(VERIFY_READ, src, size))
11736+ return size;
11737+#endif
11738+
11739+ if (unlikely(sz != -1 && sz < size)) {
11740+#ifdef CONFIG_DEBUG_VM
11741+ WARN(1, "Buffer overflow detected!\n");
11742+#endif
11743+ return size;
11744+ }
11745+
11746+ if (!__builtin_constant_p(size)) {
11747+ check_object_size(dst, size, false);
11748+
11749+#ifdef CONFIG_PAX_MEMORY_UDEREF
11750+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11751+ src += PAX_USER_SHADOW_BASE;
11752+#endif
11753+
11754+ return copy_user_generic(dst, (__force const void *)src, size);
11755+ }
11756 switch (size) {
11757- case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
11758+ case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
11759 ret, "b", "b", "=q", 1);
11760 return ret;
11761- case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
11762+ case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
11763 ret, "w", "w", "=r", 2);
11764 return ret;
11765- case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
11766+ case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
11767 ret, "l", "k", "=r", 4);
11768 return ret;
11769- case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
11770+ case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11771 ret, "q", "", "=r", 8);
11772 return ret;
11773 case 10:
11774- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
11775+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11776 ret, "q", "", "=r", 10);
11777 if (unlikely(ret))
11778 return ret;
11779 __get_user_asm(*(u16 *)(8 + (char *)dst),
11780- (u16 __user *)(8 + (char __user *)src),
11781+ (const u16 __user *)(8 + (const char __user *)src),
11782 ret, "w", "w", "=r", 2);
11783 return ret;
11784 case 16:
11785- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
11786+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11787 ret, "q", "", "=r", 16);
11788 if (unlikely(ret))
11789 return ret;
11790 __get_user_asm(*(u64 *)(8 + (char *)dst),
11791- (u64 __user *)(8 + (char __user *)src),
11792+ (const u64 __user *)(8 + (const char __user *)src),
11793 ret, "q", "", "=r", 8);
11794 return ret;
11795 default:
11796- return copy_user_generic(dst, (__force void *)src, size);
11797+
11798+#ifdef CONFIG_PAX_MEMORY_UDEREF
11799+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11800+ src += PAX_USER_SHADOW_BASE;
11801+#endif
11802+
11803+ return copy_user_generic(dst, (__force const void *)src, size);
11804 }
11805 }
11806
11807 static __always_inline __must_check
11808-int __copy_to_user(void __user *dst, const void *src, unsigned size)
11809+unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
11810 {
11811- int ret = 0;
11812+ int sz = __compiletime_object_size(src);
11813+ unsigned ret = 0;
11814
11815 might_fault();
11816- if (!__builtin_constant_p(size))
11817+
11818+ pax_track_stack();
11819+
11820+ if ((int)size < 0)
11821+ return size;
11822+
11823+#ifdef CONFIG_PAX_MEMORY_UDEREF
11824+ if (!__access_ok(VERIFY_WRITE, dst, size))
11825+ return size;
11826+#endif
11827+
11828+ if (unlikely(sz != -1 && sz < size)) {
11829+#ifdef CONFIG_DEBUG_VM
11830+ WARN(1, "Buffer overflow detected!\n");
11831+#endif
11832+ return size;
11833+ }
11834+
11835+ if (!__builtin_constant_p(size)) {
11836+ check_object_size(src, size, true);
11837+
11838+#ifdef CONFIG_PAX_MEMORY_UDEREF
11839+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11840+ dst += PAX_USER_SHADOW_BASE;
11841+#endif
11842+
11843 return copy_user_generic((__force void *)dst, src, size);
11844+ }
11845 switch (size) {
11846- case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
11847+ case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
11848 ret, "b", "b", "iq", 1);
11849 return ret;
11850- case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
11851+ case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
11852 ret, "w", "w", "ir", 2);
11853 return ret;
11854- case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
11855+ case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
11856 ret, "l", "k", "ir", 4);
11857 return ret;
11858- case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
11859+ case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11860 ret, "q", "", "er", 8);
11861 return ret;
11862 case 10:
11863- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11864+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11865 ret, "q", "", "er", 10);
11866 if (unlikely(ret))
11867 return ret;
11868 asm("":::"memory");
11869- __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
11870+ __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
11871 ret, "w", "w", "ir", 2);
11872 return ret;
11873 case 16:
11874- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11875+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11876 ret, "q", "", "er", 16);
11877 if (unlikely(ret))
11878 return ret;
11879 asm("":::"memory");
11880- __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
11881+ __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
11882 ret, "q", "", "er", 8);
11883 return ret;
11884 default:
11885+
11886+#ifdef CONFIG_PAX_MEMORY_UDEREF
11887+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11888+ dst += PAX_USER_SHADOW_BASE;
11889+#endif
11890+
11891 return copy_user_generic((__force void *)dst, src, size);
11892 }
11893 }
11894
11895 static __always_inline __must_check
11896-int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11897+unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11898 {
11899- int ret = 0;
11900+ unsigned ret = 0;
11901
11902 might_fault();
11903- if (!__builtin_constant_p(size))
11904+
11905+ if ((int)size < 0)
11906+ return size;
11907+
11908+#ifdef CONFIG_PAX_MEMORY_UDEREF
11909+ if (!__access_ok(VERIFY_READ, src, size))
11910+ return size;
11911+ if (!__access_ok(VERIFY_WRITE, dst, size))
11912+ return size;
11913+#endif
11914+
11915+ if (!__builtin_constant_p(size)) {
11916+
11917+#ifdef CONFIG_PAX_MEMORY_UDEREF
11918+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11919+ src += PAX_USER_SHADOW_BASE;
11920+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11921+ dst += PAX_USER_SHADOW_BASE;
11922+#endif
11923+
11924 return copy_user_generic((__force void *)dst,
11925- (__force void *)src, size);
11926+ (__force const void *)src, size);
11927+ }
11928 switch (size) {
11929 case 1: {
11930 u8 tmp;
11931- __get_user_asm(tmp, (u8 __user *)src,
11932+ __get_user_asm(tmp, (const u8 __user *)src,
11933 ret, "b", "b", "=q", 1);
11934 if (likely(!ret))
11935 __put_user_asm(tmp, (u8 __user *)dst,
11936@@ -177,7 +268,7 @@ int __copy_in_user(void __user *dst, con
11937 }
11938 case 2: {
11939 u16 tmp;
11940- __get_user_asm(tmp, (u16 __user *)src,
11941+ __get_user_asm(tmp, (const u16 __user *)src,
11942 ret, "w", "w", "=r", 2);
11943 if (likely(!ret))
11944 __put_user_asm(tmp, (u16 __user *)dst,
11945@@ -187,7 +278,7 @@ int __copy_in_user(void __user *dst, con
11946
11947 case 4: {
11948 u32 tmp;
11949- __get_user_asm(tmp, (u32 __user *)src,
11950+ __get_user_asm(tmp, (const u32 __user *)src,
11951 ret, "l", "k", "=r", 4);
11952 if (likely(!ret))
11953 __put_user_asm(tmp, (u32 __user *)dst,
11954@@ -196,7 +287,7 @@ int __copy_in_user(void __user *dst, con
11955 }
11956 case 8: {
11957 u64 tmp;
11958- __get_user_asm(tmp, (u64 __user *)src,
11959+ __get_user_asm(tmp, (const u64 __user *)src,
11960 ret, "q", "", "=r", 8);
11961 if (likely(!ret))
11962 __put_user_asm(tmp, (u64 __user *)dst,
11963@@ -204,8 +295,16 @@ int __copy_in_user(void __user *dst, con
11964 return ret;
11965 }
11966 default:
11967+
11968+#ifdef CONFIG_PAX_MEMORY_UDEREF
11969+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11970+ src += PAX_USER_SHADOW_BASE;
11971+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11972+ dst += PAX_USER_SHADOW_BASE;
11973+#endif
11974+
11975 return copy_user_generic((__force void *)dst,
11976- (__force void *)src, size);
11977+ (__force const void *)src, size);
11978 }
11979 }
11980
11981@@ -222,33 +321,72 @@ __must_check unsigned long __clear_user(
11982 static __must_check __always_inline int
11983 __copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
11984 {
11985+ pax_track_stack();
11986+
11987+ if ((int)size < 0)
11988+ return size;
11989+
11990+#ifdef CONFIG_PAX_MEMORY_UDEREF
11991+ if (!__access_ok(VERIFY_READ, src, size))
11992+ return size;
11993+
11994+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11995+ src += PAX_USER_SHADOW_BASE;
11996+#endif
11997+
11998 return copy_user_generic(dst, (__force const void *)src, size);
11999 }
12000
12001-static __must_check __always_inline int
12002+static __must_check __always_inline unsigned long
12003 __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
12004 {
12005+ if ((int)size < 0)
12006+ return size;
12007+
12008+#ifdef CONFIG_PAX_MEMORY_UDEREF
12009+ if (!__access_ok(VERIFY_WRITE, dst, size))
12010+ return size;
12011+
12012+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
12013+ dst += PAX_USER_SHADOW_BASE;
12014+#endif
12015+
12016 return copy_user_generic((__force void *)dst, src, size);
12017 }
12018
12019-extern long __copy_user_nocache(void *dst, const void __user *src,
12020+extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
12021 unsigned size, int zerorest);
12022
12023-static inline int
12024-__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
12025+static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
12026 {
12027 might_sleep();
12028+
12029+ if ((int)size < 0)
12030+ return size;
12031+
12032+#ifdef CONFIG_PAX_MEMORY_UDEREF
12033+ if (!__access_ok(VERIFY_READ, src, size))
12034+ return size;
12035+#endif
12036+
12037 return __copy_user_nocache(dst, src, size, 1);
12038 }
12039
12040-static inline int
12041-__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
12042+static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
12043 unsigned size)
12044 {
12045+ if ((int)size < 0)
12046+ return size;
12047+
12048+#ifdef CONFIG_PAX_MEMORY_UDEREF
12049+ if (!__access_ok(VERIFY_READ, src, size))
12050+ return size;
12051+#endif
12052+
12053 return __copy_user_nocache(dst, src, size, 0);
12054 }
12055
12056-unsigned long
12057+extern unsigned long
12058 copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
12059
12060 #endif /* _ASM_X86_UACCESS_64_H */
12061diff -urNp linux-2.6.39.1/arch/x86/include/asm/uaccess.h linux-2.6.39.1/arch/x86/include/asm/uaccess.h
12062--- linux-2.6.39.1/arch/x86/include/asm/uaccess.h 2011-06-03 00:04:13.000000000 -0400
12063+++ linux-2.6.39.1/arch/x86/include/asm/uaccess.h 2011-06-03 00:32:04.000000000 -0400
12064@@ -8,12 +8,15 @@
12065 #include <linux/thread_info.h>
12066 #include <linux/prefetch.h>
12067 #include <linux/string.h>
12068+#include <linux/sched.h>
12069 #include <asm/asm.h>
12070 #include <asm/page.h>
12071
12072 #define VERIFY_READ 0
12073 #define VERIFY_WRITE 1
12074
12075+extern void check_object_size(const void *ptr, unsigned long n, bool to);
12076+
12077 /*
12078 * The fs value determines whether argument validity checking should be
12079 * performed or not. If get_fs() == USER_DS, checking is performed, with
12080@@ -29,7 +32,12 @@
12081
12082 #define get_ds() (KERNEL_DS)
12083 #define get_fs() (current_thread_info()->addr_limit)
12084+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
12085+void __set_fs(mm_segment_t x);
12086+void set_fs(mm_segment_t x);
12087+#else
12088 #define set_fs(x) (current_thread_info()->addr_limit = (x))
12089+#endif
12090
12091 #define segment_eq(a, b) ((a).seg == (b).seg)
12092
12093@@ -77,7 +85,33 @@
12094 * checks that the pointer is in the user space range - after calling
12095 * this function, memory access functions may still return -EFAULT.
12096 */
12097-#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
12098+#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
12099+#define access_ok(type, addr, size) \
12100+({ \
12101+ long __size = size; \
12102+ unsigned long __addr = (unsigned long)addr; \
12103+ unsigned long __addr_ao = __addr & PAGE_MASK; \
12104+ unsigned long __end_ao = __addr + __size - 1; \
12105+ bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
12106+ if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
12107+ while(__addr_ao <= __end_ao) { \
12108+ char __c_ao; \
12109+ __addr_ao += PAGE_SIZE; \
12110+ if (__size > PAGE_SIZE) \
12111+ cond_resched(); \
12112+ if (__get_user(__c_ao, (char __user *)__addr)) \
12113+ break; \
12114+ if (type != VERIFY_WRITE) { \
12115+ __addr = __addr_ao; \
12116+ continue; \
12117+ } \
12118+ if (__put_user(__c_ao, (char __user *)__addr)) \
12119+ break; \
12120+ __addr = __addr_ao; \
12121+ } \
12122+ } \
12123+ __ret_ao; \
12124+})
12125
12126 /*
12127 * The exception table consists of pairs of addresses: the first is the
12128@@ -183,12 +217,20 @@ extern int __get_user_bad(void);
12129 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
12130 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
12131
12132-
12133+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
12134+#define __copyuser_seg "gs;"
12135+#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
12136+#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
12137+#else
12138+#define __copyuser_seg
12139+#define __COPYUSER_SET_ES
12140+#define __COPYUSER_RESTORE_ES
12141+#endif
12142
12143 #ifdef CONFIG_X86_32
12144 #define __put_user_asm_u64(x, addr, err, errret) \
12145- asm volatile("1: movl %%eax,0(%2)\n" \
12146- "2: movl %%edx,4(%2)\n" \
12147+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
12148+ "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
12149 "3:\n" \
12150 ".section .fixup,\"ax\"\n" \
12151 "4: movl %3,%0\n" \
12152@@ -200,8 +242,8 @@ extern int __get_user_bad(void);
12153 : "A" (x), "r" (addr), "i" (errret), "0" (err))
12154
12155 #define __put_user_asm_ex_u64(x, addr) \
12156- asm volatile("1: movl %%eax,0(%1)\n" \
12157- "2: movl %%edx,4(%1)\n" \
12158+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
12159+ "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
12160 "3:\n" \
12161 _ASM_EXTABLE(1b, 2b - 1b) \
12162 _ASM_EXTABLE(2b, 3b - 2b) \
12163@@ -374,7 +416,7 @@ do { \
12164 } while (0)
12165
12166 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
12167- asm volatile("1: mov"itype" %2,%"rtype"1\n" \
12168+ asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
12169 "2:\n" \
12170 ".section .fixup,\"ax\"\n" \
12171 "3: mov %3,%0\n" \
12172@@ -382,7 +424,7 @@ do { \
12173 " jmp 2b\n" \
12174 ".previous\n" \
12175 _ASM_EXTABLE(1b, 3b) \
12176- : "=r" (err), ltype(x) \
12177+ : "=r" (err), ltype (x) \
12178 : "m" (__m(addr)), "i" (errret), "0" (err))
12179
12180 #define __get_user_size_ex(x, ptr, size) \
12181@@ -407,7 +449,7 @@ do { \
12182 } while (0)
12183
12184 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
12185- asm volatile("1: mov"itype" %1,%"rtype"0\n" \
12186+ asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
12187 "2:\n" \
12188 _ASM_EXTABLE(1b, 2b - 1b) \
12189 : ltype(x) : "m" (__m(addr)))
12190@@ -424,13 +466,24 @@ do { \
12191 int __gu_err; \
12192 unsigned long __gu_val; \
12193 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
12194- (x) = (__force __typeof__(*(ptr)))__gu_val; \
12195+ (x) = (__typeof__(*(ptr)))__gu_val; \
12196 __gu_err; \
12197 })
12198
12199 /* FIXME: this hack is definitely wrong -AK */
12200 struct __large_struct { unsigned long buf[100]; };
12201-#define __m(x) (*(struct __large_struct __user *)(x))
12202+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12203+#define ____m(x) \
12204+({ \
12205+ unsigned long ____x = (unsigned long)(x); \
12206+ if (____x < PAX_USER_SHADOW_BASE) \
12207+ ____x += PAX_USER_SHADOW_BASE; \
12208+ (void __user *)____x; \
12209+})
12210+#else
12211+#define ____m(x) (x)
12212+#endif
12213+#define __m(x) (*(struct __large_struct __user *)____m(x))
12214
12215 /*
12216 * Tell gcc we read from memory instead of writing: this is because
12217@@ -438,7 +491,7 @@ struct __large_struct { unsigned long bu
12218 * aliasing issues.
12219 */
12220 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
12221- asm volatile("1: mov"itype" %"rtype"1,%2\n" \
12222+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
12223 "2:\n" \
12224 ".section .fixup,\"ax\"\n" \
12225 "3: mov %3,%0\n" \
12226@@ -446,10 +499,10 @@ struct __large_struct { unsigned long bu
12227 ".previous\n" \
12228 _ASM_EXTABLE(1b, 3b) \
12229 : "=r"(err) \
12230- : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
12231+ : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
12232
12233 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
12234- asm volatile("1: mov"itype" %"rtype"0,%1\n" \
12235+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
12236 "2:\n" \
12237 _ASM_EXTABLE(1b, 2b - 1b) \
12238 : : ltype(x), "m" (__m(addr)))
12239@@ -488,8 +541,12 @@ struct __large_struct { unsigned long bu
12240 * On error, the variable @x is set to zero.
12241 */
12242
12243+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12244+#define __get_user(x, ptr) get_user((x), (ptr))
12245+#else
12246 #define __get_user(x, ptr) \
12247 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
12248+#endif
12249
12250 /**
12251 * __put_user: - Write a simple value into user space, with less checking.
12252@@ -511,8 +568,12 @@ struct __large_struct { unsigned long bu
12253 * Returns zero on success, or -EFAULT on error.
12254 */
12255
12256+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12257+#define __put_user(x, ptr) put_user((x), (ptr))
12258+#else
12259 #define __put_user(x, ptr) \
12260 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
12261+#endif
12262
12263 #define __get_user_unaligned __get_user
12264 #define __put_user_unaligned __put_user
12265@@ -530,7 +591,7 @@ struct __large_struct { unsigned long bu
12266 #define get_user_ex(x, ptr) do { \
12267 unsigned long __gue_val; \
12268 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
12269- (x) = (__force __typeof__(*(ptr)))__gue_val; \
12270+ (x) = (__typeof__(*(ptr)))__gue_val; \
12271 } while (0)
12272
12273 #ifdef CONFIG_X86_WP_WORKS_OK
12274@@ -567,6 +628,7 @@ extern struct movsl_mask {
12275
12276 #define ARCH_HAS_NOCACHE_UACCESS 1
12277
12278+#define ARCH_HAS_SORT_EXTABLE
12279 #ifdef CONFIG_X86_32
12280 # include "uaccess_32.h"
12281 #else
12282diff -urNp linux-2.6.39.1/arch/x86/include/asm/vgtod.h linux-2.6.39.1/arch/x86/include/asm/vgtod.h
12283--- linux-2.6.39.1/arch/x86/include/asm/vgtod.h 2011-05-19 00:06:34.000000000 -0400
12284+++ linux-2.6.39.1/arch/x86/include/asm/vgtod.h 2011-05-22 19:36:30.000000000 -0400
12285@@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
12286 int sysctl_enabled;
12287 struct timezone sys_tz;
12288 struct { /* extract of a clocksource struct */
12289+ char name[8];
12290 cycle_t (*vread)(void);
12291 cycle_t cycle_last;
12292 cycle_t mask;
12293diff -urNp linux-2.6.39.1/arch/x86/include/asm/vsyscall.h linux-2.6.39.1/arch/x86/include/asm/vsyscall.h
12294--- linux-2.6.39.1/arch/x86/include/asm/vsyscall.h 2011-05-19 00:06:34.000000000 -0400
12295+++ linux-2.6.39.1/arch/x86/include/asm/vsyscall.h 2011-05-22 19:36:30.000000000 -0400
12296@@ -15,9 +15,10 @@ enum vsyscall_num {
12297
12298 #ifdef __KERNEL__
12299 #include <linux/seqlock.h>
12300+#include <linux/getcpu.h>
12301+#include <linux/time.h>
12302
12303 #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
12304-#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
12305
12306 /* Definitions for CONFIG_GENERIC_TIME definitions */
12307 #define __section_vsyscall_gtod_data __attribute__ \
12308@@ -31,7 +32,6 @@ enum vsyscall_num {
12309 #define VGETCPU_LSL 2
12310
12311 extern int __vgetcpu_mode;
12312-extern volatile unsigned long __jiffies;
12313
12314 /* kernel space (writeable) */
12315 extern int vgetcpu_mode;
12316@@ -39,6 +39,9 @@ extern struct timezone sys_tz;
12317
12318 extern void map_vsyscall(void);
12319
12320+extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
12321+extern time_t vtime(time_t *t);
12322+extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
12323 #endif /* __KERNEL__ */
12324
12325 #endif /* _ASM_X86_VSYSCALL_H */
12326diff -urNp linux-2.6.39.1/arch/x86/include/asm/xen/pci.h linux-2.6.39.1/arch/x86/include/asm/xen/pci.h
12327--- linux-2.6.39.1/arch/x86/include/asm/xen/pci.h 2011-05-19 00:06:34.000000000 -0400
12328+++ linux-2.6.39.1/arch/x86/include/asm/xen/pci.h 2011-05-22 19:36:30.000000000 -0400
12329@@ -33,7 +33,7 @@ struct xen_pci_frontend_ops {
12330 void (*disable_msix)(struct pci_dev *dev);
12331 };
12332
12333-extern struct xen_pci_frontend_ops *xen_pci_frontend;
12334+extern const struct xen_pci_frontend_ops *xen_pci_frontend;
12335
12336 static inline int xen_pci_frontend_enable_msi(struct pci_dev *dev,
12337 int vectors[])
12338diff -urNp linux-2.6.39.1/arch/x86/include/asm/xsave.h linux-2.6.39.1/arch/x86/include/asm/xsave.h
12339--- linux-2.6.39.1/arch/x86/include/asm/xsave.h 2011-05-19 00:06:34.000000000 -0400
12340+++ linux-2.6.39.1/arch/x86/include/asm/xsave.h 2011-05-22 19:36:30.000000000 -0400
12341@@ -65,6 +65,11 @@ static inline int xsave_user(struct xsav
12342 {
12343 int err;
12344
12345+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12346+ if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
12347+ buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
12348+#endif
12349+
12350 /*
12351 * Clear the xsave header first, so that reserved fields are
12352 * initialized to zero.
12353@@ -100,6 +105,11 @@ static inline int xrestore_user(struct x
12354 u32 lmask = mask;
12355 u32 hmask = mask >> 32;
12356
12357+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12358+ if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
12359+ xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
12360+#endif
12361+
12362 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
12363 "2:\n"
12364 ".section .fixup,\"ax\"\n"
12365diff -urNp linux-2.6.39.1/arch/x86/Kconfig linux-2.6.39.1/arch/x86/Kconfig
12366--- linux-2.6.39.1/arch/x86/Kconfig 2011-05-19 00:06:34.000000000 -0400
12367+++ linux-2.6.39.1/arch/x86/Kconfig 2011-05-22 19:41:32.000000000 -0400
12368@@ -224,7 +224,7 @@ config X86_HT
12369
12370 config X86_32_LAZY_GS
12371 def_bool y
12372- depends on X86_32 && !CC_STACKPROTECTOR
12373+ depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
12374
12375 config ARCH_HWEIGHT_CFLAGS
12376 string
12377@@ -1022,7 +1022,7 @@ choice
12378
12379 config NOHIGHMEM
12380 bool "off"
12381- depends on !X86_NUMAQ
12382+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
12383 ---help---
12384 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
12385 However, the address space of 32-bit x86 processors is only 4
12386@@ -1059,7 +1059,7 @@ config NOHIGHMEM
12387
12388 config HIGHMEM4G
12389 bool "4GB"
12390- depends on !X86_NUMAQ
12391+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
12392 ---help---
12393 Select this if you have a 32-bit processor and between 1 and 4
12394 gigabytes of physical RAM.
12395@@ -1113,7 +1113,7 @@ config PAGE_OFFSET
12396 hex
12397 default 0xB0000000 if VMSPLIT_3G_OPT
12398 default 0x80000000 if VMSPLIT_2G
12399- default 0x78000000 if VMSPLIT_2G_OPT
12400+ default 0x70000000 if VMSPLIT_2G_OPT
12401 default 0x40000000 if VMSPLIT_1G
12402 default 0xC0000000
12403 depends on X86_32
12404@@ -1457,7 +1457,7 @@ config ARCH_USES_PG_UNCACHED
12405
12406 config EFI
12407 bool "EFI runtime service support"
12408- depends on ACPI
12409+ depends on ACPI && !PAX_KERNEXEC
12410 ---help---
12411 This enables the kernel to use EFI runtime services that are
12412 available (such as the EFI variable services).
12413@@ -1487,6 +1487,7 @@ config SECCOMP
12414
12415 config CC_STACKPROTECTOR
12416 bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
12417+ depends on X86_64 || !PAX_MEMORY_UDEREF
12418 ---help---
12419 This option turns on the -fstack-protector GCC feature. This
12420 feature puts, at the beginning of functions, a canary value on
12421@@ -1544,6 +1545,7 @@ config KEXEC_JUMP
12422 config PHYSICAL_START
12423 hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP)
12424 default "0x1000000"
12425+ range 0x400000 0x40000000
12426 ---help---
12427 This gives the physical address where the kernel is loaded.
12428
12429@@ -1607,6 +1609,7 @@ config X86_NEED_RELOCS
12430 config PHYSICAL_ALIGN
12431 hex "Alignment value to which kernel should be aligned" if X86_32
12432 default "0x1000000"
12433+ range 0x400000 0x1000000 if PAX_KERNEXEC
12434 range 0x2000 0x1000000
12435 ---help---
12436 This value puts the alignment restrictions on physical address
12437@@ -1638,9 +1641,10 @@ config HOTPLUG_CPU
12438 Say N if you want to disable CPU hotplug.
12439
12440 config COMPAT_VDSO
12441- def_bool y
12442+ def_bool n
12443 prompt "Compat VDSO support"
12444 depends on X86_32 || IA32_EMULATION
12445+ depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
12446 ---help---
12447 Map the 32-bit VDSO to the predictable old-style address too.
12448
12449diff -urNp linux-2.6.39.1/arch/x86/Kconfig.cpu linux-2.6.39.1/arch/x86/Kconfig.cpu
12450--- linux-2.6.39.1/arch/x86/Kconfig.cpu 2011-05-19 00:06:34.000000000 -0400
12451+++ linux-2.6.39.1/arch/x86/Kconfig.cpu 2011-05-22 19:36:30.000000000 -0400
12452@@ -334,7 +334,7 @@ config X86_PPRO_FENCE
12453
12454 config X86_F00F_BUG
12455 def_bool y
12456- depends on M586MMX || M586TSC || M586 || M486 || M386
12457+ depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
12458
12459 config X86_INVD_BUG
12460 def_bool y
12461@@ -358,7 +358,7 @@ config X86_POPAD_OK
12462
12463 config X86_ALIGNMENT_16
12464 def_bool y
12465- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12466+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12467
12468 config X86_INTEL_USERCOPY
12469 def_bool y
12470@@ -404,7 +404,7 @@ config X86_CMPXCHG64
12471 # generates cmov.
12472 config X86_CMOV
12473 def_bool y
12474- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
12475+ depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
12476
12477 config X86_MINIMUM_CPU_FAMILY
12478 int
12479diff -urNp linux-2.6.39.1/arch/x86/Kconfig.debug linux-2.6.39.1/arch/x86/Kconfig.debug
12480--- linux-2.6.39.1/arch/x86/Kconfig.debug 2011-05-19 00:06:34.000000000 -0400
12481+++ linux-2.6.39.1/arch/x86/Kconfig.debug 2011-05-22 19:36:30.000000000 -0400
12482@@ -101,7 +101,7 @@ config X86_PTDUMP
12483 config DEBUG_RODATA
12484 bool "Write protect kernel read-only data structures"
12485 default y
12486- depends on DEBUG_KERNEL
12487+ depends on DEBUG_KERNEL && BROKEN
12488 ---help---
12489 Mark the kernel read-only data as write-protected in the pagetables,
12490 in order to catch accidental (and incorrect) writes to such const
12491@@ -119,7 +119,7 @@ config DEBUG_RODATA_TEST
12492
12493 config DEBUG_SET_MODULE_RONX
12494 bool "Set loadable kernel module data as NX and text as RO"
12495- depends on MODULES
12496+ depends on MODULES && BROKEN
12497 ---help---
12498 This option helps catch unintended modifications to loadable
12499 kernel module's text and read-only data. It also prevents execution
12500diff -urNp linux-2.6.39.1/arch/x86/kernel/acpi/sleep.c linux-2.6.39.1/arch/x86/kernel/acpi/sleep.c
12501--- linux-2.6.39.1/arch/x86/kernel/acpi/sleep.c 2011-05-19 00:06:34.000000000 -0400
12502+++ linux-2.6.39.1/arch/x86/kernel/acpi/sleep.c 2011-05-22 19:36:30.000000000 -0400
12503@@ -88,8 +88,12 @@ int acpi_suspend_lowlevel(void)
12504 header->trampoline_segment = trampoline_address() >> 4;
12505 #ifdef CONFIG_SMP
12506 stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
12507+
12508+ pax_open_kernel();
12509 early_gdt_descr.address =
12510 (unsigned long)get_cpu_gdt_table(smp_processor_id());
12511+ pax_close_kernel();
12512+
12513 initial_gs = per_cpu_offset(smp_processor_id());
12514 #endif
12515 initial_code = (unsigned long)wakeup_long64;
12516diff -urNp linux-2.6.39.1/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.39.1/arch/x86/kernel/acpi/wakeup_32.S
12517--- linux-2.6.39.1/arch/x86/kernel/acpi/wakeup_32.S 2011-05-19 00:06:34.000000000 -0400
12518+++ linux-2.6.39.1/arch/x86/kernel/acpi/wakeup_32.S 2011-05-22 19:36:30.000000000 -0400
12519@@ -30,13 +30,11 @@ wakeup_pmode_return:
12520 # and restore the stack ... but you need gdt for this to work
12521 movl saved_context_esp, %esp
12522
12523- movl %cs:saved_magic, %eax
12524- cmpl $0x12345678, %eax
12525+ cmpl $0x12345678, saved_magic
12526 jne bogus_magic
12527
12528 # jump to place where we left off
12529- movl saved_eip, %eax
12530- jmp *%eax
12531+ jmp *(saved_eip)
12532
12533 bogus_magic:
12534 jmp bogus_magic
12535diff -urNp linux-2.6.39.1/arch/x86/kernel/alternative.c linux-2.6.39.1/arch/x86/kernel/alternative.c
12536--- linux-2.6.39.1/arch/x86/kernel/alternative.c 2011-05-19 00:06:34.000000000 -0400
12537+++ linux-2.6.39.1/arch/x86/kernel/alternative.c 2011-05-22 19:36:30.000000000 -0400
12538@@ -248,7 +248,7 @@ static void alternatives_smp_lock(const
12539 if (!*poff || ptr < text || ptr >= text_end)
12540 continue;
12541 /* turn DS segment override prefix into lock prefix */
12542- if (*ptr == 0x3e)
12543+ if (*ktla_ktva(ptr) == 0x3e)
12544 text_poke(ptr, ((unsigned char []){0xf0}), 1);
12545 };
12546 mutex_unlock(&text_mutex);
12547@@ -269,7 +269,7 @@ static void alternatives_smp_unlock(cons
12548 if (!*poff || ptr < text || ptr >= text_end)
12549 continue;
12550 /* turn lock prefix into DS segment override prefix */
12551- if (*ptr == 0xf0)
12552+ if (*ktla_ktva(ptr) == 0xf0)
12553 text_poke(ptr, ((unsigned char []){0x3E}), 1);
12554 };
12555 mutex_unlock(&text_mutex);
12556@@ -438,7 +438,7 @@ void __init_or_module apply_paravirt(str
12557
12558 BUG_ON(p->len > MAX_PATCH_LEN);
12559 /* prep the buffer with the original instructions */
12560- memcpy(insnbuf, p->instr, p->len);
12561+ memcpy(insnbuf, ktla_ktva(p->instr), p->len);
12562 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
12563 (unsigned long)p->instr, p->len);
12564
12565@@ -506,7 +506,7 @@ void __init alternative_instructions(voi
12566 if (smp_alt_once)
12567 free_init_pages("SMP alternatives",
12568 (unsigned long)__smp_locks,
12569- (unsigned long)__smp_locks_end);
12570+ PAGE_ALIGN((unsigned long)__smp_locks_end));
12571
12572 restart_nmi();
12573 }
12574@@ -523,13 +523,17 @@ void __init alternative_instructions(voi
12575 * instructions. And on the local CPU you need to be protected again NMI or MCE
12576 * handlers seeing an inconsistent instruction while you patch.
12577 */
12578-void *__init_or_module text_poke_early(void *addr, const void *opcode,
12579+void *__kprobes text_poke_early(void *addr, const void *opcode,
12580 size_t len)
12581 {
12582 unsigned long flags;
12583 local_irq_save(flags);
12584- memcpy(addr, opcode, len);
12585+
12586+ pax_open_kernel();
12587+ memcpy(ktla_ktva(addr), opcode, len);
12588 sync_core();
12589+ pax_close_kernel();
12590+
12591 local_irq_restore(flags);
12592 /* Could also do a CLFLUSH here to speed up CPU recovery; but
12593 that causes hangs on some VIA CPUs. */
12594@@ -551,36 +555,22 @@ void *__init_or_module text_poke_early(v
12595 */
12596 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
12597 {
12598- unsigned long flags;
12599- char *vaddr;
12600+ unsigned char *vaddr = ktla_ktva(addr);
12601 struct page *pages[2];
12602- int i;
12603+ size_t i;
12604
12605 if (!core_kernel_text((unsigned long)addr)) {
12606- pages[0] = vmalloc_to_page(addr);
12607- pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
12608+ pages[0] = vmalloc_to_page(vaddr);
12609+ pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
12610 } else {
12611- pages[0] = virt_to_page(addr);
12612+ pages[0] = virt_to_page(vaddr);
12613 WARN_ON(!PageReserved(pages[0]));
12614- pages[1] = virt_to_page(addr + PAGE_SIZE);
12615+ pages[1] = virt_to_page(vaddr + PAGE_SIZE);
12616 }
12617 BUG_ON(!pages[0]);
12618- local_irq_save(flags);
12619- set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
12620- if (pages[1])
12621- set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
12622- vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
12623- memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
12624- clear_fixmap(FIX_TEXT_POKE0);
12625- if (pages[1])
12626- clear_fixmap(FIX_TEXT_POKE1);
12627- local_flush_tlb();
12628- sync_core();
12629- /* Could also do a CLFLUSH here to speed up CPU recovery; but
12630- that causes hangs on some VIA CPUs. */
12631+ text_poke_early(addr, opcode, len);
12632 for (i = 0; i < len; i++)
12633- BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
12634- local_irq_restore(flags);
12635+ BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
12636 return addr;
12637 }
12638
12639@@ -682,9 +672,9 @@ void __kprobes text_poke_smp_batch(struc
12640 #if defined(CONFIG_DYNAMIC_FTRACE) || defined(HAVE_JUMP_LABEL)
12641
12642 #ifdef CONFIG_X86_64
12643-unsigned char ideal_nop5[5] = { 0x66, 0x66, 0x66, 0x66, 0x90 };
12644+unsigned char ideal_nop5[5] __read_only = { 0x66, 0x66, 0x66, 0x66, 0x90 };
12645 #else
12646-unsigned char ideal_nop5[5] = { 0x3e, 0x8d, 0x74, 0x26, 0x00 };
12647+unsigned char ideal_nop5[5] __read_only = { 0x3e, 0x8d, 0x74, 0x26, 0x00 };
12648 #endif
12649
12650 void __init arch_init_ideal_nop5(void)
12651diff -urNp linux-2.6.39.1/arch/x86/kernel/amd_iommu.c linux-2.6.39.1/arch/x86/kernel/amd_iommu.c
12652--- linux-2.6.39.1/arch/x86/kernel/amd_iommu.c 2011-05-19 00:06:34.000000000 -0400
12653+++ linux-2.6.39.1/arch/x86/kernel/amd_iommu.c 2011-05-22 19:36:30.000000000 -0400
12654@@ -48,7 +48,7 @@ static DEFINE_SPINLOCK(iommu_pd_list_loc
12655 */
12656 static struct protection_domain *pt_domain;
12657
12658-static struct iommu_ops amd_iommu_ops;
12659+static const struct iommu_ops amd_iommu_ops;
12660
12661 /*
12662 * general struct to manage commands send to an IOMMU
12663@@ -2286,7 +2286,7 @@ static void prealloc_protection_domains(
12664 }
12665 }
12666
12667-static struct dma_map_ops amd_iommu_dma_ops = {
12668+static const struct dma_map_ops amd_iommu_dma_ops = {
12669 .alloc_coherent = alloc_coherent,
12670 .free_coherent = free_coherent,
12671 .map_page = map_page,
12672@@ -2582,7 +2582,7 @@ static int amd_iommu_domain_has_cap(stru
12673 return 0;
12674 }
12675
12676-static struct iommu_ops amd_iommu_ops = {
12677+static const struct iommu_ops amd_iommu_ops = {
12678 .domain_init = amd_iommu_domain_init,
12679 .domain_destroy = amd_iommu_domain_destroy,
12680 .attach_dev = amd_iommu_attach_device,
12681diff -urNp linux-2.6.39.1/arch/x86/kernel/apic/apic.c linux-2.6.39.1/arch/x86/kernel/apic/apic.c
12682--- linux-2.6.39.1/arch/x86/kernel/apic/apic.c 2011-05-19 00:06:34.000000000 -0400
12683+++ linux-2.6.39.1/arch/x86/kernel/apic/apic.c 2011-05-22 19:36:30.000000000 -0400
12684@@ -1821,7 +1821,7 @@ void smp_error_interrupt(struct pt_regs
12685 apic_write(APIC_ESR, 0);
12686 v1 = apic_read(APIC_ESR);
12687 ack_APIC_irq();
12688- atomic_inc(&irq_err_count);
12689+ atomic_inc_unchecked(&irq_err_count);
12690
12691 /*
12692 * Here is what the APIC error bits mean:
12693@@ -2204,6 +2204,8 @@ static int __cpuinit apic_cluster_num(vo
12694 u16 *bios_cpu_apicid;
12695 DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
12696
12697+ pax_track_stack();
12698+
12699 bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
12700 bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
12701
12702diff -urNp linux-2.6.39.1/arch/x86/kernel/apic/io_apic.c linux-2.6.39.1/arch/x86/kernel/apic/io_apic.c
12703--- linux-2.6.39.1/arch/x86/kernel/apic/io_apic.c 2011-06-03 00:04:13.000000000 -0400
12704+++ linux-2.6.39.1/arch/x86/kernel/apic/io_apic.c 2011-06-03 00:42:37.000000000 -0400
12705@@ -623,7 +623,7 @@ struct IO_APIC_route_entry **alloc_ioapi
12706 ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
12707 GFP_ATOMIC);
12708 if (!ioapic_entries)
12709- return 0;
12710+ return NULL;
12711
12712 for (apic = 0; apic < nr_ioapics; apic++) {
12713 ioapic_entries[apic] =
12714@@ -640,7 +640,7 @@ nomem:
12715 kfree(ioapic_entries[apic]);
12716 kfree(ioapic_entries);
12717
12718- return 0;
12719+ return NULL;
12720 }
12721
12722 /*
12723@@ -1040,7 +1040,7 @@ int IO_APIC_get_PCI_irq_vector(int bus,
12724 }
12725 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
12726
12727-void lock_vector_lock(void)
12728+void lock_vector_lock(void) __acquires(vector_lock)
12729 {
12730 /* Used to the online set of cpus does not change
12731 * during assign_irq_vector.
12732@@ -1048,7 +1048,7 @@ void lock_vector_lock(void)
12733 raw_spin_lock(&vector_lock);
12734 }
12735
12736-void unlock_vector_lock(void)
12737+void unlock_vector_lock(void) __releases(vector_lock)
12738 {
12739 raw_spin_unlock(&vector_lock);
12740 }
12741@@ -2379,7 +2379,7 @@ static void ack_apic_edge(struct irq_dat
12742 ack_APIC_irq();
12743 }
12744
12745-atomic_t irq_mis_count;
12746+atomic_unchecked_t irq_mis_count;
12747
12748 /*
12749 * IO-APIC versions below 0x20 don't support EOI register.
12750@@ -2487,7 +2487,7 @@ static void ack_apic_level(struct irq_da
12751 * at the cpu.
12752 */
12753 if (!(v & (1 << (i & 0x1f)))) {
12754- atomic_inc(&irq_mis_count);
12755+ atomic_inc_unchecked(&irq_mis_count);
12756
12757 eoi_ioapic_irq(irq, cfg);
12758 }
12759diff -urNp linux-2.6.39.1/arch/x86/kernel/apm_32.c linux-2.6.39.1/arch/x86/kernel/apm_32.c
12760--- linux-2.6.39.1/arch/x86/kernel/apm_32.c 2011-05-19 00:06:34.000000000 -0400
12761+++ linux-2.6.39.1/arch/x86/kernel/apm_32.c 2011-05-22 19:36:30.000000000 -0400
12762@@ -412,7 +412,7 @@ static DEFINE_MUTEX(apm_mutex);
12763 * This is for buggy BIOS's that refer to (real mode) segment 0x40
12764 * even though they are called in protected mode.
12765 */
12766-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
12767+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
12768 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
12769
12770 static const char driver_version[] = "1.16ac"; /* no spaces */
12771@@ -590,7 +590,10 @@ static long __apm_bios_call(void *_call)
12772 BUG_ON(cpu != 0);
12773 gdt = get_cpu_gdt_table(cpu);
12774 save_desc_40 = gdt[0x40 / 8];
12775+
12776+ pax_open_kernel();
12777 gdt[0x40 / 8] = bad_bios_desc;
12778+ pax_close_kernel();
12779
12780 apm_irq_save(flags);
12781 APM_DO_SAVE_SEGS;
12782@@ -599,7 +602,11 @@ static long __apm_bios_call(void *_call)
12783 &call->esi);
12784 APM_DO_RESTORE_SEGS;
12785 apm_irq_restore(flags);
12786+
12787+ pax_open_kernel();
12788 gdt[0x40 / 8] = save_desc_40;
12789+ pax_close_kernel();
12790+
12791 put_cpu();
12792
12793 return call->eax & 0xff;
12794@@ -666,7 +673,10 @@ static long __apm_bios_call_simple(void
12795 BUG_ON(cpu != 0);
12796 gdt = get_cpu_gdt_table(cpu);
12797 save_desc_40 = gdt[0x40 / 8];
12798+
12799+ pax_open_kernel();
12800 gdt[0x40 / 8] = bad_bios_desc;
12801+ pax_close_kernel();
12802
12803 apm_irq_save(flags);
12804 APM_DO_SAVE_SEGS;
12805@@ -674,7 +684,11 @@ static long __apm_bios_call_simple(void
12806 &call->eax);
12807 APM_DO_RESTORE_SEGS;
12808 apm_irq_restore(flags);
12809+
12810+ pax_open_kernel();
12811 gdt[0x40 / 8] = save_desc_40;
12812+ pax_close_kernel();
12813+
12814 put_cpu();
12815 return error;
12816 }
12817@@ -2351,12 +2365,15 @@ static int __init apm_init(void)
12818 * code to that CPU.
12819 */
12820 gdt = get_cpu_gdt_table(0);
12821+
12822+ pax_open_kernel();
12823 set_desc_base(&gdt[APM_CS >> 3],
12824 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
12825 set_desc_base(&gdt[APM_CS_16 >> 3],
12826 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
12827 set_desc_base(&gdt[APM_DS >> 3],
12828 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
12829+ pax_close_kernel();
12830
12831 proc_create("apm", 0, NULL, &apm_file_ops);
12832
12833diff -urNp linux-2.6.39.1/arch/x86/kernel/asm-offsets_64.c linux-2.6.39.1/arch/x86/kernel/asm-offsets_64.c
12834--- linux-2.6.39.1/arch/x86/kernel/asm-offsets_64.c 2011-05-19 00:06:34.000000000 -0400
12835+++ linux-2.6.39.1/arch/x86/kernel/asm-offsets_64.c 2011-05-22 19:36:30.000000000 -0400
12836@@ -69,6 +69,7 @@ int main(void)
12837 BLANK();
12838 #undef ENTRY
12839
12840+ DEFINE(TSS_size, sizeof(struct tss_struct));
12841 OFFSET(TSS_ist, tss_struct, x86_tss.ist);
12842 BLANK();
12843
12844diff -urNp linux-2.6.39.1/arch/x86/kernel/asm-offsets.c linux-2.6.39.1/arch/x86/kernel/asm-offsets.c
12845--- linux-2.6.39.1/arch/x86/kernel/asm-offsets.c 2011-05-19 00:06:34.000000000 -0400
12846+++ linux-2.6.39.1/arch/x86/kernel/asm-offsets.c 2011-05-25 17:35:48.000000000 -0400
12847@@ -33,6 +33,8 @@ void common(void) {
12848 OFFSET(TI_status, thread_info, status);
12849 OFFSET(TI_addr_limit, thread_info, addr_limit);
12850 OFFSET(TI_preempt_count, thread_info, preempt_count);
12851+ OFFSET(TI_lowest_stack, thread_info, lowest_stack);
12852+ DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
12853
12854 BLANK();
12855 OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
12856@@ -53,8 +55,26 @@ void common(void) {
12857 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
12858 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
12859 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
12860+
12861+#ifdef CONFIG_PAX_KERNEXEC
12862+ OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
12863+#endif
12864+
12865+#ifdef CONFIG_PAX_MEMORY_UDEREF
12866+ OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
12867+ OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
12868+#ifdef CONFIG_X86_64
12869+ OFFSET(PV_MMU_set_pgd, pv_mmu_ops, set_pgd);
12870+#endif
12871 #endif
12872
12873+#endif
12874+
12875+ BLANK();
12876+ DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
12877+ DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
12878+ DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
12879+
12880 #ifdef CONFIG_XEN
12881 BLANK();
12882 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
12883diff -urNp linux-2.6.39.1/arch/x86/kernel/cpu/amd.c linux-2.6.39.1/arch/x86/kernel/cpu/amd.c
12884--- linux-2.6.39.1/arch/x86/kernel/cpu/amd.c 2011-06-03 00:04:13.000000000 -0400
12885+++ linux-2.6.39.1/arch/x86/kernel/cpu/amd.c 2011-06-03 00:32:04.000000000 -0400
12886@@ -647,7 +647,7 @@ static unsigned int __cpuinit amd_size_c
12887 unsigned int size)
12888 {
12889 /* AMD errata T13 (order #21922) */
12890- if ((c->x86 == 6)) {
12891+ if (c->x86 == 6) {
12892 /* Duron Rev A0 */
12893 if (c->x86_model == 3 && c->x86_mask == 0)
12894 size = 64;
12895diff -urNp linux-2.6.39.1/arch/x86/kernel/cpu/common.c linux-2.6.39.1/arch/x86/kernel/cpu/common.c
12896--- linux-2.6.39.1/arch/x86/kernel/cpu/common.c 2011-06-03 00:04:13.000000000 -0400
12897+++ linux-2.6.39.1/arch/x86/kernel/cpu/common.c 2011-06-03 00:32:04.000000000 -0400
12898@@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
12899
12900 static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
12901
12902-DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
12903-#ifdef CONFIG_X86_64
12904- /*
12905- * We need valid kernel segments for data and code in long mode too
12906- * IRET will check the segment types kkeil 2000/10/28
12907- * Also sysret mandates a special GDT layout
12908- *
12909- * TLS descriptors are currently at a different place compared to i386.
12910- * Hopefully nobody expects them at a fixed place (Wine?)
12911- */
12912- [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
12913- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
12914- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
12915- [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
12916- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
12917- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
12918-#else
12919- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
12920- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12921- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
12922- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
12923- /*
12924- * Segments used for calling PnP BIOS have byte granularity.
12925- * They code segments and data segments have fixed 64k limits,
12926- * the transfer segment sizes are set at run time.
12927- */
12928- /* 32-bit code */
12929- [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
12930- /* 16-bit code */
12931- [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
12932- /* 16-bit data */
12933- [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
12934- /* 16-bit data */
12935- [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
12936- /* 16-bit data */
12937- [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
12938- /*
12939- * The APM segments have byte granularity and their bases
12940- * are set at run time. All have 64k limits.
12941- */
12942- /* 32-bit code */
12943- [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
12944- /* 16-bit code */
12945- [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
12946- /* data */
12947- [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
12948-
12949- [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12950- [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12951- GDT_STACK_CANARY_INIT
12952-#endif
12953-} };
12954-EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
12955-
12956 static int __init x86_xsave_setup(char *s)
12957 {
12958 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
12959@@ -352,7 +298,7 @@ void switch_to_new_gdt(int cpu)
12960 {
12961 struct desc_ptr gdt_descr;
12962
12963- gdt_descr.address = (long)get_cpu_gdt_table(cpu);
12964+ gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
12965 gdt_descr.size = GDT_SIZE - 1;
12966 load_gdt(&gdt_descr);
12967 /* Reload the per-cpu base */
12968@@ -824,6 +770,10 @@ static void __cpuinit identify_cpu(struc
12969 /* Filter out anything that depends on CPUID levels we don't have */
12970 filter_cpuid_features(c, true);
12971
12972+#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
12973+ setup_clear_cpu_cap(X86_FEATURE_SEP);
12974+#endif
12975+
12976 /* If the model name is still unset, do table lookup. */
12977 if (!c->x86_model_id[0]) {
12978 const char *p;
12979@@ -1003,6 +953,9 @@ static __init int setup_disablecpuid(cha
12980 }
12981 __setup("clearcpuid=", setup_disablecpuid);
12982
12983+DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
12984+EXPORT_PER_CPU_SYMBOL(current_tinfo);
12985+
12986 #ifdef CONFIG_X86_64
12987 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
12988
12989@@ -1018,7 +971,7 @@ DEFINE_PER_CPU(struct task_struct *, cur
12990 EXPORT_PER_CPU_SYMBOL(current_task);
12991
12992 DEFINE_PER_CPU(unsigned long, kernel_stack) =
12993- (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
12994+ (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
12995 EXPORT_PER_CPU_SYMBOL(kernel_stack);
12996
12997 DEFINE_PER_CPU(char *, irq_stack_ptr) =
12998@@ -1083,7 +1036,7 @@ struct pt_regs * __cpuinit idle_regs(str
12999 {
13000 memset(regs, 0, sizeof(struct pt_regs));
13001 regs->fs = __KERNEL_PERCPU;
13002- regs->gs = __KERNEL_STACK_CANARY;
13003+ savesegment(gs, regs->gs);
13004
13005 return regs;
13006 }
13007@@ -1138,7 +1091,7 @@ void __cpuinit cpu_init(void)
13008 int i;
13009
13010 cpu = stack_smp_processor_id();
13011- t = &per_cpu(init_tss, cpu);
13012+ t = init_tss + cpu;
13013 oist = &per_cpu(orig_ist, cpu);
13014
13015 #ifdef CONFIG_NUMA
13016@@ -1164,7 +1117,7 @@ void __cpuinit cpu_init(void)
13017 switch_to_new_gdt(cpu);
13018 loadsegment(fs, 0);
13019
13020- load_idt((const struct desc_ptr *)&idt_descr);
13021+ load_idt(&idt_descr);
13022
13023 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
13024 syscall_init();
13025@@ -1173,7 +1126,6 @@ void __cpuinit cpu_init(void)
13026 wrmsrl(MSR_KERNEL_GS_BASE, 0);
13027 barrier();
13028
13029- x86_configure_nx();
13030 if (cpu != 0)
13031 enable_x2apic();
13032
13033@@ -1227,7 +1179,7 @@ void __cpuinit cpu_init(void)
13034 {
13035 int cpu = smp_processor_id();
13036 struct task_struct *curr = current;
13037- struct tss_struct *t = &per_cpu(init_tss, cpu);
13038+ struct tss_struct *t = init_tss + cpu;
13039 struct thread_struct *thread = &curr->thread;
13040
13041 if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
13042diff -urNp linux-2.6.39.1/arch/x86/kernel/cpu/intel.c linux-2.6.39.1/arch/x86/kernel/cpu/intel.c
13043--- linux-2.6.39.1/arch/x86/kernel/cpu/intel.c 2011-05-19 00:06:34.000000000 -0400
13044+++ linux-2.6.39.1/arch/x86/kernel/cpu/intel.c 2011-05-22 19:36:30.000000000 -0400
13045@@ -161,7 +161,7 @@ static void __cpuinit trap_init_f00f_bug
13046 * Update the IDT descriptor and reload the IDT so that
13047 * it uses the read-only mapped virtual address.
13048 */
13049- idt_descr.address = fix_to_virt(FIX_F00F_IDT);
13050+ idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
13051 load_idt(&idt_descr);
13052 }
13053 #endif
13054diff -urNp linux-2.6.39.1/arch/x86/kernel/cpu/Makefile linux-2.6.39.1/arch/x86/kernel/cpu/Makefile
13055--- linux-2.6.39.1/arch/x86/kernel/cpu/Makefile 2011-05-19 00:06:34.000000000 -0400
13056+++ linux-2.6.39.1/arch/x86/kernel/cpu/Makefile 2011-05-22 19:36:30.000000000 -0400
13057@@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg
13058 CFLAGS_REMOVE_perf_event.o = -pg
13059 endif
13060
13061-# Make sure load_percpu_segment has no stackprotector
13062-nostackp := $(call cc-option, -fno-stack-protector)
13063-CFLAGS_common.o := $(nostackp)
13064-
13065 obj-y := intel_cacheinfo.o scattered.o topology.o
13066 obj-y += proc.o capflags.o powerflags.o common.o
13067 obj-y += vmware.o hypervisor.o sched.o mshyperv.o
13068diff -urNp linux-2.6.39.1/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.39.1/arch/x86/kernel/cpu/mcheck/mce.c
13069--- linux-2.6.39.1/arch/x86/kernel/cpu/mcheck/mce.c 2011-05-19 00:06:34.000000000 -0400
13070+++ linux-2.6.39.1/arch/x86/kernel/cpu/mcheck/mce.c 2011-05-22 19:36:30.000000000 -0400
13071@@ -46,6 +46,7 @@
13072 #include <asm/ipi.h>
13073 #include <asm/mce.h>
13074 #include <asm/msr.h>
13075+#include <asm/local.h>
13076
13077 #include "mce-internal.h"
13078
13079@@ -220,7 +221,7 @@ static void print_mce(struct mce *m)
13080 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
13081 m->cs, m->ip);
13082
13083- if (m->cs == __KERNEL_CS)
13084+ if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
13085 print_symbol("{%s}", m->ip);
13086 pr_cont("\n");
13087 }
13088@@ -244,10 +245,10 @@ static void print_mce(struct mce *m)
13089
13090 #define PANIC_TIMEOUT 5 /* 5 seconds */
13091
13092-static atomic_t mce_paniced;
13093+static atomic_unchecked_t mce_paniced;
13094
13095 static int fake_panic;
13096-static atomic_t mce_fake_paniced;
13097+static atomic_unchecked_t mce_fake_paniced;
13098
13099 /* Panic in progress. Enable interrupts and wait for final IPI */
13100 static void wait_for_panic(void)
13101@@ -271,7 +272,7 @@ static void mce_panic(char *msg, struct
13102 /*
13103 * Make sure only one CPU runs in machine check panic
13104 */
13105- if (atomic_inc_return(&mce_paniced) > 1)
13106+ if (atomic_inc_return_unchecked(&mce_paniced) > 1)
13107 wait_for_panic();
13108 barrier();
13109
13110@@ -279,7 +280,7 @@ static void mce_panic(char *msg, struct
13111 console_verbose();
13112 } else {
13113 /* Don't log too much for fake panic */
13114- if (atomic_inc_return(&mce_fake_paniced) > 1)
13115+ if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
13116 return;
13117 }
13118 /* First print corrected ones that are still unlogged */
13119@@ -647,7 +648,7 @@ static int mce_timed_out(u64 *t)
13120 * might have been modified by someone else.
13121 */
13122 rmb();
13123- if (atomic_read(&mce_paniced))
13124+ if (atomic_read_unchecked(&mce_paniced))
13125 wait_for_panic();
13126 if (!monarch_timeout)
13127 goto out;
13128@@ -1461,14 +1462,14 @@ void __cpuinit mcheck_cpu_init(struct cp
13129 */
13130
13131 static DEFINE_SPINLOCK(mce_state_lock);
13132-static int open_count; /* #times opened */
13133+static local_t open_count; /* #times opened */
13134 static int open_exclu; /* already open exclusive? */
13135
13136 static int mce_open(struct inode *inode, struct file *file)
13137 {
13138 spin_lock(&mce_state_lock);
13139
13140- if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
13141+ if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) {
13142 spin_unlock(&mce_state_lock);
13143
13144 return -EBUSY;
13145@@ -1476,7 +1477,7 @@ static int mce_open(struct inode *inode,
13146
13147 if (file->f_flags & O_EXCL)
13148 open_exclu = 1;
13149- open_count++;
13150+ local_inc(&open_count);
13151
13152 spin_unlock(&mce_state_lock);
13153
13154@@ -1487,7 +1488,7 @@ static int mce_release(struct inode *ino
13155 {
13156 spin_lock(&mce_state_lock);
13157
13158- open_count--;
13159+ local_dec(&open_count);
13160 open_exclu = 0;
13161
13162 spin_unlock(&mce_state_lock);
13163@@ -2174,7 +2175,7 @@ struct dentry *mce_get_debugfs_dir(void)
13164 static void mce_reset(void)
13165 {
13166 cpu_missing = 0;
13167- atomic_set(&mce_fake_paniced, 0);
13168+ atomic_set_unchecked(&mce_fake_paniced, 0);
13169 atomic_set(&mce_executing, 0);
13170 atomic_set(&mce_callin, 0);
13171 atomic_set(&global_nwo, 0);
13172diff -urNp linux-2.6.39.1/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.39.1/arch/x86/kernel/cpu/mtrr/main.c
13173--- linux-2.6.39.1/arch/x86/kernel/cpu/mtrr/main.c 2011-05-19 00:06:34.000000000 -0400
13174+++ linux-2.6.39.1/arch/x86/kernel/cpu/mtrr/main.c 2011-05-22 19:36:30.000000000 -0400
13175@@ -62,7 +62,7 @@ static DEFINE_MUTEX(mtrr_mutex);
13176 u64 size_or_mask, size_and_mask;
13177 static bool mtrr_aps_delayed_init;
13178
13179-static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
13180+static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
13181
13182 const struct mtrr_ops *mtrr_if;
13183
13184diff -urNp linux-2.6.39.1/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.39.1/arch/x86/kernel/cpu/mtrr/mtrr.h
13185--- linux-2.6.39.1/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-05-19 00:06:34.000000000 -0400
13186+++ linux-2.6.39.1/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-05-22 19:36:30.000000000 -0400
13187@@ -12,19 +12,19 @@
13188 extern unsigned int mtrr_usage_table[MTRR_MAX_VAR_RANGES];
13189
13190 struct mtrr_ops {
13191- u32 vendor;
13192- u32 use_intel_if;
13193- void (*set)(unsigned int reg, unsigned long base,
13194+ const u32 vendor;
13195+ const u32 use_intel_if;
13196+ void (* const set)(unsigned int reg, unsigned long base,
13197 unsigned long size, mtrr_type type);
13198- void (*set_all)(void);
13199+ void (* const set_all)(void);
13200
13201- void (*get)(unsigned int reg, unsigned long *base,
13202+ void (* const get)(unsigned int reg, unsigned long *base,
13203 unsigned long *size, mtrr_type *type);
13204- int (*get_free_region)(unsigned long base, unsigned long size,
13205+ int (* const get_free_region)(unsigned long base, unsigned long size,
13206 int replace_reg);
13207- int (*validate_add_page)(unsigned long base, unsigned long size,
13208+ int (* const validate_add_page)(unsigned long base, unsigned long size,
13209 unsigned int type);
13210- int (*have_wrcomb)(void);
13211+ int (* const have_wrcomb)(void);
13212 };
13213
13214 extern int generic_get_free_region(unsigned long base, unsigned long size,
13215diff -urNp linux-2.6.39.1/arch/x86/kernel/cpu/perf_event.c linux-2.6.39.1/arch/x86/kernel/cpu/perf_event.c
13216--- linux-2.6.39.1/arch/x86/kernel/cpu/perf_event.c 2011-05-19 00:06:34.000000000 -0400
13217+++ linux-2.6.39.1/arch/x86/kernel/cpu/perf_event.c 2011-05-22 19:36:30.000000000 -0400
13218@@ -774,6 +774,8 @@ static int x86_schedule_events(struct cp
13219 int i, j, w, wmax, num = 0;
13220 struct hw_perf_event *hwc;
13221
13222+ pax_track_stack();
13223+
13224 bitmap_zero(used_mask, X86_PMC_IDX_MAX);
13225
13226 for (i = 0; i < n; i++) {
13227@@ -1878,7 +1880,7 @@ perf_callchain_user(struct perf_callchai
13228 break;
13229
13230 perf_callchain_store(entry, frame.return_address);
13231- fp = frame.next_frame;
13232+ fp = (__force const void __user *)frame.next_frame;
13233 }
13234 }
13235
13236diff -urNp linux-2.6.39.1/arch/x86/kernel/crash.c linux-2.6.39.1/arch/x86/kernel/crash.c
13237--- linux-2.6.39.1/arch/x86/kernel/crash.c 2011-05-19 00:06:34.000000000 -0400
13238+++ linux-2.6.39.1/arch/x86/kernel/crash.c 2011-05-22 19:36:30.000000000 -0400
13239@@ -42,7 +42,7 @@ static void kdump_nmi_callback(int cpu,
13240 regs = args->regs;
13241
13242 #ifdef CONFIG_X86_32
13243- if (!user_mode_vm(regs)) {
13244+ if (!user_mode(regs)) {
13245 crash_fixup_ss_esp(&fixed_regs, regs);
13246 regs = &fixed_regs;
13247 }
13248diff -urNp linux-2.6.39.1/arch/x86/kernel/doublefault_32.c linux-2.6.39.1/arch/x86/kernel/doublefault_32.c
13249--- linux-2.6.39.1/arch/x86/kernel/doublefault_32.c 2011-05-19 00:06:34.000000000 -0400
13250+++ linux-2.6.39.1/arch/x86/kernel/doublefault_32.c 2011-05-22 19:36:30.000000000 -0400
13251@@ -11,7 +11,7 @@
13252
13253 #define DOUBLEFAULT_STACKSIZE (1024)
13254 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
13255-#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
13256+#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
13257
13258 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
13259
13260@@ -21,7 +21,7 @@ static void doublefault_fn(void)
13261 unsigned long gdt, tss;
13262
13263 store_gdt(&gdt_desc);
13264- gdt = gdt_desc.address;
13265+ gdt = (unsigned long)gdt_desc.address;
13266
13267 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
13268
13269@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
13270 /* 0x2 bit is always set */
13271 .flags = X86_EFLAGS_SF | 0x2,
13272 .sp = STACK_START,
13273- .es = __USER_DS,
13274+ .es = __KERNEL_DS,
13275 .cs = __KERNEL_CS,
13276 .ss = __KERNEL_DS,
13277- .ds = __USER_DS,
13278+ .ds = __KERNEL_DS,
13279 .fs = __KERNEL_PERCPU,
13280
13281 .__cr3 = __pa_nodebug(swapper_pg_dir),
13282diff -urNp linux-2.6.39.1/arch/x86/kernel/dumpstack_32.c linux-2.6.39.1/arch/x86/kernel/dumpstack_32.c
13283--- linux-2.6.39.1/arch/x86/kernel/dumpstack_32.c 2011-05-19 00:06:34.000000000 -0400
13284+++ linux-2.6.39.1/arch/x86/kernel/dumpstack_32.c 2011-05-22 19:36:30.000000000 -0400
13285@@ -38,15 +38,13 @@ void dump_trace(struct task_struct *task
13286 bp = stack_frame(task, regs);
13287
13288 for (;;) {
13289- struct thread_info *context;
13290+ void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
13291
13292- context = (struct thread_info *)
13293- ((unsigned long)stack & (~(THREAD_SIZE - 1)));
13294- bp = ops->walk_stack(context, stack, bp, ops, data, NULL, &graph);
13295+ bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
13296
13297- stack = (unsigned long *)context->previous_esp;
13298- if (!stack)
13299+ if (stack_start == task_stack_page(task))
13300 break;
13301+ stack = *(unsigned long **)stack_start;
13302 if (ops->stack(data, "IRQ") < 0)
13303 break;
13304 touch_nmi_watchdog();
13305@@ -96,21 +94,22 @@ void show_registers(struct pt_regs *regs
13306 * When in-kernel, we also print out the stack and code at the
13307 * time of the fault..
13308 */
13309- if (!user_mode_vm(regs)) {
13310+ if (!user_mode(regs)) {
13311 unsigned int code_prologue = code_bytes * 43 / 64;
13312 unsigned int code_len = code_bytes;
13313 unsigned char c;
13314 u8 *ip;
13315+ unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
13316
13317 printk(KERN_EMERG "Stack:\n");
13318 show_stack_log_lvl(NULL, regs, &regs->sp, 0, KERN_EMERG);
13319
13320 printk(KERN_EMERG "Code: ");
13321
13322- ip = (u8 *)regs->ip - code_prologue;
13323+ ip = (u8 *)regs->ip - code_prologue + cs_base;
13324 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
13325 /* try starting at IP */
13326- ip = (u8 *)regs->ip;
13327+ ip = (u8 *)regs->ip + cs_base;
13328 code_len = code_len - code_prologue + 1;
13329 }
13330 for (i = 0; i < code_len; i++, ip++) {
13331@@ -119,7 +118,7 @@ void show_registers(struct pt_regs *regs
13332 printk(" Bad EIP value.");
13333 break;
13334 }
13335- if (ip == (u8 *)regs->ip)
13336+ if (ip == (u8 *)regs->ip + cs_base)
13337 printk("<%02x> ", c);
13338 else
13339 printk("%02x ", c);
13340@@ -132,6 +131,7 @@ int is_valid_bugaddr(unsigned long ip)
13341 {
13342 unsigned short ud2;
13343
13344+ ip = ktla_ktva(ip);
13345 if (ip < PAGE_OFFSET)
13346 return 0;
13347 if (probe_kernel_address((unsigned short *)ip, ud2))
13348diff -urNp linux-2.6.39.1/arch/x86/kernel/dumpstack_64.c linux-2.6.39.1/arch/x86/kernel/dumpstack_64.c
13349--- linux-2.6.39.1/arch/x86/kernel/dumpstack_64.c 2011-05-19 00:06:34.000000000 -0400
13350+++ linux-2.6.39.1/arch/x86/kernel/dumpstack_64.c 2011-05-22 19:36:30.000000000 -0400
13351@@ -147,9 +147,9 @@ void dump_trace(struct task_struct *task
13352 unsigned long *irq_stack_end =
13353 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
13354 unsigned used = 0;
13355- struct thread_info *tinfo;
13356 int graph = 0;
13357 unsigned long dummy;
13358+ void *stack_start;
13359
13360 if (!task)
13361 task = current;
13362@@ -167,10 +167,10 @@ void dump_trace(struct task_struct *task
13363 * current stack address. If the stacks consist of nested
13364 * exceptions
13365 */
13366- tinfo = task_thread_info(task);
13367 for (;;) {
13368 char *id;
13369 unsigned long *estack_end;
13370+
13371 estack_end = in_exception_stack(cpu, (unsigned long)stack,
13372 &used, &id);
13373
13374@@ -178,7 +178,7 @@ void dump_trace(struct task_struct *task
13375 if (ops->stack(data, id) < 0)
13376 break;
13377
13378- bp = ops->walk_stack(tinfo, stack, bp, ops,
13379+ bp = ops->walk_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
13380 data, estack_end, &graph);
13381 ops->stack(data, "<EOE>");
13382 /*
13383@@ -197,7 +197,7 @@ void dump_trace(struct task_struct *task
13384 if (in_irq_stack(stack, irq_stack, irq_stack_end)) {
13385 if (ops->stack(data, "IRQ") < 0)
13386 break;
13387- bp = ops->walk_stack(tinfo, stack, bp,
13388+ bp = ops->walk_stack(task, irq_stack, stack, bp,
13389 ops, data, irq_stack_end, &graph);
13390 /*
13391 * We link to the next stack (which would be
13392@@ -218,7 +218,8 @@ void dump_trace(struct task_struct *task
13393 /*
13394 * This handles the process stack:
13395 */
13396- bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
13397+ stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
13398+ bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
13399 put_cpu();
13400 }
13401 EXPORT_SYMBOL(dump_trace);
13402diff -urNp linux-2.6.39.1/arch/x86/kernel/dumpstack.c linux-2.6.39.1/arch/x86/kernel/dumpstack.c
13403--- linux-2.6.39.1/arch/x86/kernel/dumpstack.c 2011-05-19 00:06:34.000000000 -0400
13404+++ linux-2.6.39.1/arch/x86/kernel/dumpstack.c 2011-05-22 19:41:32.000000000 -0400
13405@@ -2,6 +2,9 @@
13406 * Copyright (C) 1991, 1992 Linus Torvalds
13407 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
13408 */
13409+#ifdef CONFIG_GRKERNSEC_HIDESYM
13410+#define __INCLUDED_BY_HIDESYM 1
13411+#endif
13412 #include <linux/kallsyms.h>
13413 #include <linux/kprobes.h>
13414 #include <linux/uaccess.h>
13415@@ -35,9 +38,8 @@ void printk_address(unsigned long addres
13416 static void
13417 print_ftrace_graph_addr(unsigned long addr, void *data,
13418 const struct stacktrace_ops *ops,
13419- struct thread_info *tinfo, int *graph)
13420+ struct task_struct *task, int *graph)
13421 {
13422- struct task_struct *task = tinfo->task;
13423 unsigned long ret_addr;
13424 int index = task->curr_ret_stack;
13425
13426@@ -58,7 +60,7 @@ print_ftrace_graph_addr(unsigned long ad
13427 static inline void
13428 print_ftrace_graph_addr(unsigned long addr, void *data,
13429 const struct stacktrace_ops *ops,
13430- struct thread_info *tinfo, int *graph)
13431+ struct task_struct *task, int *graph)
13432 { }
13433 #endif
13434
13435@@ -69,10 +71,8 @@ print_ftrace_graph_addr(unsigned long ad
13436 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
13437 */
13438
13439-static inline int valid_stack_ptr(struct thread_info *tinfo,
13440- void *p, unsigned int size, void *end)
13441+static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
13442 {
13443- void *t = tinfo;
13444 if (end) {
13445 if (p < end && p >= (end-THREAD_SIZE))
13446 return 1;
13447@@ -83,14 +83,14 @@ static inline int valid_stack_ptr(struct
13448 }
13449
13450 unsigned long
13451-print_context_stack(struct thread_info *tinfo,
13452+print_context_stack(struct task_struct *task, void *stack_start,
13453 unsigned long *stack, unsigned long bp,
13454 const struct stacktrace_ops *ops, void *data,
13455 unsigned long *end, int *graph)
13456 {
13457 struct stack_frame *frame = (struct stack_frame *)bp;
13458
13459- while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
13460+ while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
13461 unsigned long addr;
13462
13463 addr = *stack;
13464@@ -102,7 +102,7 @@ print_context_stack(struct thread_info *
13465 } else {
13466 ops->address(data, addr, 0);
13467 }
13468- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
13469+ print_ftrace_graph_addr(addr, data, ops, task, graph);
13470 }
13471 stack++;
13472 }
13473@@ -111,7 +111,7 @@ print_context_stack(struct thread_info *
13474 EXPORT_SYMBOL_GPL(print_context_stack);
13475
13476 unsigned long
13477-print_context_stack_bp(struct thread_info *tinfo,
13478+print_context_stack_bp(struct task_struct *task, void *stack_start,
13479 unsigned long *stack, unsigned long bp,
13480 const struct stacktrace_ops *ops, void *data,
13481 unsigned long *end, int *graph)
13482@@ -119,7 +119,7 @@ print_context_stack_bp(struct thread_inf
13483 struct stack_frame *frame = (struct stack_frame *)bp;
13484 unsigned long *ret_addr = &frame->return_address;
13485
13486- while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {
13487+ while (valid_stack_ptr(stack_start, ret_addr, sizeof(*ret_addr), end)) {
13488 unsigned long addr = *ret_addr;
13489
13490 if (!__kernel_text_address(addr))
13491@@ -128,7 +128,7 @@ print_context_stack_bp(struct thread_inf
13492 ops->address(data, addr, 1);
13493 frame = frame->next_frame;
13494 ret_addr = &frame->return_address;
13495- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
13496+ print_ftrace_graph_addr(addr, data, ops, task, graph);
13497 }
13498
13499 return (unsigned long)frame;
13500@@ -202,7 +202,7 @@ void dump_stack(void)
13501
13502 bp = stack_frame(current, NULL);
13503 printk("Pid: %d, comm: %.20s %s %s %.*s\n",
13504- current->pid, current->comm, print_tainted(),
13505+ task_pid_nr(current), current->comm, print_tainted(),
13506 init_utsname()->release,
13507 (int)strcspn(init_utsname()->version, " "),
13508 init_utsname()->version);
13509@@ -238,6 +238,8 @@ unsigned __kprobes long oops_begin(void)
13510 }
13511 EXPORT_SYMBOL_GPL(oops_begin);
13512
13513+extern void gr_handle_kernel_exploit(void);
13514+
13515 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
13516 {
13517 if (regs && kexec_should_crash(current))
13518@@ -259,7 +261,10 @@ void __kprobes oops_end(unsigned long fl
13519 panic("Fatal exception in interrupt");
13520 if (panic_on_oops)
13521 panic("Fatal exception");
13522- do_exit(signr);
13523+
13524+ gr_handle_kernel_exploit();
13525+
13526+ do_group_exit(signr);
13527 }
13528
13529 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
13530@@ -286,7 +291,7 @@ int __kprobes __die(const char *str, str
13531
13532 show_registers(regs);
13533 #ifdef CONFIG_X86_32
13534- if (user_mode_vm(regs)) {
13535+ if (user_mode(regs)) {
13536 sp = regs->sp;
13537 ss = regs->ss & 0xffff;
13538 } else {
13539@@ -314,7 +319,7 @@ void die(const char *str, struct pt_regs
13540 unsigned long flags = oops_begin();
13541 int sig = SIGSEGV;
13542
13543- if (!user_mode_vm(regs))
13544+ if (!user_mode(regs))
13545 report_bug(regs->ip, regs);
13546
13547 if (__die(str, regs, err))
13548diff -urNp linux-2.6.39.1/arch/x86/kernel/early_printk.c linux-2.6.39.1/arch/x86/kernel/early_printk.c
13549--- linux-2.6.39.1/arch/x86/kernel/early_printk.c 2011-05-19 00:06:34.000000000 -0400
13550+++ linux-2.6.39.1/arch/x86/kernel/early_printk.c 2011-05-22 19:36:30.000000000 -0400
13551@@ -7,6 +7,7 @@
13552 #include <linux/pci_regs.h>
13553 #include <linux/pci_ids.h>
13554 #include <linux/errno.h>
13555+#include <linux/sched.h>
13556 #include <asm/io.h>
13557 #include <asm/processor.h>
13558 #include <asm/fcntl.h>
13559@@ -179,6 +180,8 @@ asmlinkage void early_printk(const char
13560 int n;
13561 va_list ap;
13562
13563+ pax_track_stack();
13564+
13565 va_start(ap, fmt);
13566 n = vscnprintf(buf, sizeof(buf), fmt, ap);
13567 early_console->write(early_console, buf, n);
13568diff -urNp linux-2.6.39.1/arch/x86/kernel/entry_32.S linux-2.6.39.1/arch/x86/kernel/entry_32.S
13569--- linux-2.6.39.1/arch/x86/kernel/entry_32.S 2011-05-19 00:06:34.000000000 -0400
13570+++ linux-2.6.39.1/arch/x86/kernel/entry_32.S 2011-05-23 17:07:00.000000000 -0400
13571@@ -185,13 +185,146 @@
13572 /*CFI_REL_OFFSET gs, PT_GS*/
13573 .endm
13574 .macro SET_KERNEL_GS reg
13575+
13576+#ifdef CONFIG_CC_STACKPROTECTOR
13577 movl $(__KERNEL_STACK_CANARY), \reg
13578+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
13579+ movl $(__USER_DS), \reg
13580+#else
13581+ xorl \reg, \reg
13582+#endif
13583+
13584 movl \reg, %gs
13585 .endm
13586
13587 #endif /* CONFIG_X86_32_LAZY_GS */
13588
13589-.macro SAVE_ALL
13590+.macro pax_enter_kernel
13591+#ifdef CONFIG_PAX_KERNEXEC
13592+ call pax_enter_kernel
13593+#endif
13594+.endm
13595+
13596+.macro pax_exit_kernel
13597+#ifdef CONFIG_PAX_KERNEXEC
13598+ call pax_exit_kernel
13599+#endif
13600+.endm
13601+
13602+#ifdef CONFIG_PAX_KERNEXEC
13603+ENTRY(pax_enter_kernel)
13604+#ifdef CONFIG_PARAVIRT
13605+ pushl %eax
13606+ pushl %ecx
13607+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
13608+ mov %eax, %esi
13609+#else
13610+ mov %cr0, %esi
13611+#endif
13612+ bts $16, %esi
13613+ jnc 1f
13614+ mov %cs, %esi
13615+ cmp $__KERNEL_CS, %esi
13616+ jz 3f
13617+ ljmp $__KERNEL_CS, $3f
13618+1: ljmp $__KERNEXEC_KERNEL_CS, $2f
13619+2:
13620+#ifdef CONFIG_PARAVIRT
13621+ mov %esi, %eax
13622+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
13623+#else
13624+ mov %esi, %cr0
13625+#endif
13626+3:
13627+#ifdef CONFIG_PARAVIRT
13628+ popl %ecx
13629+ popl %eax
13630+#endif
13631+ ret
13632+ENDPROC(pax_enter_kernel)
13633+
13634+ENTRY(pax_exit_kernel)
13635+#ifdef CONFIG_PARAVIRT
13636+ pushl %eax
13637+ pushl %ecx
13638+#endif
13639+ mov %cs, %esi
13640+ cmp $__KERNEXEC_KERNEL_CS, %esi
13641+ jnz 2f
13642+#ifdef CONFIG_PARAVIRT
13643+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
13644+ mov %eax, %esi
13645+#else
13646+ mov %cr0, %esi
13647+#endif
13648+ btr $16, %esi
13649+ ljmp $__KERNEL_CS, $1f
13650+1:
13651+#ifdef CONFIG_PARAVIRT
13652+ mov %esi, %eax
13653+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
13654+#else
13655+ mov %esi, %cr0
13656+#endif
13657+2:
13658+#ifdef CONFIG_PARAVIRT
13659+ popl %ecx
13660+ popl %eax
13661+#endif
13662+ ret
13663+ENDPROC(pax_exit_kernel)
13664+#endif
13665+
13666+.macro pax_erase_kstack
13667+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13668+ call pax_erase_kstack
13669+#endif
13670+.endm
13671+
13672+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13673+/*
13674+ * ebp: thread_info
13675+ * ecx, edx: can be clobbered
13676+ */
13677+ENTRY(pax_erase_kstack)
13678+ pushl %edi
13679+ pushl %eax
13680+
13681+ mov TI_lowest_stack(%ebp), %edi
13682+ mov $-0xBEEF, %eax
13683+ std
13684+
13685+1: mov %edi, %ecx
13686+ and $THREAD_SIZE_asm - 1, %ecx
13687+ shr $2, %ecx
13688+ repne scasl
13689+ jecxz 2f
13690+
13691+ cmp $2*16, %ecx
13692+ jc 2f
13693+
13694+ mov $2*16, %ecx
13695+ repe scasl
13696+ jecxz 2f
13697+ jne 1b
13698+
13699+2: cld
13700+ mov %esp, %ecx
13701+ sub %edi, %ecx
13702+ shr $2, %ecx
13703+ rep stosl
13704+
13705+ mov TI_task_thread_sp0(%ebp), %edi
13706+ sub $128, %edi
13707+ mov %edi, TI_lowest_stack(%ebp)
13708+
13709+ popl %eax
13710+ popl %edi
13711+ ret
13712+ENDPROC(pax_erase_kstack)
13713+#endif
13714+
13715+.macro __SAVE_ALL _DS
13716 cld
13717 PUSH_GS
13718 pushl_cfi %fs
13719@@ -214,7 +347,7 @@
13720 CFI_REL_OFFSET ecx, 0
13721 pushl_cfi %ebx
13722 CFI_REL_OFFSET ebx, 0
13723- movl $(__USER_DS), %edx
13724+ movl $\_DS, %edx
13725 movl %edx, %ds
13726 movl %edx, %es
13727 movl $(__KERNEL_PERCPU), %edx
13728@@ -222,6 +355,15 @@
13729 SET_KERNEL_GS %edx
13730 .endm
13731
13732+.macro SAVE_ALL
13733+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
13734+ __SAVE_ALL __KERNEL_DS
13735+ pax_enter_kernel
13736+#else
13737+ __SAVE_ALL __USER_DS
13738+#endif
13739+.endm
13740+
13741 .macro RESTORE_INT_REGS
13742 popl_cfi %ebx
13743 CFI_RESTORE ebx
13744@@ -332,7 +474,15 @@ check_userspace:
13745 movb PT_CS(%esp), %al
13746 andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
13747 cmpl $USER_RPL, %eax
13748+
13749+#ifdef CONFIG_PAX_KERNEXEC
13750+ jae resume_userspace
13751+
13752+ PAX_EXIT_KERNEL
13753+ jmp resume_kernel
13754+#else
13755 jb resume_kernel # not returning to v8086 or userspace
13756+#endif
13757
13758 ENTRY(resume_userspace)
13759 LOCKDEP_SYS_EXIT
13760@@ -344,7 +494,7 @@ ENTRY(resume_userspace)
13761 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
13762 # int/exception return?
13763 jne work_pending
13764- jmp restore_all
13765+ jmp restore_all_pax
13766 END(ret_from_exception)
13767
13768 #ifdef CONFIG_PREEMPT
13769@@ -394,23 +544,34 @@ sysenter_past_esp:
13770 /*CFI_REL_OFFSET cs, 0*/
13771 /*
13772 * Push current_thread_info()->sysenter_return to the stack.
13773- * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
13774- * pushed above; +8 corresponds to copy_thread's esp0 setting.
13775 */
13776- pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+8+4*4)(%esp)
13777+ pushl_cfi $0
13778 CFI_REL_OFFSET eip, 0
13779
13780 pushl_cfi %eax
13781 SAVE_ALL
13782+ GET_THREAD_INFO(%ebp)
13783+ movl TI_sysenter_return(%ebp),%ebp
13784+ movl %ebp,PT_EIP(%esp)
13785 ENABLE_INTERRUPTS(CLBR_NONE)
13786
13787 /*
13788 * Load the potential sixth argument from user stack.
13789 * Careful about security.
13790 */
13791+ movl PT_OLDESP(%esp),%ebp
13792+
13793+#ifdef CONFIG_PAX_MEMORY_UDEREF
13794+ mov PT_OLDSS(%esp),%ds
13795+1: movl %ds:(%ebp),%ebp
13796+ push %ss
13797+ pop %ds
13798+#else
13799 cmpl $__PAGE_OFFSET-3,%ebp
13800 jae syscall_fault
13801 1: movl (%ebp),%ebp
13802+#endif
13803+
13804 movl %ebp,PT_EBP(%esp)
13805 .section __ex_table,"a"
13806 .align 4
13807@@ -433,12 +594,23 @@ sysenter_do_call:
13808 testl $_TIF_ALLWORK_MASK, %ecx
13809 jne sysexit_audit
13810 sysenter_exit:
13811+
13812+#ifdef CONFIG_PAX_RANDKSTACK
13813+ pushl_cfi %eax
13814+ call pax_randomize_kstack
13815+ popl_cfi %eax
13816+#endif
13817+
13818+ pax_erase_kstack
13819+
13820 /* if something modifies registers it must also disable sysexit */
13821 movl PT_EIP(%esp), %edx
13822 movl PT_OLDESP(%esp), %ecx
13823 xorl %ebp,%ebp
13824 TRACE_IRQS_ON
13825 1: mov PT_FS(%esp), %fs
13826+2: mov PT_DS(%esp), %ds
13827+3: mov PT_ES(%esp), %es
13828 PTGS_TO_GS
13829 ENABLE_INTERRUPTS_SYSEXIT
13830
13831@@ -455,6 +627,9 @@ sysenter_audit:
13832 movl %eax,%edx /* 2nd arg: syscall number */
13833 movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
13834 call audit_syscall_entry
13835+
13836+ pax_erase_kstack
13837+
13838 pushl_cfi %ebx
13839 movl PT_EAX(%esp),%eax /* reload syscall number */
13840 jmp sysenter_do_call
13841@@ -481,11 +656,17 @@ sysexit_audit:
13842
13843 CFI_ENDPROC
13844 .pushsection .fixup,"ax"
13845-2: movl $0,PT_FS(%esp)
13846+4: movl $0,PT_FS(%esp)
13847+ jmp 1b
13848+5: movl $0,PT_DS(%esp)
13849+ jmp 1b
13850+6: movl $0,PT_ES(%esp)
13851 jmp 1b
13852 .section __ex_table,"a"
13853 .align 4
13854- .long 1b,2b
13855+ .long 1b,4b
13856+ .long 2b,5b
13857+ .long 3b,6b
13858 .popsection
13859 PTGS_TO_GS_EX
13860 ENDPROC(ia32_sysenter_target)
13861@@ -518,6 +699,14 @@ syscall_exit:
13862 testl $_TIF_ALLWORK_MASK, %ecx # current->work
13863 jne syscall_exit_work
13864
13865+restore_all_pax:
13866+
13867+#ifdef CONFIG_PAX_RANDKSTACK
13868+ call pax_randomize_kstack
13869+#endif
13870+
13871+ pax_erase_kstack
13872+
13873 restore_all:
13874 TRACE_IRQS_IRET
13875 restore_all_notrace:
13876@@ -577,14 +766,21 @@ ldt_ss:
13877 * compensating for the offset by changing to the ESPFIX segment with
13878 * a base address that matches for the difference.
13879 */
13880-#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
13881+#define GDT_ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)(%ebx)
13882 mov %esp, %edx /* load kernel esp */
13883 mov PT_OLDESP(%esp), %eax /* load userspace esp */
13884 mov %dx, %ax /* eax: new kernel esp */
13885 sub %eax, %edx /* offset (low word is 0) */
13886+#ifdef CONFIG_SMP
13887+ movl PER_CPU_VAR(cpu_number), %ebx
13888+ shll $PAGE_SHIFT_asm, %ebx
13889+ addl $cpu_gdt_table, %ebx
13890+#else
13891+ movl $cpu_gdt_table, %ebx
13892+#endif
13893 shr $16, %edx
13894- mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */
13895- mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */
13896+ mov %dl, 4 + GDT_ESPFIX_SS /* bits 16..23 */
13897+ mov %dh, 7 + GDT_ESPFIX_SS /* bits 24..31 */
13898 pushl_cfi $__ESPFIX_SS
13899 pushl_cfi %eax /* new kernel esp */
13900 /* Disable interrupts, but do not irqtrace this section: we
13901@@ -613,29 +809,23 @@ work_resched:
13902 movl TI_flags(%ebp), %ecx
13903 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
13904 # than syscall tracing?
13905- jz restore_all
13906+ jz restore_all_pax
13907 testb $_TIF_NEED_RESCHED, %cl
13908 jnz work_resched
13909
13910 work_notifysig: # deal with pending signals and
13911 # notify-resume requests
13912+ movl %esp, %eax
13913 #ifdef CONFIG_VM86
13914 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
13915- movl %esp, %eax
13916- jne work_notifysig_v86 # returning to kernel-space or
13917+ jz 1f # returning to kernel-space or
13918 # vm86-space
13919- xorl %edx, %edx
13920- call do_notify_resume
13921- jmp resume_userspace_sig
13922
13923- ALIGN
13924-work_notifysig_v86:
13925 pushl_cfi %ecx # save ti_flags for do_notify_resume
13926 call save_v86_state # %eax contains pt_regs pointer
13927 popl_cfi %ecx
13928 movl %eax, %esp
13929-#else
13930- movl %esp, %eax
13931+1:
13932 #endif
13933 xorl %edx, %edx
13934 call do_notify_resume
13935@@ -648,6 +838,9 @@ syscall_trace_entry:
13936 movl $-ENOSYS,PT_EAX(%esp)
13937 movl %esp, %eax
13938 call syscall_trace_enter
13939+
13940+ pax_erase_kstack
13941+
13942 /* What it returned is what we'll actually use. */
13943 cmpl $(nr_syscalls), %eax
13944 jnae syscall_call
13945@@ -670,6 +863,10 @@ END(syscall_exit_work)
13946
13947 RING0_INT_FRAME # can't unwind into user space anyway
13948 syscall_fault:
13949+#ifdef CONFIG_PAX_MEMORY_UDEREF
13950+ push %ss
13951+ pop %ds
13952+#endif
13953 GET_THREAD_INFO(%ebp)
13954 movl $-EFAULT,PT_EAX(%esp)
13955 jmp resume_userspace
13956@@ -752,6 +949,36 @@ ptregs_clone:
13957 CFI_ENDPROC
13958 ENDPROC(ptregs_clone)
13959
13960+ ALIGN;
13961+ENTRY(kernel_execve)
13962+ CFI_STARTPROC
13963+ pushl_cfi %ebp
13964+ sub $PT_OLDSS+4,%esp
13965+ pushl_cfi %edi
13966+ pushl_cfi %ecx
13967+ pushl_cfi %eax
13968+ lea 3*4(%esp),%edi
13969+ mov $PT_OLDSS/4+1,%ecx
13970+ xorl %eax,%eax
13971+ rep stosl
13972+ popl_cfi %eax
13973+ popl_cfi %ecx
13974+ popl_cfi %edi
13975+ movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
13976+ pushl_cfi %esp
13977+ call sys_execve
13978+ add $4,%esp
13979+ CFI_ADJUST_CFA_OFFSET -4
13980+ GET_THREAD_INFO(%ebp)
13981+ test %eax,%eax
13982+ jz syscall_exit
13983+ add $PT_OLDSS+4,%esp
13984+ CFI_ADJUST_CFA_OFFSET -PT_OLDSS-4
13985+ popl_cfi %ebp
13986+ ret
13987+ CFI_ENDPROC
13988+ENDPROC(kernel_execve)
13989+
13990 .macro FIXUP_ESPFIX_STACK
13991 /*
13992 * Switch back for ESPFIX stack to the normal zerobased stack
13993@@ -761,8 +988,15 @@ ENDPROC(ptregs_clone)
13994 * normal stack and adjusts ESP with the matching offset.
13995 */
13996 /* fixup the stack */
13997- mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
13998- mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
13999+#ifdef CONFIG_SMP
14000+ movl PER_CPU_VAR(cpu_number), %ebx
14001+ shll $PAGE_SHIFT_asm, %ebx
14002+ addl $cpu_gdt_table, %ebx
14003+#else
14004+ movl $cpu_gdt_table, %ebx
14005+#endif
14006+ mov 4 + GDT_ESPFIX_SS, %al /* bits 16..23 */
14007+ mov 7 + GDT_ESPFIX_SS, %ah /* bits 24..31 */
14008 shl $16, %eax
14009 addl %esp, %eax /* the adjusted stack pointer */
14010 pushl_cfi $__KERNEL_DS
14011@@ -1213,7 +1447,6 @@ return_to_handler:
14012 jmp *%ecx
14013 #endif
14014
14015-.section .rodata,"a"
14016 #include "syscall_table_32.S"
14017
14018 syscall_table_size=(.-sys_call_table)
14019@@ -1259,9 +1492,12 @@ error_code:
14020 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
14021 REG_TO_PTGS %ecx
14022 SET_KERNEL_GS %ecx
14023- movl $(__USER_DS), %ecx
14024+ movl $(__KERNEL_DS), %ecx
14025 movl %ecx, %ds
14026 movl %ecx, %es
14027+
14028+ pax_enter_kernel
14029+
14030 TRACE_IRQS_OFF
14031 movl %esp,%eax # pt_regs pointer
14032 call *%edi
14033@@ -1346,6 +1582,9 @@ nmi_stack_correct:
14034 xorl %edx,%edx # zero error code
14035 movl %esp,%eax # pt_regs pointer
14036 call do_nmi
14037+
14038+ pax_exit_kernel
14039+
14040 jmp restore_all_notrace
14041 CFI_ENDPROC
14042
14043@@ -1382,6 +1621,9 @@ nmi_espfix_stack:
14044 FIXUP_ESPFIX_STACK # %eax == %esp
14045 xorl %edx,%edx # zero error code
14046 call do_nmi
14047+
14048+ pax_exit_kernel
14049+
14050 RESTORE_REGS
14051 lss 12+4(%esp), %esp # back to espfix stack
14052 CFI_ADJUST_CFA_OFFSET -24
14053diff -urNp linux-2.6.39.1/arch/x86/kernel/entry_64.S linux-2.6.39.1/arch/x86/kernel/entry_64.S
14054--- linux-2.6.39.1/arch/x86/kernel/entry_64.S 2011-05-19 00:06:34.000000000 -0400
14055+++ linux-2.6.39.1/arch/x86/kernel/entry_64.S 2011-05-23 17:10:49.000000000 -0400
14056@@ -53,6 +53,7 @@
14057 #include <asm/paravirt.h>
14058 #include <asm/ftrace.h>
14059 #include <asm/percpu.h>
14060+#include <asm/pgtable.h>
14061
14062 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
14063 #include <linux/elf-em.h>
14064@@ -176,6 +177,259 @@ ENTRY(native_usergs_sysret64)
14065 ENDPROC(native_usergs_sysret64)
14066 #endif /* CONFIG_PARAVIRT */
14067
14068+ .macro ljmpq sel, off
14069+#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
14070+ .byte 0x48; ljmp *1234f(%rip)
14071+ .pushsection .rodata
14072+ .align 16
14073+ 1234: .quad \off; .word \sel
14074+ .popsection
14075+#else
14076+ pushq $\sel
14077+ pushq $\off
14078+ lretq
14079+#endif
14080+ .endm
14081+
14082+ .macro pax_enter_kernel
14083+#ifdef CONFIG_PAX_KERNEXEC
14084+ call pax_enter_kernel
14085+#endif
14086+ .endm
14087+
14088+ .macro pax_exit_kernel
14089+#ifdef CONFIG_PAX_KERNEXEC
14090+ call pax_exit_kernel
14091+#endif
14092+ .endm
14093+
14094+#ifdef CONFIG_PAX_KERNEXEC
14095+ENTRY(pax_enter_kernel)
14096+ pushq %rdi
14097+
14098+#ifdef CONFIG_PARAVIRT
14099+ PV_SAVE_REGS(CLBR_RDI)
14100+#endif
14101+
14102+ GET_CR0_INTO_RDI
14103+ bts $16,%rdi
14104+ jnc 1f
14105+ mov %cs,%edi
14106+ cmp $__KERNEL_CS,%edi
14107+ jz 3f
14108+ ljmpq __KERNEL_CS,3f
14109+1: ljmpq __KERNEXEC_KERNEL_CS,2f
14110+2: SET_RDI_INTO_CR0
14111+3:
14112+
14113+#ifdef CONFIG_PARAVIRT
14114+ PV_RESTORE_REGS(CLBR_RDI)
14115+#endif
14116+
14117+ popq %rdi
14118+ retq
14119+ENDPROC(pax_enter_kernel)
14120+
14121+ENTRY(pax_exit_kernel)
14122+ pushq %rdi
14123+
14124+#ifdef CONFIG_PARAVIRT
14125+ PV_SAVE_REGS(CLBR_RDI)
14126+#endif
14127+
14128+ mov %cs,%rdi
14129+ cmp $__KERNEXEC_KERNEL_CS,%edi
14130+ jnz 2f
14131+ GET_CR0_INTO_RDI
14132+ btr $16,%rdi
14133+ ljmpq __KERNEL_CS,1f
14134+1: SET_RDI_INTO_CR0
14135+2:
14136+
14137+#ifdef CONFIG_PARAVIRT
14138+ PV_RESTORE_REGS(CLBR_RDI);
14139+#endif
14140+
14141+ popq %rdi
14142+ retq
14143+ENDPROC(pax_exit_kernel)
14144+#endif
14145+
14146+ .macro pax_enter_kernel_user
14147+#ifdef CONFIG_PAX_MEMORY_UDEREF
14148+ call pax_enter_kernel_user
14149+#endif
14150+ .endm
14151+
14152+ .macro pax_exit_kernel_user
14153+#ifdef CONFIG_PAX_MEMORY_UDEREF
14154+ call pax_exit_kernel_user
14155+#endif
14156+#ifdef CONFIG_PAX_RANDKSTACK
14157+ push %rax
14158+ call pax_randomize_kstack
14159+ pop %rax
14160+#endif
14161+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14162+ call pax_erase_kstack
14163+#endif
14164+ .endm
14165+
14166+#ifdef CONFIG_PAX_MEMORY_UDEREF
14167+ENTRY(pax_enter_kernel_user)
14168+ pushq %rdi
14169+ pushq %rbx
14170+
14171+#ifdef CONFIG_PARAVIRT
14172+ PV_SAVE_REGS(CLBR_RDI)
14173+#endif
14174+
14175+ GET_CR3_INTO_RDI
14176+ mov %rdi,%rbx
14177+ add $__START_KERNEL_map,%rbx
14178+ sub phys_base(%rip),%rbx
14179+
14180+#ifdef CONFIG_PARAVIRT
14181+ pushq %rdi
14182+ cmpl $0, pv_info+PARAVIRT_enabled
14183+ jz 1f
14184+ i = 0
14185+ .rept USER_PGD_PTRS
14186+ mov i*8(%rbx),%rsi
14187+ mov $0,%sil
14188+ lea i*8(%rbx),%rdi
14189+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
14190+ i = i + 1
14191+ .endr
14192+ jmp 2f
14193+1:
14194+#endif
14195+
14196+ i = 0
14197+ .rept USER_PGD_PTRS
14198+ movb $0,i*8(%rbx)
14199+ i = i + 1
14200+ .endr
14201+
14202+#ifdef CONFIG_PARAVIRT
14203+2: popq %rdi
14204+#endif
14205+ SET_RDI_INTO_CR3
14206+
14207+#ifdef CONFIG_PAX_KERNEXEC
14208+ GET_CR0_INTO_RDI
14209+ bts $16,%rdi
14210+ SET_RDI_INTO_CR0
14211+#endif
14212+
14213+#ifdef CONFIG_PARAVIRT
14214+ PV_RESTORE_REGS(CLBR_RDI)
14215+#endif
14216+
14217+ popq %rbx
14218+ popq %rdi
14219+ retq
14220+ENDPROC(pax_enter_kernel_user)
14221+
14222+ENTRY(pax_exit_kernel_user)
14223+ push %rdi
14224+
14225+#ifdef CONFIG_PARAVIRT
14226+ pushq %rbx
14227+ PV_SAVE_REGS(CLBR_RDI)
14228+#endif
14229+
14230+#ifdef CONFIG_PAX_KERNEXEC
14231+ GET_CR0_INTO_RDI
14232+ btr $16,%rdi
14233+ SET_RDI_INTO_CR0
14234+#endif
14235+
14236+ GET_CR3_INTO_RDI
14237+ add $__START_KERNEL_map,%rdi
14238+ sub phys_base(%rip),%rdi
14239+
14240+#ifdef CONFIG_PARAVIRT
14241+ cmpl $0, pv_info+PARAVIRT_enabled
14242+ jz 1f
14243+ mov %rdi,%rbx
14244+ i = 0
14245+ .rept USER_PGD_PTRS
14246+ mov i*8(%rbx),%rsi
14247+ mov $0x67,%sil
14248+ lea i*8(%rbx),%rdi
14249+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
14250+ i = i + 1
14251+ .endr
14252+ jmp 2f
14253+1:
14254+#endif
14255+
14256+ i = 0
14257+ .rept USER_PGD_PTRS
14258+ movb $0x67,i*8(%rdi)
14259+ i = i + 1
14260+ .endr
14261+
14262+#ifdef CONFIG_PARAVIRT
14263+2: PV_RESTORE_REGS(CLBR_RDI)
14264+ popq %rbx
14265+#endif
14266+
14267+ popq %rdi
14268+ retq
14269+ENDPROC(pax_exit_kernel_user)
14270+#endif
14271+
14272+ .macro pax_erase_kstack
14273+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14274+ call pax_erase_kstack
14275+#endif
14276+ .endm
14277+
14278+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14279+/*
14280+ * r10: thread_info
14281+ * rcx, rdx: can be clobbered
14282+ */
14283+ENTRY(pax_erase_kstack)
14284+ pushq %rdi
14285+ pushq %rax
14286+
14287+ GET_THREAD_INFO(%r10)
14288+ mov TI_lowest_stack(%r10), %rdi
14289+ mov $-0xBEEF, %rax
14290+ std
14291+
14292+1: mov %edi, %ecx
14293+ and $THREAD_SIZE_asm - 1, %ecx
14294+ shr $3, %ecx
14295+ repne scasq
14296+ jecxz 2f
14297+
14298+ cmp $2*8, %ecx
14299+ jc 2f
14300+
14301+ mov $2*8, %ecx
14302+ repe scasq
14303+ jecxz 2f
14304+ jne 1b
14305+
14306+2: cld
14307+ mov %esp, %ecx
14308+ sub %edi, %ecx
14309+ shr $3, %ecx
14310+ rep stosq
14311+
14312+ mov TI_task_thread_sp0(%r10), %rdi
14313+ sub $256, %rdi
14314+ mov %rdi, TI_lowest_stack(%r10)
14315+
14316+ popq %rax
14317+ popq %rdi
14318+ ret
14319+ENDPROC(pax_erase_kstack)
14320+#endif
14321
14322 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
14323 #ifdef CONFIG_TRACE_IRQFLAGS
14324@@ -318,7 +572,7 @@ ENTRY(save_args)
14325 leaq -RBP+8(%rsp),%rdi /* arg1 for handler */
14326 movq_cfi rbp, 8 /* push %rbp */
14327 leaq 8(%rsp), %rbp /* mov %rsp, %ebp */
14328- testl $3, CS(%rdi)
14329+ testb $3, CS(%rdi)
14330 je 1f
14331 SWAPGS
14332 /*
14333@@ -409,7 +663,7 @@ ENTRY(ret_from_fork)
14334
14335 RESTORE_REST
14336
14337- testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
14338+ testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
14339 je int_ret_from_sys_call
14340
14341 testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
14342@@ -455,7 +709,7 @@ END(ret_from_fork)
14343 ENTRY(system_call)
14344 CFI_STARTPROC simple
14345 CFI_SIGNAL_FRAME
14346- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
14347+ CFI_DEF_CFA rsp,0
14348 CFI_REGISTER rip,rcx
14349 /*CFI_REGISTER rflags,r11*/
14350 SWAPGS_UNSAFE_STACK
14351@@ -468,12 +722,13 @@ ENTRY(system_call_after_swapgs)
14352
14353 movq %rsp,PER_CPU_VAR(old_rsp)
14354 movq PER_CPU_VAR(kernel_stack),%rsp
14355+ pax_enter_kernel_user
14356 /*
14357 * No need to follow this irqs off/on section - it's straight
14358 * and short:
14359 */
14360 ENABLE_INTERRUPTS(CLBR_NONE)
14361- SAVE_ARGS 8,1
14362+ SAVE_ARGS 8*6,1
14363 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
14364 movq %rcx,RIP-ARGOFFSET(%rsp)
14365 CFI_REL_OFFSET rip,RIP-ARGOFFSET
14366@@ -502,6 +757,7 @@ sysret_check:
14367 andl %edi,%edx
14368 jnz sysret_careful
14369 CFI_REMEMBER_STATE
14370+ pax_exit_kernel_user
14371 /*
14372 * sysretq will re-enable interrupts:
14373 */
14374@@ -560,6 +816,9 @@ auditsys:
14375 movq %rax,%rsi /* 2nd arg: syscall number */
14376 movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
14377 call audit_syscall_entry
14378+
14379+ pax_erase_kstack
14380+
14381 LOAD_ARGS 0 /* reload call-clobbered registers */
14382 jmp system_call_fastpath
14383
14384@@ -590,6 +849,9 @@ tracesys:
14385 FIXUP_TOP_OF_STACK %rdi
14386 movq %rsp,%rdi
14387 call syscall_trace_enter
14388+
14389+ pax_erase_kstack
14390+
14391 /*
14392 * Reload arg registers from stack in case ptrace changed them.
14393 * We don't reload %rax because syscall_trace_enter() returned
14394@@ -611,7 +873,7 @@ tracesys:
14395 GLOBAL(int_ret_from_sys_call)
14396 DISABLE_INTERRUPTS(CLBR_NONE)
14397 TRACE_IRQS_OFF
14398- testl $3,CS-ARGOFFSET(%rsp)
14399+ testb $3,CS-ARGOFFSET(%rsp)
14400 je retint_restore_args
14401 movl $_TIF_ALLWORK_MASK,%edi
14402 /* edi: mask to check */
14403@@ -793,6 +1055,16 @@ END(interrupt)
14404 CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
14405 call save_args
14406 PARTIAL_FRAME 0
14407+#ifdef CONFIG_PAX_MEMORY_UDEREF
14408+ testb $3, CS(%rdi)
14409+ jnz 1f
14410+ pax_enter_kernel
14411+ jmp 2f
14412+1: pax_enter_kernel_user
14413+2:
14414+#else
14415+ pax_enter_kernel
14416+#endif
14417 call \func
14418 .endm
14419
14420@@ -825,7 +1097,7 @@ ret_from_intr:
14421 CFI_ADJUST_CFA_OFFSET -8
14422 exit_intr:
14423 GET_THREAD_INFO(%rcx)
14424- testl $3,CS-ARGOFFSET(%rsp)
14425+ testb $3,CS-ARGOFFSET(%rsp)
14426 je retint_kernel
14427
14428 /* Interrupt came from user space */
14429@@ -847,12 +1119,14 @@ retint_swapgs: /* return to user-space
14430 * The iretq could re-enable interrupts:
14431 */
14432 DISABLE_INTERRUPTS(CLBR_ANY)
14433+ pax_exit_kernel_user
14434 TRACE_IRQS_IRETQ
14435 SWAPGS
14436 jmp restore_args
14437
14438 retint_restore_args: /* return to kernel space */
14439 DISABLE_INTERRUPTS(CLBR_ANY)
14440+ pax_exit_kernel
14441 /*
14442 * The iretq could re-enable interrupts:
14443 */
14444@@ -1027,6 +1301,16 @@ ENTRY(\sym)
14445 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14446 call error_entry
14447 DEFAULT_FRAME 0
14448+#ifdef CONFIG_PAX_MEMORY_UDEREF
14449+ testb $3, CS(%rsp)
14450+ jnz 1f
14451+ pax_enter_kernel
14452+ jmp 2f
14453+1: pax_enter_kernel_user
14454+2:
14455+#else
14456+ pax_enter_kernel
14457+#endif
14458 movq %rsp,%rdi /* pt_regs pointer */
14459 xorl %esi,%esi /* no error code */
14460 call \do_sym
14461@@ -1044,6 +1328,16 @@ ENTRY(\sym)
14462 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14463 call save_paranoid
14464 TRACE_IRQS_OFF
14465+#ifdef CONFIG_PAX_MEMORY_UDEREF
14466+ testb $3, CS(%rsp)
14467+ jnz 1f
14468+ pax_enter_kernel
14469+ jmp 2f
14470+1: pax_enter_kernel_user
14471+2:
14472+#else
14473+ pax_enter_kernel
14474+#endif
14475 movq %rsp,%rdi /* pt_regs pointer */
14476 xorl %esi,%esi /* no error code */
14477 call \do_sym
14478@@ -1052,7 +1346,7 @@ ENTRY(\sym)
14479 END(\sym)
14480 .endm
14481
14482-#define INIT_TSS_IST(x) PER_CPU_VAR(init_tss) + (TSS_ist + ((x) - 1) * 8)
14483+#define INIT_TSS_IST(x) (TSS_ist + ((x) - 1) * 8)(%r12)
14484 .macro paranoidzeroentry_ist sym do_sym ist
14485 ENTRY(\sym)
14486 INTR_FRAME
14487@@ -1062,8 +1356,24 @@ ENTRY(\sym)
14488 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14489 call save_paranoid
14490 TRACE_IRQS_OFF
14491+#ifdef CONFIG_PAX_MEMORY_UDEREF
14492+ testb $3, CS(%rsp)
14493+ jnz 1f
14494+ pax_enter_kernel
14495+ jmp 2f
14496+1: pax_enter_kernel_user
14497+2:
14498+#else
14499+ pax_enter_kernel
14500+#endif
14501 movq %rsp,%rdi /* pt_regs pointer */
14502 xorl %esi,%esi /* no error code */
14503+#ifdef CONFIG_SMP
14504+ imul $TSS_size, PER_CPU_VAR(cpu_number), %r12d
14505+ lea init_tss(%r12), %r12
14506+#else
14507+ lea init_tss(%rip), %r12
14508+#endif
14509 subq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
14510 call \do_sym
14511 addq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
14512@@ -1080,6 +1390,16 @@ ENTRY(\sym)
14513 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14514 call error_entry
14515 DEFAULT_FRAME 0
14516+#ifdef CONFIG_PAX_MEMORY_UDEREF
14517+ testb $3, CS(%rsp)
14518+ jnz 1f
14519+ pax_enter_kernel
14520+ jmp 2f
14521+1: pax_enter_kernel_user
14522+2:
14523+#else
14524+ pax_enter_kernel
14525+#endif
14526 movq %rsp,%rdi /* pt_regs pointer */
14527 movq ORIG_RAX(%rsp),%rsi /* get error code */
14528 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14529@@ -1099,6 +1419,16 @@ ENTRY(\sym)
14530 call save_paranoid
14531 DEFAULT_FRAME 0
14532 TRACE_IRQS_OFF
14533+#ifdef CONFIG_PAX_MEMORY_UDEREF
14534+ testb $3, CS(%rsp)
14535+ jnz 1f
14536+ pax_enter_kernel
14537+ jmp 2f
14538+1: pax_enter_kernel_user
14539+2:
14540+#else
14541+ pax_enter_kernel
14542+#endif
14543 movq %rsp,%rdi /* pt_regs pointer */
14544 movq ORIG_RAX(%rsp),%rsi /* get error code */
14545 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14546@@ -1361,14 +1691,27 @@ ENTRY(paranoid_exit)
14547 TRACE_IRQS_OFF
14548 testl %ebx,%ebx /* swapgs needed? */
14549 jnz paranoid_restore
14550- testl $3,CS(%rsp)
14551+ testb $3,CS(%rsp)
14552 jnz paranoid_userspace
14553+#ifdef CONFIG_PAX_MEMORY_UDEREF
14554+ pax_exit_kernel
14555+ TRACE_IRQS_IRETQ 0
14556+ SWAPGS_UNSAFE_STACK
14557+ RESTORE_ALL 8
14558+ jmp irq_return
14559+#endif
14560 paranoid_swapgs:
14561+#ifdef CONFIG_PAX_MEMORY_UDEREF
14562+ pax_exit_kernel_user
14563+#else
14564+ pax_exit_kernel
14565+#endif
14566 TRACE_IRQS_IRETQ 0
14567 SWAPGS_UNSAFE_STACK
14568 RESTORE_ALL 8
14569 jmp irq_return
14570 paranoid_restore:
14571+ pax_exit_kernel
14572 TRACE_IRQS_IRETQ 0
14573 RESTORE_ALL 8
14574 jmp irq_return
14575@@ -1426,7 +1769,7 @@ ENTRY(error_entry)
14576 movq_cfi r14, R14+8
14577 movq_cfi r15, R15+8
14578 xorl %ebx,%ebx
14579- testl $3,CS+8(%rsp)
14580+ testb $3,CS+8(%rsp)
14581 je error_kernelspace
14582 error_swapgs:
14583 SWAPGS
14584@@ -1490,6 +1833,16 @@ ENTRY(nmi)
14585 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14586 call save_paranoid
14587 DEFAULT_FRAME 0
14588+#ifdef CONFIG_PAX_MEMORY_UDEREF
14589+ testb $3, CS(%rsp)
14590+ jnz 1f
14591+ pax_enter_kernel
14592+ jmp 2f
14593+1: pax_enter_kernel_user
14594+2:
14595+#else
14596+ pax_enter_kernel
14597+#endif
14598 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
14599 movq %rsp,%rdi
14600 movq $-1,%rsi
14601@@ -1500,11 +1853,25 @@ ENTRY(nmi)
14602 DISABLE_INTERRUPTS(CLBR_NONE)
14603 testl %ebx,%ebx /* swapgs needed? */
14604 jnz nmi_restore
14605- testl $3,CS(%rsp)
14606+ testb $3,CS(%rsp)
14607 jnz nmi_userspace
14608+#ifdef CONFIG_PAX_MEMORY_UDEREF
14609+ pax_exit_kernel
14610+ SWAPGS_UNSAFE_STACK
14611+ RESTORE_ALL 8
14612+ jmp irq_return
14613+#endif
14614 nmi_swapgs:
14615+#ifdef CONFIG_PAX_MEMORY_UDEREF
14616+ pax_exit_kernel_user
14617+#else
14618+ pax_exit_kernel
14619+#endif
14620 SWAPGS_UNSAFE_STACK
14621+ RESTORE_ALL 8
14622+ jmp irq_return
14623 nmi_restore:
14624+ pax_exit_kernel
14625 RESTORE_ALL 8
14626 jmp irq_return
14627 nmi_userspace:
14628diff -urNp linux-2.6.39.1/arch/x86/kernel/ftrace.c linux-2.6.39.1/arch/x86/kernel/ftrace.c
14629--- linux-2.6.39.1/arch/x86/kernel/ftrace.c 2011-05-19 00:06:34.000000000 -0400
14630+++ linux-2.6.39.1/arch/x86/kernel/ftrace.c 2011-05-22 19:36:30.000000000 -0400
14631@@ -126,7 +126,7 @@ static void *mod_code_ip; /* holds the
14632 static void *mod_code_newcode; /* holds the text to write to the IP */
14633
14634 static unsigned nmi_wait_count;
14635-static atomic_t nmi_update_count = ATOMIC_INIT(0);
14636+static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
14637
14638 int ftrace_arch_read_dyn_info(char *buf, int size)
14639 {
14640@@ -134,7 +134,7 @@ int ftrace_arch_read_dyn_info(char *buf,
14641
14642 r = snprintf(buf, size, "%u %u",
14643 nmi_wait_count,
14644- atomic_read(&nmi_update_count));
14645+ atomic_read_unchecked(&nmi_update_count));
14646 return r;
14647 }
14648
14649@@ -177,8 +177,10 @@ void ftrace_nmi_enter(void)
14650
14651 if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
14652 smp_rmb();
14653+ pax_open_kernel();
14654 ftrace_mod_code();
14655- atomic_inc(&nmi_update_count);
14656+ pax_close_kernel();
14657+ atomic_inc_unchecked(&nmi_update_count);
14658 }
14659 /* Must have previous changes seen before executions */
14660 smp_mb();
14661@@ -271,6 +273,8 @@ ftrace_modify_code(unsigned long ip, uns
14662 {
14663 unsigned char replaced[MCOUNT_INSN_SIZE];
14664
14665+ ip = ktla_ktva(ip);
14666+
14667 /*
14668 * Note: Due to modules and __init, code can
14669 * disappear and change, we need to protect against faulting
14670@@ -327,7 +331,7 @@ int ftrace_update_ftrace_func(ftrace_fun
14671 unsigned char old[MCOUNT_INSN_SIZE], *new;
14672 int ret;
14673
14674- memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
14675+ memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
14676 new = ftrace_call_replace(ip, (unsigned long)func);
14677 ret = ftrace_modify_code(ip, old, new);
14678
14679@@ -353,6 +357,8 @@ static int ftrace_mod_jmp(unsigned long
14680 {
14681 unsigned char code[MCOUNT_INSN_SIZE];
14682
14683+ ip = ktla_ktva(ip);
14684+
14685 if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
14686 return -EFAULT;
14687
14688diff -urNp linux-2.6.39.1/arch/x86/kernel/head32.c linux-2.6.39.1/arch/x86/kernel/head32.c
14689--- linux-2.6.39.1/arch/x86/kernel/head32.c 2011-05-19 00:06:34.000000000 -0400
14690+++ linux-2.6.39.1/arch/x86/kernel/head32.c 2011-05-22 19:36:30.000000000 -0400
14691@@ -19,6 +19,7 @@
14692 #include <asm/io_apic.h>
14693 #include <asm/bios_ebda.h>
14694 #include <asm/tlbflush.h>
14695+#include <asm/boot.h>
14696
14697 static void __init i386_default_early_setup(void)
14698 {
14699@@ -34,7 +35,7 @@ void __init i386_start_kernel(void)
14700 {
14701 memblock_init();
14702
14703- memblock_x86_reserve_range(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14704+ memblock_x86_reserve_range(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14705
14706 #ifdef CONFIG_BLK_DEV_INITRD
14707 /* Reserve INITRD */
14708diff -urNp linux-2.6.39.1/arch/x86/kernel/head_32.S linux-2.6.39.1/arch/x86/kernel/head_32.S
14709--- linux-2.6.39.1/arch/x86/kernel/head_32.S 2011-05-19 00:06:34.000000000 -0400
14710+++ linux-2.6.39.1/arch/x86/kernel/head_32.S 2011-05-22 19:36:30.000000000 -0400
14711@@ -25,6 +25,12 @@
14712 /* Physical address */
14713 #define pa(X) ((X) - __PAGE_OFFSET)
14714
14715+#ifdef CONFIG_PAX_KERNEXEC
14716+#define ta(X) (X)
14717+#else
14718+#define ta(X) ((X) - __PAGE_OFFSET)
14719+#endif
14720+
14721 /*
14722 * References to members of the new_cpu_data structure.
14723 */
14724@@ -54,11 +60,7 @@
14725 * and small than max_low_pfn, otherwise will waste some page table entries
14726 */
14727
14728-#if PTRS_PER_PMD > 1
14729-#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
14730-#else
14731-#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
14732-#endif
14733+#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
14734
14735 /* Number of possible pages in the lowmem region */
14736 LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT)
14737@@ -77,6 +79,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
14738 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14739
14740 /*
14741+ * Real beginning of normal "text" segment
14742+ */
14743+ENTRY(stext)
14744+ENTRY(_stext)
14745+
14746+/*
14747 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
14748 * %esi points to the real-mode code as a 32-bit pointer.
14749 * CS and DS must be 4 GB flat segments, but we don't depend on
14750@@ -84,6 +92,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14751 * can.
14752 */
14753 __HEAD
14754+
14755+#ifdef CONFIG_PAX_KERNEXEC
14756+ jmp startup_32
14757+/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
14758+.fill PAGE_SIZE-5,1,0xcc
14759+#endif
14760+
14761 ENTRY(startup_32)
14762 movl pa(stack_start),%ecx
14763
14764@@ -105,6 +120,57 @@ ENTRY(startup_32)
14765 2:
14766 leal -__PAGE_OFFSET(%ecx),%esp
14767
14768+#ifdef CONFIG_SMP
14769+ movl $pa(cpu_gdt_table),%edi
14770+ movl $__per_cpu_load,%eax
14771+ movw %ax,__KERNEL_PERCPU + 2(%edi)
14772+ rorl $16,%eax
14773+ movb %al,__KERNEL_PERCPU + 4(%edi)
14774+ movb %ah,__KERNEL_PERCPU + 7(%edi)
14775+ movl $__per_cpu_end - 1,%eax
14776+ subl $__per_cpu_start,%eax
14777+ movw %ax,__KERNEL_PERCPU + 0(%edi)
14778+#endif
14779+
14780+#ifdef CONFIG_PAX_MEMORY_UDEREF
14781+ movl $NR_CPUS,%ecx
14782+ movl $pa(cpu_gdt_table),%edi
14783+1:
14784+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
14785+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
14786+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
14787+ addl $PAGE_SIZE_asm,%edi
14788+ loop 1b
14789+#endif
14790+
14791+#ifdef CONFIG_PAX_KERNEXEC
14792+ movl $pa(boot_gdt),%edi
14793+ movl $__LOAD_PHYSICAL_ADDR,%eax
14794+ movw %ax,__BOOT_CS + 2(%edi)
14795+ rorl $16,%eax
14796+ movb %al,__BOOT_CS + 4(%edi)
14797+ movb %ah,__BOOT_CS + 7(%edi)
14798+ rorl $16,%eax
14799+
14800+ ljmp $(__BOOT_CS),$1f
14801+1:
14802+
14803+ movl $NR_CPUS,%ecx
14804+ movl $pa(cpu_gdt_table),%edi
14805+ addl $__PAGE_OFFSET,%eax
14806+1:
14807+ movw %ax,__KERNEL_CS + 2(%edi)
14808+ movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
14809+ rorl $16,%eax
14810+ movb %al,__KERNEL_CS + 4(%edi)
14811+ movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
14812+ movb %ah,__KERNEL_CS + 7(%edi)
14813+ movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
14814+ rorl $16,%eax
14815+ addl $PAGE_SIZE_asm,%edi
14816+ loop 1b
14817+#endif
14818+
14819 /*
14820 * Clear BSS first so that there are no surprises...
14821 */
14822@@ -195,8 +261,11 @@ ENTRY(startup_32)
14823 movl %eax, pa(max_pfn_mapped)
14824
14825 /* Do early initialization of the fixmap area */
14826- movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
14827- movl %eax,pa(initial_pg_pmd+0x1000*KPMDS-8)
14828+#ifdef CONFIG_COMPAT_VDSO
14829+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_pg_pmd+0x1000*KPMDS-8)
14830+#else
14831+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_pg_pmd+0x1000*KPMDS-8)
14832+#endif
14833 #else /* Not PAE */
14834
14835 page_pde_offset = (__PAGE_OFFSET >> 20);
14836@@ -226,8 +295,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
14837 movl %eax, pa(max_pfn_mapped)
14838
14839 /* Do early initialization of the fixmap area */
14840- movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
14841- movl %eax,pa(initial_page_table+0xffc)
14842+#ifdef CONFIG_COMPAT_VDSO
14843+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_page_table+0xffc)
14844+#else
14845+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_page_table+0xffc)
14846+#endif
14847 #endif
14848
14849 #ifdef CONFIG_PARAVIRT
14850@@ -241,9 +313,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
14851 cmpl $num_subarch_entries, %eax
14852 jae bad_subarch
14853
14854- movl pa(subarch_entries)(,%eax,4), %eax
14855- subl $__PAGE_OFFSET, %eax
14856- jmp *%eax
14857+ jmp *pa(subarch_entries)(,%eax,4)
14858
14859 bad_subarch:
14860 WEAK(lguest_entry)
14861@@ -255,10 +325,10 @@ WEAK(xen_entry)
14862 __INITDATA
14863
14864 subarch_entries:
14865- .long default_entry /* normal x86/PC */
14866- .long lguest_entry /* lguest hypervisor */
14867- .long xen_entry /* Xen hypervisor */
14868- .long default_entry /* Moorestown MID */
14869+ .long ta(default_entry) /* normal x86/PC */
14870+ .long ta(lguest_entry) /* lguest hypervisor */
14871+ .long ta(xen_entry) /* Xen hypervisor */
14872+ .long ta(default_entry) /* Moorestown MID */
14873 num_subarch_entries = (. - subarch_entries) / 4
14874 .previous
14875 #else
14876@@ -312,6 +382,7 @@ default_entry:
14877 orl %edx,%eax
14878 movl %eax,%cr4
14879
14880+#ifdef CONFIG_X86_PAE
14881 testb $X86_CR4_PAE, %al # check if PAE is enabled
14882 jz 6f
14883
14884@@ -340,6 +411,9 @@ default_entry:
14885 /* Make changes effective */
14886 wrmsr
14887
14888+ btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
14889+#endif
14890+
14891 6:
14892
14893 /*
14894@@ -443,7 +517,7 @@ is386: movl $2,%ecx # set MP
14895 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
14896 movl %eax,%ss # after changing gdt.
14897
14898- movl $(__USER_DS),%eax # DS/ES contains default USER segment
14899+# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
14900 movl %eax,%ds
14901 movl %eax,%es
14902
14903@@ -457,15 +531,22 @@ is386: movl $2,%ecx # set MP
14904 */
14905 cmpb $0,ready
14906 jne 1f
14907- movl $gdt_page,%eax
14908+ movl $cpu_gdt_table,%eax
14909 movl $stack_canary,%ecx
14910+#ifdef CONFIG_SMP
14911+ addl $__per_cpu_load,%ecx
14912+#endif
14913 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
14914 shrl $16, %ecx
14915 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
14916 movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
14917 1:
14918-#endif
14919 movl $(__KERNEL_STACK_CANARY),%eax
14920+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
14921+ movl $(__USER_DS),%eax
14922+#else
14923+ xorl %eax,%eax
14924+#endif
14925 movl %eax,%gs
14926
14927 xorl %eax,%eax # Clear LDT
14928@@ -558,22 +639,22 @@ early_page_fault:
14929 jmp early_fault
14930
14931 early_fault:
14932- cld
14933 #ifdef CONFIG_PRINTK
14934+ cmpl $1,%ss:early_recursion_flag
14935+ je hlt_loop
14936+ incl %ss:early_recursion_flag
14937+ cld
14938 pusha
14939 movl $(__KERNEL_DS),%eax
14940 movl %eax,%ds
14941 movl %eax,%es
14942- cmpl $2,early_recursion_flag
14943- je hlt_loop
14944- incl early_recursion_flag
14945 movl %cr2,%eax
14946 pushl %eax
14947 pushl %edx /* trapno */
14948 pushl $fault_msg
14949 call printk
14950+; call dump_stack
14951 #endif
14952- call dump_stack
14953 hlt_loop:
14954 hlt
14955 jmp hlt_loop
14956@@ -581,8 +662,11 @@ hlt_loop:
14957 /* This is the default interrupt "handler" :-) */
14958 ALIGN
14959 ignore_int:
14960- cld
14961 #ifdef CONFIG_PRINTK
14962+ cmpl $2,%ss:early_recursion_flag
14963+ je hlt_loop
14964+ incl %ss:early_recursion_flag
14965+ cld
14966 pushl %eax
14967 pushl %ecx
14968 pushl %edx
14969@@ -591,9 +675,6 @@ ignore_int:
14970 movl $(__KERNEL_DS),%eax
14971 movl %eax,%ds
14972 movl %eax,%es
14973- cmpl $2,early_recursion_flag
14974- je hlt_loop
14975- incl early_recursion_flag
14976 pushl 16(%esp)
14977 pushl 24(%esp)
14978 pushl 32(%esp)
14979@@ -622,29 +703,43 @@ ENTRY(initial_code)
14980 /*
14981 * BSS section
14982 */
14983-__PAGE_ALIGNED_BSS
14984- .align PAGE_SIZE
14985 #ifdef CONFIG_X86_PAE
14986+.section .initial_pg_pmd,"a",@progbits
14987 initial_pg_pmd:
14988 .fill 1024*KPMDS,4,0
14989 #else
14990+.section .initial_page_table,"a",@progbits
14991 ENTRY(initial_page_table)
14992 .fill 1024,4,0
14993 #endif
14994+.section .initial_pg_fixmap,"a",@progbits
14995 initial_pg_fixmap:
14996 .fill 1024,4,0
14997+.section .empty_zero_page,"a",@progbits
14998 ENTRY(empty_zero_page)
14999 .fill 4096,1,0
15000+.section .swapper_pg_dir,"a",@progbits
15001 ENTRY(swapper_pg_dir)
15002+#ifdef CONFIG_X86_PAE
15003+ .fill 4,8,0
15004+#else
15005 .fill 1024,4,0
15006+#endif
15007+
15008+/*
15009+ * The IDT has to be page-aligned to simplify the Pentium
15010+ * F0 0F bug workaround.. We have a special link segment
15011+ * for this.
15012+ */
15013+.section .idt,"a",@progbits
15014+ENTRY(idt_table)
15015+ .fill 256,8,0
15016
15017 /*
15018 * This starts the data section.
15019 */
15020 #ifdef CONFIG_X86_PAE
15021-__PAGE_ALIGNED_DATA
15022- /* Page-aligned for the benefit of paravirt? */
15023- .align PAGE_SIZE
15024+.section .initial_page_table,"a",@progbits
15025 ENTRY(initial_page_table)
15026 .long pa(initial_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
15027 # if KPMDS == 3
15028@@ -663,18 +758,27 @@ ENTRY(initial_page_table)
15029 # error "Kernel PMDs should be 1, 2 or 3"
15030 # endif
15031 .align PAGE_SIZE /* needs to be page-sized too */
15032+
15033+#ifdef CONFIG_PAX_PER_CPU_PGD
15034+ENTRY(cpu_pgd)
15035+ .rept NR_CPUS
15036+ .fill 4,8,0
15037+ .endr
15038+#endif
15039+
15040 #endif
15041
15042 .data
15043 .balign 4
15044 ENTRY(stack_start)
15045- .long init_thread_union+THREAD_SIZE
15046+ .long init_thread_union+THREAD_SIZE-8
15047+
15048+ready: .byte 0
15049
15050+.section .rodata,"a",@progbits
15051 early_recursion_flag:
15052 .long 0
15053
15054-ready: .byte 0
15055-
15056 int_msg:
15057 .asciz "Unknown interrupt or fault at: %p %p %p\n"
15058
15059@@ -707,7 +811,7 @@ fault_msg:
15060 .word 0 # 32 bit align gdt_desc.address
15061 boot_gdt_descr:
15062 .word __BOOT_DS+7
15063- .long boot_gdt - __PAGE_OFFSET
15064+ .long pa(boot_gdt)
15065
15066 .word 0 # 32-bit align idt_desc.address
15067 idt_descr:
15068@@ -718,7 +822,7 @@ idt_descr:
15069 .word 0 # 32 bit align gdt_desc.address
15070 ENTRY(early_gdt_descr)
15071 .word GDT_ENTRIES*8-1
15072- .long gdt_page /* Overwritten for secondary CPUs */
15073+ .long cpu_gdt_table /* Overwritten for secondary CPUs */
15074
15075 /*
15076 * The boot_gdt must mirror the equivalent in setup.S and is
15077@@ -727,5 +831,65 @@ ENTRY(early_gdt_descr)
15078 .align L1_CACHE_BYTES
15079 ENTRY(boot_gdt)
15080 .fill GDT_ENTRY_BOOT_CS,8,0
15081- .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
15082- .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
15083+ .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
15084+ .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
15085+
15086+ .align PAGE_SIZE_asm
15087+ENTRY(cpu_gdt_table)
15088+ .rept NR_CPUS
15089+ .quad 0x0000000000000000 /* NULL descriptor */
15090+ .quad 0x0000000000000000 /* 0x0b reserved */
15091+ .quad 0x0000000000000000 /* 0x13 reserved */
15092+ .quad 0x0000000000000000 /* 0x1b reserved */
15093+
15094+#ifdef CONFIG_PAX_KERNEXEC
15095+ .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
15096+#else
15097+ .quad 0x0000000000000000 /* 0x20 unused */
15098+#endif
15099+
15100+ .quad 0x0000000000000000 /* 0x28 unused */
15101+ .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
15102+ .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
15103+ .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
15104+ .quad 0x0000000000000000 /* 0x4b reserved */
15105+ .quad 0x0000000000000000 /* 0x53 reserved */
15106+ .quad 0x0000000000000000 /* 0x5b reserved */
15107+
15108+ .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
15109+ .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
15110+ .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
15111+ .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
15112+
15113+ .quad 0x0000000000000000 /* 0x80 TSS descriptor */
15114+ .quad 0x0000000000000000 /* 0x88 LDT descriptor */
15115+
15116+ /*
15117+ * Segments used for calling PnP BIOS have byte granularity.
15118+ * The code segments and data segments have fixed 64k limits,
15119+ * the transfer segment sizes are set at run time.
15120+ */
15121+ .quad 0x00409b000000ffff /* 0x90 32-bit code */
15122+ .quad 0x00009b000000ffff /* 0x98 16-bit code */
15123+ .quad 0x000093000000ffff /* 0xa0 16-bit data */
15124+ .quad 0x0000930000000000 /* 0xa8 16-bit data */
15125+ .quad 0x0000930000000000 /* 0xb0 16-bit data */
15126+
15127+ /*
15128+ * The APM segments have byte granularity and their bases
15129+ * are set at run time. All have 64k limits.
15130+ */
15131+ .quad 0x00409b000000ffff /* 0xb8 APM CS code */
15132+ .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
15133+ .quad 0x004093000000ffff /* 0xc8 APM DS data */
15134+
15135+ .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
15136+ .quad 0x0040930000000000 /* 0xd8 - PERCPU */
15137+ .quad 0x0040910000000018 /* 0xe0 - STACK_CANARY */
15138+ .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
15139+ .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
15140+ .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
15141+
15142+ /* Be sure this is zeroed to avoid false validations in Xen */
15143+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0
15144+ .endr
15145diff -urNp linux-2.6.39.1/arch/x86/kernel/head_64.S linux-2.6.39.1/arch/x86/kernel/head_64.S
15146--- linux-2.6.39.1/arch/x86/kernel/head_64.S 2011-05-19 00:06:34.000000000 -0400
15147+++ linux-2.6.39.1/arch/x86/kernel/head_64.S 2011-05-22 19:36:30.000000000 -0400
15148@@ -19,6 +19,7 @@
15149 #include <asm/cache.h>
15150 #include <asm/processor-flags.h>
15151 #include <asm/percpu.h>
15152+#include <asm/cpufeature.h>
15153
15154 #ifdef CONFIG_PARAVIRT
15155 #include <asm/asm-offsets.h>
15156@@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
15157 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
15158 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
15159 L3_START_KERNEL = pud_index(__START_KERNEL_map)
15160+L4_VMALLOC_START = pgd_index(VMALLOC_START)
15161+L3_VMALLOC_START = pud_index(VMALLOC_START)
15162+L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
15163+L3_VMEMMAP_START = pud_index(VMEMMAP_START)
15164
15165 .text
15166 __HEAD
15167@@ -85,35 +90,22 @@ startup_64:
15168 */
15169 addq %rbp, init_level4_pgt + 0(%rip)
15170 addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
15171+ addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
15172+ addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
15173 addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
15174
15175 addq %rbp, level3_ident_pgt + 0(%rip)
15176+#ifndef CONFIG_XEN
15177+ addq %rbp, level3_ident_pgt + 8(%rip)
15178+#endif
15179
15180- addq %rbp, level3_kernel_pgt + (510*8)(%rip)
15181- addq %rbp, level3_kernel_pgt + (511*8)(%rip)
15182+ addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
15183
15184- addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
15185+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
15186+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
15187
15188- /* Add an Identity mapping if I am above 1G */
15189- leaq _text(%rip), %rdi
15190- andq $PMD_PAGE_MASK, %rdi
15191-
15192- movq %rdi, %rax
15193- shrq $PUD_SHIFT, %rax
15194- andq $(PTRS_PER_PUD - 1), %rax
15195- jz ident_complete
15196-
15197- leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
15198- leaq level3_ident_pgt(%rip), %rbx
15199- movq %rdx, 0(%rbx, %rax, 8)
15200-
15201- movq %rdi, %rax
15202- shrq $PMD_SHIFT, %rax
15203- andq $(PTRS_PER_PMD - 1), %rax
15204- leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
15205- leaq level2_spare_pgt(%rip), %rbx
15206- movq %rdx, 0(%rbx, %rax, 8)
15207-ident_complete:
15208+ addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
15209+ addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
15210
15211 /*
15212 * Fixup the kernel text+data virtual addresses. Note that
15213@@ -160,8 +152,8 @@ ENTRY(secondary_startup_64)
15214 * after the boot processor executes this code.
15215 */
15216
15217- /* Enable PAE mode and PGE */
15218- movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
15219+ /* Enable PAE mode and PSE/PGE */
15220+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
15221 movq %rax, %cr4
15222
15223 /* Setup early boot stage 4 level pagetables. */
15224@@ -183,9 +175,14 @@ ENTRY(secondary_startup_64)
15225 movl $MSR_EFER, %ecx
15226 rdmsr
15227 btsl $_EFER_SCE, %eax /* Enable System Call */
15228- btl $20,%edi /* No Execute supported? */
15229+ btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
15230 jnc 1f
15231 btsl $_EFER_NX, %eax
15232+ leaq init_level4_pgt(%rip), %rdi
15233+ btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
15234+ btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
15235+ btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
15236+ btsq $_PAGE_BIT_NX, __supported_pte_mask(%rip)
15237 1: wrmsr /* Make changes effective */
15238
15239 /* Setup cr0 */
15240@@ -269,7 +266,7 @@ ENTRY(secondary_startup_64)
15241 bad_address:
15242 jmp bad_address
15243
15244- .section ".init.text","ax"
15245+ __INIT
15246 #ifdef CONFIG_EARLY_PRINTK
15247 .globl early_idt_handlers
15248 early_idt_handlers:
15249@@ -314,18 +311,23 @@ ENTRY(early_idt_handler)
15250 #endif /* EARLY_PRINTK */
15251 1: hlt
15252 jmp 1b
15253+ .previous
15254
15255 #ifdef CONFIG_EARLY_PRINTK
15256+ __INITDATA
15257 early_recursion_flag:
15258 .long 0
15259+ .previous
15260
15261+ .section .rodata,"a",@progbits
15262 early_idt_msg:
15263 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
15264 early_idt_ripmsg:
15265 .asciz "RIP %s\n"
15266-#endif /* CONFIG_EARLY_PRINTK */
15267 .previous
15268+#endif /* CONFIG_EARLY_PRINTK */
15269
15270+ .section .rodata,"a",@progbits
15271 #define NEXT_PAGE(name) \
15272 .balign PAGE_SIZE; \
15273 ENTRY(name)
15274@@ -338,7 +340,6 @@ ENTRY(name)
15275 i = i + 1 ; \
15276 .endr
15277
15278- .data
15279 /*
15280 * This default setting generates an ident mapping at address 0x100000
15281 * and a mapping for the kernel that precisely maps virtual address
15282@@ -349,13 +350,36 @@ NEXT_PAGE(init_level4_pgt)
15283 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15284 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
15285 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15286+ .org init_level4_pgt + L4_VMALLOC_START*8, 0
15287+ .quad level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
15288+ .org init_level4_pgt + L4_VMEMMAP_START*8, 0
15289+ .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15290 .org init_level4_pgt + L4_START_KERNEL*8, 0
15291 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
15292 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
15293
15294+#ifdef CONFIG_PAX_PER_CPU_PGD
15295+NEXT_PAGE(cpu_pgd)
15296+ .rept NR_CPUS
15297+ .fill 512,8,0
15298+ .endr
15299+#endif
15300+
15301 NEXT_PAGE(level3_ident_pgt)
15302 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15303+#ifdef CONFIG_XEN
15304 .fill 511,8,0
15305+#else
15306+ .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
15307+ .fill 510,8,0
15308+#endif
15309+
15310+NEXT_PAGE(level3_vmalloc_pgt)
15311+ .fill 512,8,0
15312+
15313+NEXT_PAGE(level3_vmemmap_pgt)
15314+ .fill L3_VMEMMAP_START,8,0
15315+ .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15316
15317 NEXT_PAGE(level3_kernel_pgt)
15318 .fill L3_START_KERNEL,8,0
15319@@ -363,20 +387,23 @@ NEXT_PAGE(level3_kernel_pgt)
15320 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
15321 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15322
15323+NEXT_PAGE(level2_vmemmap_pgt)
15324+ .fill 512,8,0
15325+
15326 NEXT_PAGE(level2_fixmap_pgt)
15327- .fill 506,8,0
15328- .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15329- /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
15330- .fill 5,8,0
15331+ .fill 507,8,0
15332+ .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
15333+ /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
15334+ .fill 4,8,0
15335
15336-NEXT_PAGE(level1_fixmap_pgt)
15337+NEXT_PAGE(level1_vsyscall_pgt)
15338 .fill 512,8,0
15339
15340-NEXT_PAGE(level2_ident_pgt)
15341- /* Since I easily can, map the first 1G.
15342+ /* Since I easily can, map the first 2G.
15343 * Don't set NX because code runs from these pages.
15344 */
15345- PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
15346+NEXT_PAGE(level2_ident_pgt)
15347+ PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
15348
15349 NEXT_PAGE(level2_kernel_pgt)
15350 /*
15351@@ -389,33 +416,55 @@ NEXT_PAGE(level2_kernel_pgt)
15352 * If you want to increase this then increase MODULES_VADDR
15353 * too.)
15354 */
15355- PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
15356- KERNEL_IMAGE_SIZE/PMD_SIZE)
15357-
15358-NEXT_PAGE(level2_spare_pgt)
15359- .fill 512, 8, 0
15360+ PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
15361
15362 #undef PMDS
15363 #undef NEXT_PAGE
15364
15365- .data
15366+ .align PAGE_SIZE
15367+ENTRY(cpu_gdt_table)
15368+ .rept NR_CPUS
15369+ .quad 0x0000000000000000 /* NULL descriptor */
15370+ .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
15371+ .quad 0x00af9b000000ffff /* __KERNEL_CS */
15372+ .quad 0x00cf93000000ffff /* __KERNEL_DS */
15373+ .quad 0x00cffb000000ffff /* __USER32_CS */
15374+ .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
15375+ .quad 0x00affb000000ffff /* __USER_CS */
15376+
15377+#ifdef CONFIG_PAX_KERNEXEC
15378+ .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
15379+#else
15380+ .quad 0x0 /* unused */
15381+#endif
15382+
15383+ .quad 0,0 /* TSS */
15384+ .quad 0,0 /* LDT */
15385+ .quad 0,0,0 /* three TLS descriptors */
15386+ .quad 0x0000f40000000000 /* node/CPU stored in limit */
15387+ /* asm/segment.h:GDT_ENTRIES must match this */
15388+
15389+ /* zero the remaining page */
15390+ .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
15391+ .endr
15392+
15393 .align 16
15394 .globl early_gdt_descr
15395 early_gdt_descr:
15396 .word GDT_ENTRIES*8-1
15397 early_gdt_descr_base:
15398- .quad INIT_PER_CPU_VAR(gdt_page)
15399+ .quad cpu_gdt_table
15400
15401 ENTRY(phys_base)
15402 /* This must match the first entry in level2_kernel_pgt */
15403 .quad 0x0000000000000000
15404
15405 #include "../../x86/xen/xen-head.S"
15406-
15407- .section .bss, "aw", @nobits
15408+
15409+ .section .rodata,"a",@progbits
15410 .align L1_CACHE_BYTES
15411 ENTRY(idt_table)
15412- .skip IDT_ENTRIES * 16
15413+ .fill 512,8,0
15414
15415 __PAGE_ALIGNED_BSS
15416 .align PAGE_SIZE
15417diff -urNp linux-2.6.39.1/arch/x86/kernel/i386_ksyms_32.c linux-2.6.39.1/arch/x86/kernel/i386_ksyms_32.c
15418--- linux-2.6.39.1/arch/x86/kernel/i386_ksyms_32.c 2011-05-19 00:06:34.000000000 -0400
15419+++ linux-2.6.39.1/arch/x86/kernel/i386_ksyms_32.c 2011-05-22 19:36:30.000000000 -0400
15420@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
15421 EXPORT_SYMBOL(cmpxchg8b_emu);
15422 #endif
15423
15424+EXPORT_SYMBOL_GPL(cpu_gdt_table);
15425+
15426 /* Networking helper routines. */
15427 EXPORT_SYMBOL(csum_partial_copy_generic);
15428+EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
15429+EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
15430
15431 EXPORT_SYMBOL(__get_user_1);
15432 EXPORT_SYMBOL(__get_user_2);
15433@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
15434
15435 EXPORT_SYMBOL(csum_partial);
15436 EXPORT_SYMBOL(empty_zero_page);
15437+
15438+#ifdef CONFIG_PAX_KERNEXEC
15439+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
15440+#endif
15441diff -urNp linux-2.6.39.1/arch/x86/kernel/i8259.c linux-2.6.39.1/arch/x86/kernel/i8259.c
15442--- linux-2.6.39.1/arch/x86/kernel/i8259.c 2011-05-19 00:06:34.000000000 -0400
15443+++ linux-2.6.39.1/arch/x86/kernel/i8259.c 2011-05-22 19:36:30.000000000 -0400
15444@@ -210,7 +210,7 @@ spurious_8259A_irq:
15445 "spurious 8259A interrupt: IRQ%d.\n", irq);
15446 spurious_irq_mask |= irqmask;
15447 }
15448- atomic_inc(&irq_err_count);
15449+ atomic_inc_unchecked(&irq_err_count);
15450 /*
15451 * Theoretically we do not have to handle this IRQ,
15452 * but in Linux this does not cause problems and is
15453diff -urNp linux-2.6.39.1/arch/x86/kernel/init_task.c linux-2.6.39.1/arch/x86/kernel/init_task.c
15454--- linux-2.6.39.1/arch/x86/kernel/init_task.c 2011-05-19 00:06:34.000000000 -0400
15455+++ linux-2.6.39.1/arch/x86/kernel/init_task.c 2011-05-22 19:36:30.000000000 -0400
15456@@ -20,8 +20,7 @@ static struct sighand_struct init_sighan
15457 * way process stacks are handled. This is done by having a special
15458 * "init_task" linker map entry..
15459 */
15460-union thread_union init_thread_union __init_task_data =
15461- { INIT_THREAD_INFO(init_task) };
15462+union thread_union init_thread_union __init_task_data;
15463
15464 /*
15465 * Initial task structure.
15466@@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
15467 * section. Since TSS's are completely CPU-local, we want them
15468 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
15469 */
15470-DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
15471-
15472+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
15473+EXPORT_SYMBOL(init_tss);
15474diff -urNp linux-2.6.39.1/arch/x86/kernel/ioport.c linux-2.6.39.1/arch/x86/kernel/ioport.c
15475--- linux-2.6.39.1/arch/x86/kernel/ioport.c 2011-05-19 00:06:34.000000000 -0400
15476+++ linux-2.6.39.1/arch/x86/kernel/ioport.c 2011-05-22 19:41:32.000000000 -0400
15477@@ -6,6 +6,7 @@
15478 #include <linux/sched.h>
15479 #include <linux/kernel.h>
15480 #include <linux/capability.h>
15481+#include <linux/security.h>
15482 #include <linux/errno.h>
15483 #include <linux/types.h>
15484 #include <linux/ioport.h>
15485@@ -28,6 +29,12 @@ asmlinkage long sys_ioperm(unsigned long
15486
15487 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
15488 return -EINVAL;
15489+#ifdef CONFIG_GRKERNSEC_IO
15490+ if (turn_on && grsec_disable_privio) {
15491+ gr_handle_ioperm();
15492+ return -EPERM;
15493+ }
15494+#endif
15495 if (turn_on && !capable(CAP_SYS_RAWIO))
15496 return -EPERM;
15497
15498@@ -54,7 +61,7 @@ asmlinkage long sys_ioperm(unsigned long
15499 * because the ->io_bitmap_max value must match the bitmap
15500 * contents:
15501 */
15502- tss = &per_cpu(init_tss, get_cpu());
15503+ tss = init_tss + get_cpu();
15504
15505 if (turn_on)
15506 bitmap_clear(t->io_bitmap_ptr, from, num);
15507@@ -102,6 +109,12 @@ long sys_iopl(unsigned int level, struct
15508 return -EINVAL;
15509 /* Trying to gain more privileges? */
15510 if (level > old) {
15511+#ifdef CONFIG_GRKERNSEC_IO
15512+ if (grsec_disable_privio) {
15513+ gr_handle_iopl();
15514+ return -EPERM;
15515+ }
15516+#endif
15517 if (!capable(CAP_SYS_RAWIO))
15518 return -EPERM;
15519 }
15520diff -urNp linux-2.6.39.1/arch/x86/kernel/irq_32.c linux-2.6.39.1/arch/x86/kernel/irq_32.c
15521--- linux-2.6.39.1/arch/x86/kernel/irq_32.c 2011-05-19 00:06:34.000000000 -0400
15522+++ linux-2.6.39.1/arch/x86/kernel/irq_32.c 2011-05-22 19:36:30.000000000 -0400
15523@@ -36,7 +36,7 @@ static int check_stack_overflow(void)
15524 __asm__ __volatile__("andl %%esp,%0" :
15525 "=r" (sp) : "0" (THREAD_SIZE - 1));
15526
15527- return sp < (sizeof(struct thread_info) + STACK_WARN);
15528+ return sp < STACK_WARN;
15529 }
15530
15531 static void print_stack_overflow(void)
15532@@ -54,8 +54,8 @@ static inline void print_stack_overflow(
15533 * per-CPU IRQ handling contexts (thread information and stack)
15534 */
15535 union irq_ctx {
15536- struct thread_info tinfo;
15537- u32 stack[THREAD_SIZE/sizeof(u32)];
15538+ unsigned long previous_esp;
15539+ u32 stack[THREAD_SIZE/sizeof(u32)];
15540 } __attribute__((aligned(THREAD_SIZE)));
15541
15542 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
15543@@ -75,10 +75,9 @@ static void call_on_stack(void *func, vo
15544 static inline int
15545 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15546 {
15547- union irq_ctx *curctx, *irqctx;
15548+ union irq_ctx *irqctx;
15549 u32 *isp, arg1, arg2;
15550
15551- curctx = (union irq_ctx *) current_thread_info();
15552 irqctx = __this_cpu_read(hardirq_ctx);
15553
15554 /*
15555@@ -87,21 +86,17 @@ execute_on_irq_stack(int overflow, struc
15556 * handler) we can't do that and just have to keep using the
15557 * current stack (which is the irq stack already after all)
15558 */
15559- if (unlikely(curctx == irqctx))
15560+ if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
15561 return 0;
15562
15563 /* build the stack frame on the IRQ stack */
15564- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15565- irqctx->tinfo.task = curctx->tinfo.task;
15566- irqctx->tinfo.previous_esp = current_stack_pointer;
15567+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15568+ irqctx->previous_esp = current_stack_pointer;
15569+ add_preempt_count(HARDIRQ_OFFSET);
15570
15571- /*
15572- * Copy the softirq bits in preempt_count so that the
15573- * softirq checks work in the hardirq context.
15574- */
15575- irqctx->tinfo.preempt_count =
15576- (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
15577- (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
15578+#ifdef CONFIG_PAX_MEMORY_UDEREF
15579+ __set_fs(MAKE_MM_SEG(0));
15580+#endif
15581
15582 if (unlikely(overflow))
15583 call_on_stack(print_stack_overflow, isp);
15584@@ -113,6 +108,12 @@ execute_on_irq_stack(int overflow, struc
15585 : "0" (irq), "1" (desc), "2" (isp),
15586 "D" (desc->handle_irq)
15587 : "memory", "cc", "ecx");
15588+
15589+#ifdef CONFIG_PAX_MEMORY_UDEREF
15590+ __set_fs(current_thread_info()->addr_limit);
15591+#endif
15592+
15593+ sub_preempt_count(HARDIRQ_OFFSET);
15594 return 1;
15595 }
15596
15597@@ -121,29 +122,11 @@ execute_on_irq_stack(int overflow, struc
15598 */
15599 void __cpuinit irq_ctx_init(int cpu)
15600 {
15601- union irq_ctx *irqctx;
15602-
15603 if (per_cpu(hardirq_ctx, cpu))
15604 return;
15605
15606- irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15607- THREAD_FLAGS,
15608- THREAD_ORDER));
15609- memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15610- irqctx->tinfo.cpu = cpu;
15611- irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
15612- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15613-
15614- per_cpu(hardirq_ctx, cpu) = irqctx;
15615-
15616- irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15617- THREAD_FLAGS,
15618- THREAD_ORDER));
15619- memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15620- irqctx->tinfo.cpu = cpu;
15621- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15622-
15623- per_cpu(softirq_ctx, cpu) = irqctx;
15624+ per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15625+ per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15626
15627 printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
15628 cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
15629@@ -152,7 +135,6 @@ void __cpuinit irq_ctx_init(int cpu)
15630 asmlinkage void do_softirq(void)
15631 {
15632 unsigned long flags;
15633- struct thread_info *curctx;
15634 union irq_ctx *irqctx;
15635 u32 *isp;
15636
15637@@ -162,15 +144,22 @@ asmlinkage void do_softirq(void)
15638 local_irq_save(flags);
15639
15640 if (local_softirq_pending()) {
15641- curctx = current_thread_info();
15642 irqctx = __this_cpu_read(softirq_ctx);
15643- irqctx->tinfo.task = curctx->task;
15644- irqctx->tinfo.previous_esp = current_stack_pointer;
15645+ irqctx->previous_esp = current_stack_pointer;
15646
15647 /* build the stack frame on the softirq stack */
15648- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15649+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15650+
15651+#ifdef CONFIG_PAX_MEMORY_UDEREF
15652+ __set_fs(MAKE_MM_SEG(0));
15653+#endif
15654
15655 call_on_stack(__do_softirq, isp);
15656+
15657+#ifdef CONFIG_PAX_MEMORY_UDEREF
15658+ __set_fs(current_thread_info()->addr_limit);
15659+#endif
15660+
15661 /*
15662 * Shouldn't happen, we returned above if in_interrupt():
15663 */
15664diff -urNp linux-2.6.39.1/arch/x86/kernel/irq.c linux-2.6.39.1/arch/x86/kernel/irq.c
15665--- linux-2.6.39.1/arch/x86/kernel/irq.c 2011-05-19 00:06:34.000000000 -0400
15666+++ linux-2.6.39.1/arch/x86/kernel/irq.c 2011-05-22 19:36:30.000000000 -0400
15667@@ -17,7 +17,7 @@
15668 #include <asm/mce.h>
15669 #include <asm/hw_irq.h>
15670
15671-atomic_t irq_err_count;
15672+atomic_unchecked_t irq_err_count;
15673
15674 /* Function pointer for generic interrupt vector handling */
15675 void (*x86_platform_ipi_callback)(void) = NULL;
15676@@ -116,9 +116,9 @@ int arch_show_interrupts(struct seq_file
15677 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
15678 seq_printf(p, " Machine check polls\n");
15679 #endif
15680- seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
15681+ seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
15682 #if defined(CONFIG_X86_IO_APIC)
15683- seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
15684+ seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
15685 #endif
15686 return 0;
15687 }
15688@@ -158,10 +158,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
15689
15690 u64 arch_irq_stat(void)
15691 {
15692- u64 sum = atomic_read(&irq_err_count);
15693+ u64 sum = atomic_read_unchecked(&irq_err_count);
15694
15695 #ifdef CONFIG_X86_IO_APIC
15696- sum += atomic_read(&irq_mis_count);
15697+ sum += atomic_read_unchecked(&irq_mis_count);
15698 #endif
15699 return sum;
15700 }
15701diff -urNp linux-2.6.39.1/arch/x86/kernel/kgdb.c linux-2.6.39.1/arch/x86/kernel/kgdb.c
15702--- linux-2.6.39.1/arch/x86/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
15703+++ linux-2.6.39.1/arch/x86/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
15704@@ -124,11 +124,11 @@ char *dbg_get_reg(int regno, void *mem,
15705 #ifdef CONFIG_X86_32
15706 switch (regno) {
15707 case GDB_SS:
15708- if (!user_mode_vm(regs))
15709+ if (!user_mode(regs))
15710 *(unsigned long *)mem = __KERNEL_DS;
15711 break;
15712 case GDB_SP:
15713- if (!user_mode_vm(regs))
15714+ if (!user_mode(regs))
15715 *(unsigned long *)mem = kernel_stack_pointer(regs);
15716 break;
15717 case GDB_GS:
15718@@ -473,12 +473,12 @@ int kgdb_arch_handle_exception(int e_vec
15719 case 'k':
15720 /* clear the trace bit */
15721 linux_regs->flags &= ~X86_EFLAGS_TF;
15722- atomic_set(&kgdb_cpu_doing_single_step, -1);
15723+ atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
15724
15725 /* set the trace bit if we're stepping */
15726 if (remcomInBuffer[0] == 's') {
15727 linux_regs->flags |= X86_EFLAGS_TF;
15728- atomic_set(&kgdb_cpu_doing_single_step,
15729+ atomic_set_unchecked(&kgdb_cpu_doing_single_step,
15730 raw_smp_processor_id());
15731 }
15732
15733@@ -534,7 +534,7 @@ static int __kgdb_notify(struct die_args
15734 return NOTIFY_DONE;
15735
15736 case DIE_DEBUG:
15737- if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
15738+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
15739 if (user_mode(regs))
15740 return single_step_cont(regs, args);
15741 break;
15742@@ -710,7 +710,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
15743 regs->ip = ip;
15744 }
15745
15746-struct kgdb_arch arch_kgdb_ops = {
15747+const struct kgdb_arch arch_kgdb_ops = {
15748 /* Breakpoint instruction: */
15749 .gdb_bpt_instr = { 0xcc },
15750 .flags = KGDB_HW_BREAKPOINT,
15751diff -urNp linux-2.6.39.1/arch/x86/kernel/kprobes.c linux-2.6.39.1/arch/x86/kernel/kprobes.c
15752--- linux-2.6.39.1/arch/x86/kernel/kprobes.c 2011-05-19 00:06:34.000000000 -0400
15753+++ linux-2.6.39.1/arch/x86/kernel/kprobes.c 2011-05-22 19:36:30.000000000 -0400
15754@@ -115,8 +115,11 @@ static void __kprobes __synthesize_relat
15755 } __attribute__((packed)) *insn;
15756
15757 insn = (struct __arch_relative_insn *)from;
15758+
15759+ pax_open_kernel();
15760 insn->raddr = (s32)((long)(to) - ((long)(from) + 5));
15761 insn->op = op;
15762+ pax_close_kernel();
15763 }
15764
15765 /* Insert a jump instruction at address 'from', which jumps to address 'to'.*/
15766@@ -153,7 +156,7 @@ static int __kprobes can_boost(kprobe_op
15767 kprobe_opcode_t opcode;
15768 kprobe_opcode_t *orig_opcodes = opcodes;
15769
15770- if (search_exception_tables((unsigned long)opcodes))
15771+ if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
15772 return 0; /* Page fault may occur on this address. */
15773
15774 retry:
15775@@ -314,7 +317,9 @@ static int __kprobes __copy_instruction(
15776 }
15777 }
15778 insn_get_length(&insn);
15779+ pax_open_kernel();
15780 memcpy(dest, insn.kaddr, insn.length);
15781+ pax_close_kernel();
15782
15783 #ifdef CONFIG_X86_64
15784 if (insn_rip_relative(&insn)) {
15785@@ -338,7 +343,9 @@ static int __kprobes __copy_instruction(
15786 (u8 *) dest;
15787 BUG_ON((s64) (s32) newdisp != newdisp); /* Sanity check. */
15788 disp = (u8 *) dest + insn_offset_displacement(&insn);
15789+ pax_open_kernel();
15790 *(s32 *) disp = (s32) newdisp;
15791+ pax_close_kernel();
15792 }
15793 #endif
15794 return insn.length;
15795@@ -352,12 +359,12 @@ static void __kprobes arch_copy_kprobe(s
15796 */
15797 __copy_instruction(p->ainsn.insn, p->addr, 0);
15798
15799- if (can_boost(p->addr))
15800+ if (can_boost(ktla_ktva(p->addr)))
15801 p->ainsn.boostable = 0;
15802 else
15803 p->ainsn.boostable = -1;
15804
15805- p->opcode = *p->addr;
15806+ p->opcode = *(ktla_ktva(p->addr));
15807 }
15808
15809 int __kprobes arch_prepare_kprobe(struct kprobe *p)
15810@@ -474,7 +481,7 @@ static void __kprobes setup_singlestep(s
15811 * nor set current_kprobe, because it doesn't use single
15812 * stepping.
15813 */
15814- regs->ip = (unsigned long)p->ainsn.insn;
15815+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15816 preempt_enable_no_resched();
15817 return;
15818 }
15819@@ -493,7 +500,7 @@ static void __kprobes setup_singlestep(s
15820 if (p->opcode == BREAKPOINT_INSTRUCTION)
15821 regs->ip = (unsigned long)p->addr;
15822 else
15823- regs->ip = (unsigned long)p->ainsn.insn;
15824+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15825 }
15826
15827 /*
15828@@ -572,7 +579,7 @@ static int __kprobes kprobe_handler(stru
15829 setup_singlestep(p, regs, kcb, 0);
15830 return 1;
15831 }
15832- } else if (*addr != BREAKPOINT_INSTRUCTION) {
15833+ } else if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
15834 /*
15835 * The breakpoint instruction was removed right
15836 * after we hit it. Another cpu has removed
15837@@ -817,7 +824,7 @@ static void __kprobes resume_execution(s
15838 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
15839 {
15840 unsigned long *tos = stack_addr(regs);
15841- unsigned long copy_ip = (unsigned long)p->ainsn.insn;
15842+ unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
15843 unsigned long orig_ip = (unsigned long)p->addr;
15844 kprobe_opcode_t *insn = p->ainsn.insn;
15845
15846@@ -999,7 +1006,7 @@ int __kprobes kprobe_exceptions_notify(s
15847 struct die_args *args = data;
15848 int ret = NOTIFY_DONE;
15849
15850- if (args->regs && user_mode_vm(args->regs))
15851+ if (args->regs && user_mode(args->regs))
15852 return ret;
15853
15854 switch (val) {
15855@@ -1381,7 +1388,7 @@ int __kprobes arch_prepare_optimized_kpr
15856 * Verify if the address gap is in 2GB range, because this uses
15857 * a relative jump.
15858 */
15859- rel = (long)op->optinsn.insn - (long)op->kp.addr + RELATIVEJUMP_SIZE;
15860+ rel = (long)op->optinsn.insn - ktla_ktva((long)op->kp.addr) + RELATIVEJUMP_SIZE;
15861 if (abs(rel) > 0x7fffffff)
15862 return -ERANGE;
15863
15864@@ -1402,11 +1409,11 @@ int __kprobes arch_prepare_optimized_kpr
15865 synthesize_set_arg1(buf + TMPL_MOVE_IDX, (unsigned long)op);
15866
15867 /* Set probe function call */
15868- synthesize_relcall(buf + TMPL_CALL_IDX, optimized_callback);
15869+ synthesize_relcall(buf + TMPL_CALL_IDX, ktla_ktva(optimized_callback));
15870
15871 /* Set returning jmp instruction at the tail of out-of-line buffer */
15872 synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size,
15873- (u8 *)op->kp.addr + op->optinsn.size);
15874+ (u8 *)ktla_ktva(op->kp.addr) + op->optinsn.size);
15875
15876 flush_icache_range((unsigned long) buf,
15877 (unsigned long) buf + TMPL_END_IDX +
15878@@ -1428,7 +1435,7 @@ static void __kprobes setup_optimize_kpr
15879 ((long)op->kp.addr + RELATIVEJUMP_SIZE));
15880
15881 /* Backup instructions which will be replaced by jump address */
15882- memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE,
15883+ memcpy(op->optinsn.copied_insn, ktla_ktva(op->kp.addr) + INT3_SIZE,
15884 RELATIVE_ADDR_SIZE);
15885
15886 insn_buf[0] = RELATIVEJUMP_OPCODE;
15887diff -urNp linux-2.6.39.1/arch/x86/kernel/ldt.c linux-2.6.39.1/arch/x86/kernel/ldt.c
15888--- linux-2.6.39.1/arch/x86/kernel/ldt.c 2011-05-19 00:06:34.000000000 -0400
15889+++ linux-2.6.39.1/arch/x86/kernel/ldt.c 2011-05-22 19:36:30.000000000 -0400
15890@@ -67,13 +67,13 @@ static int alloc_ldt(mm_context_t *pc, i
15891 if (reload) {
15892 #ifdef CONFIG_SMP
15893 preempt_disable();
15894- load_LDT(pc);
15895+ load_LDT_nolock(pc);
15896 if (!cpumask_equal(mm_cpumask(current->mm),
15897 cpumask_of(smp_processor_id())))
15898 smp_call_function(flush_ldt, current->mm, 1);
15899 preempt_enable();
15900 #else
15901- load_LDT(pc);
15902+ load_LDT_nolock(pc);
15903 #endif
15904 }
15905 if (oldsize) {
15906@@ -95,7 +95,7 @@ static inline int copy_ldt(mm_context_t
15907 return err;
15908
15909 for (i = 0; i < old->size; i++)
15910- write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
15911+ write_ldt_entry(new->ldt, i, old->ldt + i);
15912 return 0;
15913 }
15914
15915@@ -116,6 +116,24 @@ int init_new_context(struct task_struct
15916 retval = copy_ldt(&mm->context, &old_mm->context);
15917 mutex_unlock(&old_mm->context.lock);
15918 }
15919+
15920+ if (tsk == current) {
15921+ mm->context.vdso = 0;
15922+
15923+#ifdef CONFIG_X86_32
15924+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
15925+ mm->context.user_cs_base = 0UL;
15926+ mm->context.user_cs_limit = ~0UL;
15927+
15928+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
15929+ cpus_clear(mm->context.cpu_user_cs_mask);
15930+#endif
15931+
15932+#endif
15933+#endif
15934+
15935+ }
15936+
15937 return retval;
15938 }
15939
15940@@ -230,6 +248,13 @@ static int write_ldt(void __user *ptr, u
15941 }
15942 }
15943
15944+#ifdef CONFIG_PAX_SEGMEXEC
15945+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
15946+ error = -EINVAL;
15947+ goto out_unlock;
15948+ }
15949+#endif
15950+
15951 fill_ldt(&ldt, &ldt_info);
15952 if (oldmode)
15953 ldt.avl = 0;
15954diff -urNp linux-2.6.39.1/arch/x86/kernel/machine_kexec_32.c linux-2.6.39.1/arch/x86/kernel/machine_kexec_32.c
15955--- linux-2.6.39.1/arch/x86/kernel/machine_kexec_32.c 2011-05-19 00:06:34.000000000 -0400
15956+++ linux-2.6.39.1/arch/x86/kernel/machine_kexec_32.c 2011-05-22 19:36:30.000000000 -0400
15957@@ -27,7 +27,7 @@
15958 #include <asm/cacheflush.h>
15959 #include <asm/debugreg.h>
15960
15961-static void set_idt(void *newidt, __u16 limit)
15962+static void set_idt(struct desc_struct *newidt, __u16 limit)
15963 {
15964 struct desc_ptr curidt;
15965
15966@@ -39,7 +39,7 @@ static void set_idt(void *newidt, __u16
15967 }
15968
15969
15970-static void set_gdt(void *newgdt, __u16 limit)
15971+static void set_gdt(struct desc_struct *newgdt, __u16 limit)
15972 {
15973 struct desc_ptr curgdt;
15974
15975@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
15976 }
15977
15978 control_page = page_address(image->control_code_page);
15979- memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
15980+ memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
15981
15982 relocate_kernel_ptr = control_page;
15983 page_list[PA_CONTROL_PAGE] = __pa(control_page);
15984diff -urNp linux-2.6.39.1/arch/x86/kernel/microcode_amd.c linux-2.6.39.1/arch/x86/kernel/microcode_amd.c
15985--- linux-2.6.39.1/arch/x86/kernel/microcode_amd.c 2011-05-19 00:06:34.000000000 -0400
15986+++ linux-2.6.39.1/arch/x86/kernel/microcode_amd.c 2011-05-22 19:36:30.000000000 -0400
15987@@ -339,7 +339,7 @@ static void microcode_fini_cpu_amd(int c
15988 uci->mc = NULL;
15989 }
15990
15991-static struct microcode_ops microcode_amd_ops = {
15992+static const struct microcode_ops microcode_amd_ops = {
15993 .request_microcode_user = request_microcode_user,
15994 .request_microcode_fw = request_microcode_amd,
15995 .collect_cpu_info = collect_cpu_info_amd,
15996@@ -347,7 +347,7 @@ static struct microcode_ops microcode_am
15997 .microcode_fini_cpu = microcode_fini_cpu_amd,
15998 };
15999
16000-struct microcode_ops * __init init_amd_microcode(void)
16001+const struct microcode_ops * __init init_amd_microcode(void)
16002 {
16003 return &microcode_amd_ops;
16004 }
16005diff -urNp linux-2.6.39.1/arch/x86/kernel/microcode_core.c linux-2.6.39.1/arch/x86/kernel/microcode_core.c
16006--- linux-2.6.39.1/arch/x86/kernel/microcode_core.c 2011-05-19 00:06:34.000000000 -0400
16007+++ linux-2.6.39.1/arch/x86/kernel/microcode_core.c 2011-05-22 19:36:30.000000000 -0400
16008@@ -93,7 +93,7 @@ MODULE_LICENSE("GPL");
16009
16010 #define MICROCODE_VERSION "2.00"
16011
16012-static struct microcode_ops *microcode_ops;
16013+static const struct microcode_ops *microcode_ops;
16014
16015 /*
16016 * Synchronization.
16017diff -urNp linux-2.6.39.1/arch/x86/kernel/microcode_intel.c linux-2.6.39.1/arch/x86/kernel/microcode_intel.c
16018--- linux-2.6.39.1/arch/x86/kernel/microcode_intel.c 2011-05-19 00:06:34.000000000 -0400
16019+++ linux-2.6.39.1/arch/x86/kernel/microcode_intel.c 2011-05-22 19:36:30.000000000 -0400
16020@@ -440,13 +440,13 @@ static enum ucode_state request_microcod
16021
16022 static int get_ucode_user(void *to, const void *from, size_t n)
16023 {
16024- return copy_from_user(to, from, n);
16025+ return copy_from_user(to, (__force const void __user *)from, n);
16026 }
16027
16028 static enum ucode_state
16029 request_microcode_user(int cpu, const void __user *buf, size_t size)
16030 {
16031- return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
16032+ return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user);
16033 }
16034
16035 static void microcode_fini_cpu(int cpu)
16036@@ -457,7 +457,7 @@ static void microcode_fini_cpu(int cpu)
16037 uci->mc = NULL;
16038 }
16039
16040-static struct microcode_ops microcode_intel_ops = {
16041+static const struct microcode_ops microcode_intel_ops = {
16042 .request_microcode_user = request_microcode_user,
16043 .request_microcode_fw = request_microcode_fw,
16044 .collect_cpu_info = collect_cpu_info,
16045@@ -465,7 +465,7 @@ static struct microcode_ops microcode_in
16046 .microcode_fini_cpu = microcode_fini_cpu,
16047 };
16048
16049-struct microcode_ops * __init init_intel_microcode(void)
16050+const struct microcode_ops * __init init_intel_microcode(void)
16051 {
16052 return &microcode_intel_ops;
16053 }
16054diff -urNp linux-2.6.39.1/arch/x86/kernel/module.c linux-2.6.39.1/arch/x86/kernel/module.c
16055--- linux-2.6.39.1/arch/x86/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
16056+++ linux-2.6.39.1/arch/x86/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
16057@@ -35,21 +35,66 @@
16058 #define DEBUGP(fmt...)
16059 #endif
16060
16061-void *module_alloc(unsigned long size)
16062+static inline void *__module_alloc(unsigned long size, pgprot_t prot)
16063 {
16064 if (PAGE_ALIGN(size) > MODULES_LEN)
16065 return NULL;
16066 return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
16067- GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
16068+ GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot,
16069 -1, __builtin_return_address(0));
16070 }
16071
16072+void *module_alloc(unsigned long size)
16073+{
16074+
16075+#ifdef CONFIG_PAX_KERNEXEC
16076+ return __module_alloc(size, PAGE_KERNEL);
16077+#else
16078+ return __module_alloc(size, PAGE_KERNEL_EXEC);
16079+#endif
16080+
16081+}
16082+
16083 /* Free memory returned from module_alloc */
16084 void module_free(struct module *mod, void *module_region)
16085 {
16086 vfree(module_region);
16087 }
16088
16089+#ifdef CONFIG_PAX_KERNEXEC
16090+#ifdef CONFIG_X86_32
16091+void *module_alloc_exec(unsigned long size)
16092+{
16093+ struct vm_struct *area;
16094+
16095+ if (size == 0)
16096+ return NULL;
16097+
16098+ area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
16099+ return area ? area->addr : NULL;
16100+}
16101+EXPORT_SYMBOL(module_alloc_exec);
16102+
16103+void module_free_exec(struct module *mod, void *module_region)
16104+{
16105+ vunmap(module_region);
16106+}
16107+EXPORT_SYMBOL(module_free_exec);
16108+#else
16109+void module_free_exec(struct module *mod, void *module_region)
16110+{
16111+ module_free(mod, module_region);
16112+}
16113+EXPORT_SYMBOL(module_free_exec);
16114+
16115+void *module_alloc_exec(unsigned long size)
16116+{
16117+ return __module_alloc(size, PAGE_KERNEL_RX);
16118+}
16119+EXPORT_SYMBOL(module_alloc_exec);
16120+#endif
16121+#endif
16122+
16123 /* We don't need anything special. */
16124 int module_frob_arch_sections(Elf_Ehdr *hdr,
16125 Elf_Shdr *sechdrs,
16126@@ -69,14 +114,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
16127 unsigned int i;
16128 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
16129 Elf32_Sym *sym;
16130- uint32_t *location;
16131+ uint32_t *plocation, location;
16132
16133 DEBUGP("Applying relocate section %u to %u\n", relsec,
16134 sechdrs[relsec].sh_info);
16135 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
16136 /* This is where to make the change */
16137- location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
16138- + rel[i].r_offset;
16139+ plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
16140+ location = (uint32_t)plocation;
16141+ if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
16142+ plocation = ktla_ktva((void *)plocation);
16143 /* This is the symbol it is referring to. Note that all
16144 undefined symbols have been resolved. */
16145 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
16146@@ -85,11 +132,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
16147 switch (ELF32_R_TYPE(rel[i].r_info)) {
16148 case R_386_32:
16149 /* We add the value into the location given */
16150- *location += sym->st_value;
16151+ pax_open_kernel();
16152+ *plocation += sym->st_value;
16153+ pax_close_kernel();
16154 break;
16155 case R_386_PC32:
16156 /* Add the value, subtract its postition */
16157- *location += sym->st_value - (uint32_t)location;
16158+ pax_open_kernel();
16159+ *plocation += sym->st_value - location;
16160+ pax_close_kernel();
16161 break;
16162 default:
16163 printk(KERN_ERR "module %s: Unknown relocation: %u\n",
16164@@ -145,21 +196,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
16165 case R_X86_64_NONE:
16166 break;
16167 case R_X86_64_64:
16168+ pax_open_kernel();
16169 *(u64 *)loc = val;
16170+ pax_close_kernel();
16171 break;
16172 case R_X86_64_32:
16173+ pax_open_kernel();
16174 *(u32 *)loc = val;
16175+ pax_close_kernel();
16176 if (val != *(u32 *)loc)
16177 goto overflow;
16178 break;
16179 case R_X86_64_32S:
16180+ pax_open_kernel();
16181 *(s32 *)loc = val;
16182+ pax_close_kernel();
16183 if ((s64)val != *(s32 *)loc)
16184 goto overflow;
16185 break;
16186 case R_X86_64_PC32:
16187 val -= (u64)loc;
16188+ pax_open_kernel();
16189 *(u32 *)loc = val;
16190+ pax_close_kernel();
16191+
16192 #if 0
16193 if ((s64)val != *(s32 *)loc)
16194 goto overflow;
16195diff -urNp linux-2.6.39.1/arch/x86/kernel/paravirt.c linux-2.6.39.1/arch/x86/kernel/paravirt.c
16196--- linux-2.6.39.1/arch/x86/kernel/paravirt.c 2011-05-19 00:06:34.000000000 -0400
16197+++ linux-2.6.39.1/arch/x86/kernel/paravirt.c 2011-05-22 19:36:30.000000000 -0400
16198@@ -122,7 +122,7 @@ unsigned paravirt_patch_jmp(void *insnbu
16199 * corresponding structure. */
16200 static void *get_call_destination(u8 type)
16201 {
16202- struct paravirt_patch_template tmpl = {
16203+ const struct paravirt_patch_template tmpl = {
16204 .pv_init_ops = pv_init_ops,
16205 .pv_time_ops = pv_time_ops,
16206 .pv_cpu_ops = pv_cpu_ops,
16207@@ -133,6 +133,9 @@ static void *get_call_destination(u8 typ
16208 .pv_lock_ops = pv_lock_ops,
16209 #endif
16210 };
16211+
16212+ pax_track_stack();
16213+
16214 return *((void **)&tmpl + type);
16215 }
16216
16217@@ -145,14 +148,14 @@ unsigned paravirt_patch_default(u8 type,
16218 if (opfunc == NULL)
16219 /* If there's no function, patch it with a ud2a (BUG) */
16220 ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
16221- else if (opfunc == _paravirt_nop)
16222+ else if (opfunc == (void *)_paravirt_nop)
16223 /* If the operation is a nop, then nop the callsite */
16224 ret = paravirt_patch_nop();
16225
16226 /* identity functions just return their single argument */
16227- else if (opfunc == _paravirt_ident_32)
16228+ else if (opfunc == (void *)_paravirt_ident_32)
16229 ret = paravirt_patch_ident_32(insnbuf, len);
16230- else if (opfunc == _paravirt_ident_64)
16231+ else if (opfunc == (void *)_paravirt_ident_64)
16232 ret = paravirt_patch_ident_64(insnbuf, len);
16233
16234 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
16235@@ -178,7 +181,7 @@ unsigned paravirt_patch_insns(void *insn
16236 if (insn_len > len || start == NULL)
16237 insn_len = len;
16238 else
16239- memcpy(insnbuf, start, insn_len);
16240+ memcpy(insnbuf, ktla_ktva(start), insn_len);
16241
16242 return insn_len;
16243 }
16244@@ -294,22 +297,22 @@ void arch_flush_lazy_mmu_mode(void)
16245 preempt_enable();
16246 }
16247
16248-struct pv_info pv_info = {
16249+struct pv_info pv_info __read_only = {
16250 .name = "bare hardware",
16251 .paravirt_enabled = 0,
16252 .kernel_rpl = 0,
16253 .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */
16254 };
16255
16256-struct pv_init_ops pv_init_ops = {
16257+struct pv_init_ops pv_init_ops __read_only = {
16258 .patch = native_patch,
16259 };
16260
16261-struct pv_time_ops pv_time_ops = {
16262+struct pv_time_ops pv_time_ops __read_only = {
16263 .sched_clock = native_sched_clock,
16264 };
16265
16266-struct pv_irq_ops pv_irq_ops = {
16267+struct pv_irq_ops pv_irq_ops __read_only = {
16268 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
16269 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
16270 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
16271@@ -321,7 +324,7 @@ struct pv_irq_ops pv_irq_ops = {
16272 #endif
16273 };
16274
16275-struct pv_cpu_ops pv_cpu_ops = {
16276+struct pv_cpu_ops pv_cpu_ops __read_only = {
16277 .cpuid = native_cpuid,
16278 .get_debugreg = native_get_debugreg,
16279 .set_debugreg = native_set_debugreg,
16280@@ -382,7 +385,7 @@ struct pv_cpu_ops pv_cpu_ops = {
16281 .end_context_switch = paravirt_nop,
16282 };
16283
16284-struct pv_apic_ops pv_apic_ops = {
16285+struct pv_apic_ops pv_apic_ops __read_only = {
16286 #ifdef CONFIG_X86_LOCAL_APIC
16287 .startup_ipi_hook = paravirt_nop,
16288 #endif
16289@@ -396,7 +399,7 @@ struct pv_apic_ops pv_apic_ops = {
16290 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
16291 #endif
16292
16293-struct pv_mmu_ops pv_mmu_ops = {
16294+struct pv_mmu_ops pv_mmu_ops __read_only = {
16295
16296 .read_cr2 = native_read_cr2,
16297 .write_cr2 = native_write_cr2,
16298@@ -465,6 +468,12 @@ struct pv_mmu_ops pv_mmu_ops = {
16299 },
16300
16301 .set_fixmap = native_set_fixmap,
16302+
16303+#ifdef CONFIG_PAX_KERNEXEC
16304+ .pax_open_kernel = native_pax_open_kernel,
16305+ .pax_close_kernel = native_pax_close_kernel,
16306+#endif
16307+
16308 };
16309
16310 EXPORT_SYMBOL_GPL(pv_time_ops);
16311diff -urNp linux-2.6.39.1/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.39.1/arch/x86/kernel/paravirt-spinlocks.c
16312--- linux-2.6.39.1/arch/x86/kernel/paravirt-spinlocks.c 2011-05-19 00:06:34.000000000 -0400
16313+++ linux-2.6.39.1/arch/x86/kernel/paravirt-spinlocks.c 2011-05-22 19:36:30.000000000 -0400
16314@@ -13,7 +13,7 @@ default_spin_lock_flags(arch_spinlock_t
16315 arch_spin_lock(lock);
16316 }
16317
16318-struct pv_lock_ops pv_lock_ops = {
16319+struct pv_lock_ops pv_lock_ops __read_only = {
16320 #ifdef CONFIG_SMP
16321 .spin_is_locked = __ticket_spin_is_locked,
16322 .spin_is_contended = __ticket_spin_is_contended,
16323diff -urNp linux-2.6.39.1/arch/x86/kernel/pci-calgary_64.c linux-2.6.39.1/arch/x86/kernel/pci-calgary_64.c
16324--- linux-2.6.39.1/arch/x86/kernel/pci-calgary_64.c 2011-05-19 00:06:34.000000000 -0400
16325+++ linux-2.6.39.1/arch/x86/kernel/pci-calgary_64.c 2011-05-22 19:36:30.000000000 -0400
16326@@ -179,13 +179,13 @@ static void calioc2_dump_error_regs(stru
16327 static void calgary_init_bitmap_from_tce_table(struct iommu_table *tbl);
16328 static void get_tce_space_from_tar(void);
16329
16330-static struct cal_chipset_ops calgary_chip_ops = {
16331+static const struct cal_chipset_ops calgary_chip_ops = {
16332 .handle_quirks = calgary_handle_quirks,
16333 .tce_cache_blast = calgary_tce_cache_blast,
16334 .dump_error_regs = calgary_dump_error_regs
16335 };
16336
16337-static struct cal_chipset_ops calioc2_chip_ops = {
16338+static const struct cal_chipset_ops calioc2_chip_ops = {
16339 .handle_quirks = calioc2_handle_quirks,
16340 .tce_cache_blast = calioc2_tce_cache_blast,
16341 .dump_error_regs = calioc2_dump_error_regs
16342@@ -476,7 +476,7 @@ static void calgary_free_coherent(struct
16343 free_pages((unsigned long)vaddr, get_order(size));
16344 }
16345
16346-static struct dma_map_ops calgary_dma_ops = {
16347+static const struct dma_map_ops calgary_dma_ops = {
16348 .alloc_coherent = calgary_alloc_coherent,
16349 .free_coherent = calgary_free_coherent,
16350 .map_sg = calgary_map_sg,
16351diff -urNp linux-2.6.39.1/arch/x86/kernel/pci-dma.c linux-2.6.39.1/arch/x86/kernel/pci-dma.c
16352--- linux-2.6.39.1/arch/x86/kernel/pci-dma.c 2011-05-19 00:06:34.000000000 -0400
16353+++ linux-2.6.39.1/arch/x86/kernel/pci-dma.c 2011-05-22 19:36:30.000000000 -0400
16354@@ -16,7 +16,7 @@
16355
16356 static int forbid_dac __read_mostly;
16357
16358-struct dma_map_ops *dma_ops = &nommu_dma_ops;
16359+const struct dma_map_ops *dma_ops = &nommu_dma_ops;
16360 EXPORT_SYMBOL(dma_ops);
16361
16362 static int iommu_sac_force __read_mostly;
16363@@ -250,7 +250,7 @@ early_param("iommu", iommu_setup);
16364
16365 int dma_supported(struct device *dev, u64 mask)
16366 {
16367- struct dma_map_ops *ops = get_dma_ops(dev);
16368+ const struct dma_map_ops *ops = get_dma_ops(dev);
16369
16370 #ifdef CONFIG_PCI
16371 if (mask > 0xffffffff && forbid_dac > 0) {
16372diff -urNp linux-2.6.39.1/arch/x86/kernel/pci-gart_64.c linux-2.6.39.1/arch/x86/kernel/pci-gart_64.c
16373--- linux-2.6.39.1/arch/x86/kernel/pci-gart_64.c 2011-05-19 00:06:34.000000000 -0400
16374+++ linux-2.6.39.1/arch/x86/kernel/pci-gart_64.c 2011-05-22 19:36:30.000000000 -0400
16375@@ -695,7 +695,7 @@ static __init int init_amd_gatt(struct a
16376 return -1;
16377 }
16378
16379-static struct dma_map_ops gart_dma_ops = {
16380+static const struct dma_map_ops gart_dma_ops = {
16381 .map_sg = gart_map_sg,
16382 .unmap_sg = gart_unmap_sg,
16383 .map_page = gart_map_page,
16384diff -urNp linux-2.6.39.1/arch/x86/kernel/pci-iommu_table.c linux-2.6.39.1/arch/x86/kernel/pci-iommu_table.c
16385--- linux-2.6.39.1/arch/x86/kernel/pci-iommu_table.c 2011-05-19 00:06:34.000000000 -0400
16386+++ linux-2.6.39.1/arch/x86/kernel/pci-iommu_table.c 2011-05-22 19:36:30.000000000 -0400
16387@@ -2,7 +2,7 @@
16388 #include <asm/iommu_table.h>
16389 #include <linux/string.h>
16390 #include <linux/kallsyms.h>
16391-
16392+#include <linux/sched.h>
16393
16394 #define DEBUG 1
16395
16396@@ -53,6 +53,8 @@ void __init check_iommu_entries(struct i
16397 char sym_p[KSYM_SYMBOL_LEN];
16398 char sym_q[KSYM_SYMBOL_LEN];
16399
16400+ pax_track_stack();
16401+
16402 /* Simple cyclic dependency checker. */
16403 for (p = start; p < finish; p++) {
16404 q = find_dependents_of(start, finish, p);
16405diff -urNp linux-2.6.39.1/arch/x86/kernel/pci-nommu.c linux-2.6.39.1/arch/x86/kernel/pci-nommu.c
16406--- linux-2.6.39.1/arch/x86/kernel/pci-nommu.c 2011-05-19 00:06:34.000000000 -0400
16407+++ linux-2.6.39.1/arch/x86/kernel/pci-nommu.c 2011-05-22 19:36:30.000000000 -0400
16408@@ -95,7 +95,7 @@ static void nommu_sync_sg_for_device(str
16409 flush_write_buffers();
16410 }
16411
16412-struct dma_map_ops nommu_dma_ops = {
16413+const struct dma_map_ops nommu_dma_ops = {
16414 .alloc_coherent = dma_generic_alloc_coherent,
16415 .free_coherent = nommu_free_coherent,
16416 .map_sg = nommu_map_sg,
16417diff -urNp linux-2.6.39.1/arch/x86/kernel/pci-swiotlb.c linux-2.6.39.1/arch/x86/kernel/pci-swiotlb.c
16418--- linux-2.6.39.1/arch/x86/kernel/pci-swiotlb.c 2011-05-19 00:06:34.000000000 -0400
16419+++ linux-2.6.39.1/arch/x86/kernel/pci-swiotlb.c 2011-05-22 19:36:30.000000000 -0400
16420@@ -26,7 +26,7 @@ static void *x86_swiotlb_alloc_coherent(
16421 return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
16422 }
16423
16424-static struct dma_map_ops swiotlb_dma_ops = {
16425+static const struct dma_map_ops swiotlb_dma_ops = {
16426 .mapping_error = swiotlb_dma_mapping_error,
16427 .alloc_coherent = x86_swiotlb_alloc_coherent,
16428 .free_coherent = swiotlb_free_coherent,
16429diff -urNp linux-2.6.39.1/arch/x86/kernel/process_32.c linux-2.6.39.1/arch/x86/kernel/process_32.c
16430--- linux-2.6.39.1/arch/x86/kernel/process_32.c 2011-05-19 00:06:34.000000000 -0400
16431+++ linux-2.6.39.1/arch/x86/kernel/process_32.c 2011-05-22 19:36:30.000000000 -0400
16432@@ -65,6 +65,7 @@ asmlinkage void ret_from_fork(void) __as
16433 unsigned long thread_saved_pc(struct task_struct *tsk)
16434 {
16435 return ((unsigned long *)tsk->thread.sp)[3];
16436+//XXX return tsk->thread.eip;
16437 }
16438
16439 #ifndef CONFIG_SMP
16440@@ -126,15 +127,14 @@ void __show_regs(struct pt_regs *regs, i
16441 unsigned long sp;
16442 unsigned short ss, gs;
16443
16444- if (user_mode_vm(regs)) {
16445+ if (user_mode(regs)) {
16446 sp = regs->sp;
16447 ss = regs->ss & 0xffff;
16448- gs = get_user_gs(regs);
16449 } else {
16450 sp = kernel_stack_pointer(regs);
16451 savesegment(ss, ss);
16452- savesegment(gs, gs);
16453 }
16454+ gs = get_user_gs(regs);
16455
16456 show_regs_common();
16457
16458@@ -196,13 +196,14 @@ int copy_thread(unsigned long clone_flag
16459 struct task_struct *tsk;
16460 int err;
16461
16462- childregs = task_pt_regs(p);
16463+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
16464 *childregs = *regs;
16465 childregs->ax = 0;
16466 childregs->sp = sp;
16467
16468 p->thread.sp = (unsigned long) childregs;
16469 p->thread.sp0 = (unsigned long) (childregs+1);
16470+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16471
16472 p->thread.ip = (unsigned long) ret_from_fork;
16473
16474@@ -293,7 +294,7 @@ __switch_to(struct task_struct *prev_p,
16475 struct thread_struct *prev = &prev_p->thread,
16476 *next = &next_p->thread;
16477 int cpu = smp_processor_id();
16478- struct tss_struct *tss = &per_cpu(init_tss, cpu);
16479+ struct tss_struct *tss = init_tss + cpu;
16480 bool preload_fpu;
16481
16482 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
16483@@ -328,6 +329,10 @@ __switch_to(struct task_struct *prev_p,
16484 */
16485 lazy_save_gs(prev->gs);
16486
16487+#ifdef CONFIG_PAX_MEMORY_UDEREF
16488+ __set_fs(task_thread_info(next_p)->addr_limit);
16489+#endif
16490+
16491 /*
16492 * Load the per-thread Thread-Local Storage descriptor.
16493 */
16494@@ -363,6 +368,9 @@ __switch_to(struct task_struct *prev_p,
16495 */
16496 arch_end_context_switch(next_p);
16497
16498+ percpu_write(current_task, next_p);
16499+ percpu_write(current_tinfo, &next_p->tinfo);
16500+
16501 if (preload_fpu)
16502 __math_state_restore();
16503
16504@@ -372,8 +380,6 @@ __switch_to(struct task_struct *prev_p,
16505 if (prev->gs | next->gs)
16506 lazy_load_gs(next->gs);
16507
16508- percpu_write(current_task, next_p);
16509-
16510 return prev_p;
16511 }
16512
16513@@ -403,4 +409,3 @@ unsigned long get_wchan(struct task_stru
16514 } while (count++ < 16);
16515 return 0;
16516 }
16517-
16518diff -urNp linux-2.6.39.1/arch/x86/kernel/process_64.c linux-2.6.39.1/arch/x86/kernel/process_64.c
16519--- linux-2.6.39.1/arch/x86/kernel/process_64.c 2011-05-19 00:06:34.000000000 -0400
16520+++ linux-2.6.39.1/arch/x86/kernel/process_64.c 2011-05-22 19:36:30.000000000 -0400
16521@@ -87,7 +87,7 @@ static void __exit_idle(void)
16522 void exit_idle(void)
16523 {
16524 /* idle loop has pid 0 */
16525- if (current->pid)
16526+ if (task_pid_nr(current))
16527 return;
16528 __exit_idle();
16529 }
16530@@ -260,8 +260,7 @@ int copy_thread(unsigned long clone_flag
16531 struct pt_regs *childregs;
16532 struct task_struct *me = current;
16533
16534- childregs = ((struct pt_regs *)
16535- (THREAD_SIZE + task_stack_page(p))) - 1;
16536+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
16537 *childregs = *regs;
16538
16539 childregs->ax = 0;
16540@@ -273,6 +272,7 @@ int copy_thread(unsigned long clone_flag
16541 p->thread.sp = (unsigned long) childregs;
16542 p->thread.sp0 = (unsigned long) (childregs+1);
16543 p->thread.usersp = me->thread.usersp;
16544+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16545
16546 set_tsk_thread_flag(p, TIF_FORK);
16547
16548@@ -376,7 +376,7 @@ __switch_to(struct task_struct *prev_p,
16549 struct thread_struct *prev = &prev_p->thread;
16550 struct thread_struct *next = &next_p->thread;
16551 int cpu = smp_processor_id();
16552- struct tss_struct *tss = &per_cpu(init_tss, cpu);
16553+ struct tss_struct *tss = init_tss + cpu;
16554 unsigned fsindex, gsindex;
16555 bool preload_fpu;
16556
16557@@ -472,10 +472,9 @@ __switch_to(struct task_struct *prev_p,
16558 prev->usersp = percpu_read(old_rsp);
16559 percpu_write(old_rsp, next->usersp);
16560 percpu_write(current_task, next_p);
16561+ percpu_write(current_tinfo, &next_p->tinfo);
16562
16563- percpu_write(kernel_stack,
16564- (unsigned long)task_stack_page(next_p) +
16565- THREAD_SIZE - KERNEL_STACK_OFFSET);
16566+ percpu_write(kernel_stack, next->sp0);
16567
16568 /*
16569 * Now maybe reload the debug registers and handle I/O bitmaps
16570@@ -537,12 +536,11 @@ unsigned long get_wchan(struct task_stru
16571 if (!p || p == current || p->state == TASK_RUNNING)
16572 return 0;
16573 stack = (unsigned long)task_stack_page(p);
16574- if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
16575+ if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
16576 return 0;
16577 fp = *(u64 *)(p->thread.sp);
16578 do {
16579- if (fp < (unsigned long)stack ||
16580- fp >= (unsigned long)stack+THREAD_SIZE)
16581+ if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
16582 return 0;
16583 ip = *(u64 *)(fp+8);
16584 if (!in_sched_functions(ip))
16585diff -urNp linux-2.6.39.1/arch/x86/kernel/process.c linux-2.6.39.1/arch/x86/kernel/process.c
16586--- linux-2.6.39.1/arch/x86/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
16587+++ linux-2.6.39.1/arch/x86/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
16588@@ -48,16 +48,33 @@ void free_thread_xstate(struct task_stru
16589
16590 void free_thread_info(struct thread_info *ti)
16591 {
16592- free_thread_xstate(ti->task);
16593 free_pages((unsigned long)ti, get_order(THREAD_SIZE));
16594 }
16595
16596+static struct kmem_cache *task_struct_cachep;
16597+
16598 void arch_task_cache_init(void)
16599 {
16600- task_xstate_cachep =
16601- kmem_cache_create("task_xstate", xstate_size,
16602+ /* create a slab on which task_structs can be allocated */
16603+ task_struct_cachep =
16604+ kmem_cache_create("task_struct", sizeof(struct task_struct),
16605+ ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
16606+
16607+ task_xstate_cachep =
16608+ kmem_cache_create("task_xstate", xstate_size,
16609 __alignof__(union thread_xstate),
16610- SLAB_PANIC | SLAB_NOTRACK, NULL);
16611+ SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
16612+}
16613+
16614+struct task_struct *alloc_task_struct_node(int node)
16615+{
16616+ return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node);
16617+}
16618+
16619+void free_task_struct(struct task_struct *task)
16620+{
16621+ free_thread_xstate(task);
16622+ kmem_cache_free(task_struct_cachep, task);
16623 }
16624
16625 /*
16626@@ -70,7 +87,7 @@ void exit_thread(void)
16627 unsigned long *bp = t->io_bitmap_ptr;
16628
16629 if (bp) {
16630- struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
16631+ struct tss_struct *tss = init_tss + get_cpu();
16632
16633 t->io_bitmap_ptr = NULL;
16634 clear_thread_flag(TIF_IO_BITMAP);
16635@@ -106,7 +123,7 @@ void show_regs_common(void)
16636
16637 printk(KERN_CONT "\n");
16638 printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s",
16639- current->pid, current->comm, print_tainted(),
16640+ task_pid_nr(current), current->comm, print_tainted(),
16641 init_utsname()->release,
16642 (int)strcspn(init_utsname()->version, " "),
16643 init_utsname()->version);
16644@@ -120,6 +137,9 @@ void flush_thread(void)
16645 {
16646 struct task_struct *tsk = current;
16647
16648+#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
16649+ loadsegment(gs, 0);
16650+#endif
16651 flush_ptrace_hw_breakpoint(tsk);
16652 memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
16653 /*
16654@@ -282,10 +302,10 @@ int kernel_thread(int (*fn)(void *), voi
16655 regs.di = (unsigned long) arg;
16656
16657 #ifdef CONFIG_X86_32
16658- regs.ds = __USER_DS;
16659- regs.es = __USER_DS;
16660+ regs.ds = __KERNEL_DS;
16661+ regs.es = __KERNEL_DS;
16662 regs.fs = __KERNEL_PERCPU;
16663- regs.gs = __KERNEL_STACK_CANARY;
16664+ savesegment(gs, regs.gs);
16665 #else
16666 regs.ss = __KERNEL_DS;
16667 #endif
16668@@ -401,7 +421,7 @@ void default_idle(void)
16669 EXPORT_SYMBOL(default_idle);
16670 #endif
16671
16672-void stop_this_cpu(void *dummy)
16673+__noreturn void stop_this_cpu(void *dummy)
16674 {
16675 local_irq_disable();
16676 /*
16677@@ -665,16 +685,34 @@ static int __init idle_setup(char *str)
16678 }
16679 early_param("idle", idle_setup);
16680
16681-unsigned long arch_align_stack(unsigned long sp)
16682+#ifdef CONFIG_PAX_RANDKSTACK
16683+asmlinkage void pax_randomize_kstack(void)
16684 {
16685- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
16686- sp -= get_random_int() % 8192;
16687- return sp & ~0xf;
16688-}
16689+ struct thread_struct *thread = &current->thread;
16690+ unsigned long time;
16691
16692-unsigned long arch_randomize_brk(struct mm_struct *mm)
16693-{
16694- unsigned long range_end = mm->brk + 0x02000000;
16695- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
16696-}
16697+ if (!randomize_va_space)
16698+ return;
16699+
16700+ rdtscl(time);
16701+
16702+ /* P4 seems to return a 0 LSB, ignore it */
16703+#ifdef CONFIG_MPENTIUM4
16704+ time &= 0x3EUL;
16705+ time <<= 2;
16706+#elif defined(CONFIG_X86_64)
16707+ time &= 0xFUL;
16708+ time <<= 4;
16709+#else
16710+ time &= 0x1FUL;
16711+ time <<= 3;
16712+#endif
16713+
16714+ thread->sp0 ^= time;
16715+ load_sp0(init_tss + smp_processor_id(), thread);
16716
16717+#ifdef CONFIG_X86_64
16718+ percpu_write(kernel_stack, thread->sp0);
16719+#endif
16720+}
16721+#endif
16722diff -urNp linux-2.6.39.1/arch/x86/kernel/ptrace.c linux-2.6.39.1/arch/x86/kernel/ptrace.c
16723--- linux-2.6.39.1/arch/x86/kernel/ptrace.c 2011-05-19 00:06:34.000000000 -0400
16724+++ linux-2.6.39.1/arch/x86/kernel/ptrace.c 2011-05-22 19:36:30.000000000 -0400
16725@@ -821,7 +821,7 @@ long arch_ptrace(struct task_struct *chi
16726 unsigned long addr, unsigned long data)
16727 {
16728 int ret;
16729- unsigned long __user *datap = (unsigned long __user *)data;
16730+ unsigned long __user *datap = (__force unsigned long __user *)data;
16731
16732 switch (request) {
16733 /* read the word at location addr in the USER area. */
16734@@ -906,14 +906,14 @@ long arch_ptrace(struct task_struct *chi
16735 if ((int) addr < 0)
16736 return -EIO;
16737 ret = do_get_thread_area(child, addr,
16738- (struct user_desc __user *)data);
16739+ (__force struct user_desc __user *) data);
16740 break;
16741
16742 case PTRACE_SET_THREAD_AREA:
16743 if ((int) addr < 0)
16744 return -EIO;
16745 ret = do_set_thread_area(child, addr,
16746- (struct user_desc __user *)data, 0);
16747+ (__force struct user_desc __user *) data, 0);
16748 break;
16749 #endif
16750
16751@@ -1330,7 +1330,7 @@ static void fill_sigtrap_info(struct tas
16752 memset(info, 0, sizeof(*info));
16753 info->si_signo = SIGTRAP;
16754 info->si_code = si_code;
16755- info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL;
16756+ info->si_addr = user_mode(regs) ? (__force void __user *)regs->ip : NULL;
16757 }
16758
16759 void user_single_step_siginfo(struct task_struct *tsk,
16760@@ -1363,7 +1363,7 @@ void send_sigtrap(struct task_struct *ts
16761 * We must return the syscall number to actually look up in the table.
16762 * This can be -1L to skip running any syscall at all.
16763 */
16764-asmregparm long syscall_trace_enter(struct pt_regs *regs)
16765+long syscall_trace_enter(struct pt_regs *regs)
16766 {
16767 long ret = 0;
16768
16769@@ -1408,7 +1408,7 @@ asmregparm long syscall_trace_enter(stru
16770 return ret ?: regs->orig_ax;
16771 }
16772
16773-asmregparm void syscall_trace_leave(struct pt_regs *regs)
16774+void syscall_trace_leave(struct pt_regs *regs)
16775 {
16776 bool step;
16777
16778diff -urNp linux-2.6.39.1/arch/x86/kernel/pvclock.c linux-2.6.39.1/arch/x86/kernel/pvclock.c
16779--- linux-2.6.39.1/arch/x86/kernel/pvclock.c 2011-05-19 00:06:34.000000000 -0400
16780+++ linux-2.6.39.1/arch/x86/kernel/pvclock.c 2011-05-22 19:36:30.000000000 -0400
16781@@ -81,11 +81,11 @@ unsigned long pvclock_tsc_khz(struct pvc
16782 return pv_tsc_khz;
16783 }
16784
16785-static atomic64_t last_value = ATOMIC64_INIT(0);
16786+static atomic64_unchecked_t last_value = ATOMIC64_INIT(0);
16787
16788 void pvclock_resume(void)
16789 {
16790- atomic64_set(&last_value, 0);
16791+ atomic64_set_unchecked(&last_value, 0);
16792 }
16793
16794 cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
16795@@ -121,11 +121,11 @@ cycle_t pvclock_clocksource_read(struct
16796 * updating at the same time, and one of them could be slightly behind,
16797 * making the assumption that last_value always go forward fail to hold.
16798 */
16799- last = atomic64_read(&last_value);
16800+ last = atomic64_read_unchecked(&last_value);
16801 do {
16802 if (ret < last)
16803 return last;
16804- last = atomic64_cmpxchg(&last_value, last, ret);
16805+ last = atomic64_cmpxchg_unchecked(&last_value, last, ret);
16806 } while (unlikely(last != ret));
16807
16808 return ret;
16809diff -urNp linux-2.6.39.1/arch/x86/kernel/reboot.c linux-2.6.39.1/arch/x86/kernel/reboot.c
16810--- linux-2.6.39.1/arch/x86/kernel/reboot.c 2011-05-19 00:06:34.000000000 -0400
16811+++ linux-2.6.39.1/arch/x86/kernel/reboot.c 2011-05-23 17:07:00.000000000 -0400
16812@@ -35,7 +35,7 @@ void (*pm_power_off)(void);
16813 EXPORT_SYMBOL(pm_power_off);
16814
16815 static const struct desc_ptr no_idt = {};
16816-static int reboot_mode;
16817+static unsigned short reboot_mode;
16818 enum reboot_type reboot_type = BOOT_KBD;
16819 int reboot_force;
16820
16821@@ -307,13 +307,17 @@ core_initcall(reboot_init);
16822 extern const unsigned char machine_real_restart_asm[];
16823 extern const u64 machine_real_restart_gdt[3];
16824
16825-void machine_real_restart(unsigned int type)
16826+__noreturn void machine_real_restart(unsigned int type)
16827 {
16828 void *restart_va;
16829 unsigned long restart_pa;
16830- void (*restart_lowmem)(unsigned int);
16831+ void (* __noreturn restart_lowmem)(unsigned int);
16832 u64 *lowmem_gdt;
16833
16834+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
16835+ struct desc_struct *gdt;
16836+#endif
16837+
16838 local_irq_disable();
16839
16840 /* Write zero to CMOS register number 0x0f, which the BIOS POST
16841@@ -339,14 +343,14 @@ void machine_real_restart(unsigned int t
16842 boot)". This seems like a fairly standard thing that gets set by
16843 REBOOT.COM programs, and the previous reset routine did this
16844 too. */
16845- *((unsigned short *)0x472) = reboot_mode;
16846+ *(unsigned short *)(__va(0x472)) = reboot_mode;
16847
16848 /* Patch the GDT in the low memory trampoline */
16849 lowmem_gdt = TRAMPOLINE_SYM(machine_real_restart_gdt);
16850
16851 restart_va = TRAMPOLINE_SYM(machine_real_restart_asm);
16852 restart_pa = virt_to_phys(restart_va);
16853- restart_lowmem = (void (*)(unsigned int))restart_pa;
16854+ restart_lowmem = (void *)restart_pa;
16855
16856 /* GDT[0]: GDT self-pointer */
16857 lowmem_gdt[0] =
16858@@ -357,7 +361,33 @@ void machine_real_restart(unsigned int t
16859 GDT_ENTRY(0x009b, restart_pa, 0xffff);
16860
16861 /* Jump to the identity-mapped low memory code */
16862+
16863+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
16864+ gdt = get_cpu_gdt_table(smp_processor_id());
16865+ pax_open_kernel();
16866+#ifdef CONFIG_PAX_MEMORY_UDEREF
16867+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
16868+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
16869+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
16870+#endif
16871+#ifdef CONFIG_PAX_KERNEXEC
16872+ gdt[GDT_ENTRY_KERNEL_CS].base0 = 0;
16873+ gdt[GDT_ENTRY_KERNEL_CS].base1 = 0;
16874+ gdt[GDT_ENTRY_KERNEL_CS].base2 = 0;
16875+ gdt[GDT_ENTRY_KERNEL_CS].limit0 = 0xffff;
16876+ gdt[GDT_ENTRY_KERNEL_CS].limit = 0xf;
16877+ gdt[GDT_ENTRY_KERNEL_CS].g = 1;
16878+#endif
16879+ pax_close_kernel();
16880+#endif
16881+
16882+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16883+ asm volatile("push %0; push %1; lret\n" : : "i" (__KERNEL_CS), "rm" (restart_lowmem), "a" (type));
16884+ unreachable();
16885+#else
16886 restart_lowmem(type);
16887+#endif
16888+
16889 }
16890 #ifdef CONFIG_APM_MODULE
16891 EXPORT_SYMBOL(machine_real_restart);
16892@@ -478,7 +508,7 @@ void __attribute__((weak)) mach_reboot_f
16893 {
16894 }
16895
16896-static void native_machine_emergency_restart(void)
16897+__noreturn static void native_machine_emergency_restart(void)
16898 {
16899 int i;
16900
16901@@ -593,13 +623,13 @@ void native_machine_shutdown(void)
16902 #endif
16903 }
16904
16905-static void __machine_emergency_restart(int emergency)
16906+static __noreturn void __machine_emergency_restart(int emergency)
16907 {
16908 reboot_emergency = emergency;
16909 machine_ops.emergency_restart();
16910 }
16911
16912-static void native_machine_restart(char *__unused)
16913+static __noreturn void native_machine_restart(char *__unused)
16914 {
16915 printk("machine restart\n");
16916
16917@@ -608,7 +638,7 @@ static void native_machine_restart(char
16918 __machine_emergency_restart(0);
16919 }
16920
16921-static void native_machine_halt(void)
16922+static __noreturn void native_machine_halt(void)
16923 {
16924 /* stop other cpus and apics */
16925 machine_shutdown();
16926@@ -619,7 +649,7 @@ static void native_machine_halt(void)
16927 stop_this_cpu(NULL);
16928 }
16929
16930-static void native_machine_power_off(void)
16931+__noreturn static void native_machine_power_off(void)
16932 {
16933 if (pm_power_off) {
16934 if (!reboot_force)
16935@@ -628,6 +658,7 @@ static void native_machine_power_off(voi
16936 }
16937 /* a fallback in case there is no PM info available */
16938 tboot_shutdown(TB_SHUTDOWN_HALT);
16939+ unreachable();
16940 }
16941
16942 struct machine_ops machine_ops = {
16943diff -urNp linux-2.6.39.1/arch/x86/kernel/setup.c linux-2.6.39.1/arch/x86/kernel/setup.c
16944--- linux-2.6.39.1/arch/x86/kernel/setup.c 2011-06-03 00:04:13.000000000 -0400
16945+++ linux-2.6.39.1/arch/x86/kernel/setup.c 2011-06-03 00:32:04.000000000 -0400
16946@@ -650,7 +650,7 @@ static void __init trim_bios_range(void)
16947 * area (640->1Mb) as ram even though it is not.
16948 * take them out.
16949 */
16950- e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1);
16951+ e820_remove_range(ISA_START_ADDRESS, ISA_END_ADDRESS - ISA_START_ADDRESS, E820_RAM, 1);
16952 sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
16953 }
16954
16955@@ -775,14 +775,14 @@ void __init setup_arch(char **cmdline_p)
16956
16957 if (!boot_params.hdr.root_flags)
16958 root_mountflags &= ~MS_RDONLY;
16959- init_mm.start_code = (unsigned long) _text;
16960- init_mm.end_code = (unsigned long) _etext;
16961+ init_mm.start_code = ktla_ktva((unsigned long) _text);
16962+ init_mm.end_code = ktla_ktva((unsigned long) _etext);
16963 init_mm.end_data = (unsigned long) _edata;
16964 init_mm.brk = _brk_end;
16965
16966- code_resource.start = virt_to_phys(_text);
16967- code_resource.end = virt_to_phys(_etext)-1;
16968- data_resource.start = virt_to_phys(_etext);
16969+ code_resource.start = virt_to_phys(ktla_ktva(_text));
16970+ code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
16971+ data_resource.start = virt_to_phys(_sdata);
16972 data_resource.end = virt_to_phys(_edata)-1;
16973 bss_resource.start = virt_to_phys(&__bss_start);
16974 bss_resource.end = virt_to_phys(&__bss_stop)-1;
16975diff -urNp linux-2.6.39.1/arch/x86/kernel/setup_percpu.c linux-2.6.39.1/arch/x86/kernel/setup_percpu.c
16976--- linux-2.6.39.1/arch/x86/kernel/setup_percpu.c 2011-05-19 00:06:34.000000000 -0400
16977+++ linux-2.6.39.1/arch/x86/kernel/setup_percpu.c 2011-06-04 20:08:30.000000000 -0400
16978@@ -21,19 +21,17 @@
16979 #include <asm/cpu.h>
16980 #include <asm/stackprotector.h>
16981
16982-DEFINE_PER_CPU(int, cpu_number);
16983+#ifdef CONFIG_SMP
16984+DEFINE_PER_CPU(unsigned int, cpu_number);
16985 EXPORT_PER_CPU_SYMBOL(cpu_number);
16986+#endif
16987
16988-#ifdef CONFIG_X86_64
16989 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
16990-#else
16991-#define BOOT_PERCPU_OFFSET 0
16992-#endif
16993
16994 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
16995 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
16996
16997-unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
16998+unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
16999 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
17000 };
17001 EXPORT_SYMBOL(__per_cpu_offset);
17002@@ -155,10 +153,10 @@ static inline void setup_percpu_segment(
17003 {
17004 #ifdef CONFIG_X86_32
17005 struct desc_struct gdt;
17006+ unsigned long base = per_cpu_offset(cpu);
17007
17008- pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
17009- 0x2 | DESCTYPE_S, 0x8);
17010- gdt.s = 1;
17011+ pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
17012+ 0x83 | DESCTYPE_S, 0xC);
17013 write_gdt_entry(get_cpu_gdt_table(cpu),
17014 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
17015 #endif
17016@@ -207,6 +205,11 @@ void __init setup_per_cpu_areas(void)
17017 /* alrighty, percpu areas up and running */
17018 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
17019 for_each_possible_cpu(cpu) {
17020+#ifdef CONFIG_CC_STACKPROTECTOR
17021+#ifdef CONFIG_X86_32
17022+ unsigned long canary = per_cpu(stack_canary.canary, cpu);
17023+#endif
17024+#endif
17025 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
17026 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
17027 per_cpu(cpu_number, cpu) = cpu;
17028@@ -247,6 +250,12 @@ void __init setup_per_cpu_areas(void)
17029 */
17030 set_cpu_numa_node(cpu, early_cpu_to_node(cpu));
17031 #endif
17032+#ifdef CONFIG_CC_STACKPROTECTOR
17033+#ifdef CONFIG_X86_32
17034+ if (!cpu)
17035+ per_cpu(stack_canary.canary, cpu) = canary;
17036+#endif
17037+#endif
17038 /*
17039 * Up to this point, the boot CPU has been using .init.data
17040 * area. Reload any changed state for the boot CPU.
17041diff -urNp linux-2.6.39.1/arch/x86/kernel/signal.c linux-2.6.39.1/arch/x86/kernel/signal.c
17042--- linux-2.6.39.1/arch/x86/kernel/signal.c 2011-05-19 00:06:34.000000000 -0400
17043+++ linux-2.6.39.1/arch/x86/kernel/signal.c 2011-05-23 17:07:00.000000000 -0400
17044@@ -198,7 +198,7 @@ static unsigned long align_sigframe(unsi
17045 * Align the stack pointer according to the i386 ABI,
17046 * i.e. so that on function entry ((sp + 4) & 15) == 0.
17047 */
17048- sp = ((sp + 4) & -16ul) - 4;
17049+ sp = ((sp - 12) & -16ul) - 4;
17050 #else /* !CONFIG_X86_32 */
17051 sp = round_down(sp, 16) - 8;
17052 #endif
17053@@ -249,11 +249,11 @@ get_sigframe(struct k_sigaction *ka, str
17054 * Return an always-bogus address instead so we will die with SIGSEGV.
17055 */
17056 if (onsigstack && !likely(on_sig_stack(sp)))
17057- return (void __user *)-1L;
17058+ return (__force void __user *)-1L;
17059
17060 /* save i387 state */
17061 if (used_math() && save_i387_xstate(*fpstate) < 0)
17062- return (void __user *)-1L;
17063+ return (__force void __user *)-1L;
17064
17065 return (void __user *)sp;
17066 }
17067@@ -308,9 +308,9 @@ __setup_frame(int sig, struct k_sigactio
17068 }
17069
17070 if (current->mm->context.vdso)
17071- restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
17072+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
17073 else
17074- restorer = &frame->retcode;
17075+ restorer = (void __user *)&frame->retcode;
17076 if (ka->sa.sa_flags & SA_RESTORER)
17077 restorer = ka->sa.sa_restorer;
17078
17079@@ -324,7 +324,7 @@ __setup_frame(int sig, struct k_sigactio
17080 * reasons and because gdb uses it as a signature to notice
17081 * signal handler stack frames.
17082 */
17083- err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
17084+ err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
17085
17086 if (err)
17087 return -EFAULT;
17088@@ -378,7 +378,10 @@ static int __setup_rt_frame(int sig, str
17089 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
17090
17091 /* Set up to return from userspace. */
17092- restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
17093+ if (current->mm->context.vdso)
17094+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
17095+ else
17096+ restorer = (void __user *)&frame->retcode;
17097 if (ka->sa.sa_flags & SA_RESTORER)
17098 restorer = ka->sa.sa_restorer;
17099 put_user_ex(restorer, &frame->pretcode);
17100@@ -390,7 +393,7 @@ static int __setup_rt_frame(int sig, str
17101 * reasons and because gdb uses it as a signature to notice
17102 * signal handler stack frames.
17103 */
17104- put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
17105+ put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
17106 } put_user_catch(err);
17107
17108 if (err)
17109@@ -773,6 +776,8 @@ static void do_signal(struct pt_regs *re
17110 int signr;
17111 sigset_t *oldset;
17112
17113+ pax_track_stack();
17114+
17115 /*
17116 * We want the common case to go fast, which is why we may in certain
17117 * cases get here from kernel mode. Just return without doing anything
17118@@ -780,7 +785,7 @@ static void do_signal(struct pt_regs *re
17119 * X86_32: vm86 regs switched out by assembly code before reaching
17120 * here, so testing against kernel CS suffices.
17121 */
17122- if (!user_mode(regs))
17123+ if (!user_mode_novm(regs))
17124 return;
17125
17126 if (current_thread_info()->status & TS_RESTORE_SIGMASK)
17127diff -urNp linux-2.6.39.1/arch/x86/kernel/smpboot.c linux-2.6.39.1/arch/x86/kernel/smpboot.c
17128--- linux-2.6.39.1/arch/x86/kernel/smpboot.c 2011-05-19 00:06:34.000000000 -0400
17129+++ linux-2.6.39.1/arch/x86/kernel/smpboot.c 2011-05-22 19:36:30.000000000 -0400
17130@@ -696,17 +696,20 @@ static int __cpuinit do_boot_cpu(int api
17131 set_idle_for_cpu(cpu, c_idle.idle);
17132 do_rest:
17133 per_cpu(current_task, cpu) = c_idle.idle;
17134+ per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
17135 #ifdef CONFIG_X86_32
17136 /* Stack for startup_32 can be just as for start_secondary onwards */
17137 irq_ctx_init(cpu);
17138 #else
17139 clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
17140 initial_gs = per_cpu_offset(cpu);
17141- per_cpu(kernel_stack, cpu) =
17142- (unsigned long)task_stack_page(c_idle.idle) -
17143- KERNEL_STACK_OFFSET + THREAD_SIZE;
17144+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
17145 #endif
17146+
17147+ pax_open_kernel();
17148 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
17149+ pax_close_kernel();
17150+
17151 initial_code = (unsigned long)start_secondary;
17152 stack_start = c_idle.idle->thread.sp;
17153
17154@@ -848,6 +851,12 @@ int __cpuinit native_cpu_up(unsigned int
17155
17156 per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
17157
17158+#ifdef CONFIG_PAX_PER_CPU_PGD
17159+ clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
17160+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
17161+ KERNEL_PGD_PTRS);
17162+#endif
17163+
17164 err = do_boot_cpu(apicid, cpu);
17165 if (err) {
17166 pr_debug("do_boot_cpu failed %d\n", err);
17167diff -urNp linux-2.6.39.1/arch/x86/kernel/step.c linux-2.6.39.1/arch/x86/kernel/step.c
17168--- linux-2.6.39.1/arch/x86/kernel/step.c 2011-05-19 00:06:34.000000000 -0400
17169+++ linux-2.6.39.1/arch/x86/kernel/step.c 2011-05-22 19:36:30.000000000 -0400
17170@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
17171 struct desc_struct *desc;
17172 unsigned long base;
17173
17174- seg &= ~7UL;
17175+ seg >>= 3;
17176
17177 mutex_lock(&child->mm->context.lock);
17178- if (unlikely((seg >> 3) >= child->mm->context.size))
17179+ if (unlikely(seg >= child->mm->context.size))
17180 addr = -1L; /* bogus selector, access would fault */
17181 else {
17182 desc = child->mm->context.ldt + seg;
17183@@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struc
17184 addr += base;
17185 }
17186 mutex_unlock(&child->mm->context.lock);
17187- }
17188+ } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
17189+ addr = ktla_ktva(addr);
17190
17191 return addr;
17192 }
17193@@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct t
17194 unsigned char opcode[15];
17195 unsigned long addr = convert_ip_to_linear(child, regs);
17196
17197+ if (addr == -EINVAL)
17198+ return 0;
17199+
17200 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
17201 for (i = 0; i < copied; i++) {
17202 switch (opcode[i]) {
17203@@ -74,7 +78,7 @@ static int is_setting_trap_flag(struct t
17204
17205 #ifdef CONFIG_X86_64
17206 case 0x40 ... 0x4f:
17207- if (regs->cs != __USER_CS)
17208+ if ((regs->cs & 0xffff) != __USER_CS)
17209 /* 32-bit mode: register increment */
17210 return 0;
17211 /* 64-bit mode: REX prefix */
17212diff -urNp linux-2.6.39.1/arch/x86/kernel/syscall_table_32.S linux-2.6.39.1/arch/x86/kernel/syscall_table_32.S
17213--- linux-2.6.39.1/arch/x86/kernel/syscall_table_32.S 2011-05-19 00:06:34.000000000 -0400
17214+++ linux-2.6.39.1/arch/x86/kernel/syscall_table_32.S 2011-05-22 19:36:30.000000000 -0400
17215@@ -1,3 +1,4 @@
17216+.section .rodata,"a",@progbits
17217 ENTRY(sys_call_table)
17218 .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
17219 .long sys_exit
17220diff -urNp linux-2.6.39.1/arch/x86/kernel/sys_i386_32.c linux-2.6.39.1/arch/x86/kernel/sys_i386_32.c
17221--- linux-2.6.39.1/arch/x86/kernel/sys_i386_32.c 2011-05-19 00:06:34.000000000 -0400
17222+++ linux-2.6.39.1/arch/x86/kernel/sys_i386_32.c 2011-05-22 19:36:30.000000000 -0400
17223@@ -24,17 +24,224 @@
17224
17225 #include <asm/syscalls.h>
17226
17227-/*
17228- * Do a system call from kernel instead of calling sys_execve so we
17229- * end up with proper pt_regs.
17230- */
17231-int kernel_execve(const char *filename,
17232- const char *const argv[],
17233- const char *const envp[])
17234+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
17235 {
17236- long __res;
17237- asm volatile ("int $0x80"
17238- : "=a" (__res)
17239- : "0" (__NR_execve), "b" (filename), "c" (argv), "d" (envp) : "memory");
17240- return __res;
17241+ unsigned long pax_task_size = TASK_SIZE;
17242+
17243+#ifdef CONFIG_PAX_SEGMEXEC
17244+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
17245+ pax_task_size = SEGMEXEC_TASK_SIZE;
17246+#endif
17247+
17248+ if (len > pax_task_size || addr > pax_task_size - len)
17249+ return -EINVAL;
17250+
17251+ return 0;
17252+}
17253+
17254+unsigned long
17255+arch_get_unmapped_area(struct file *filp, unsigned long addr,
17256+ unsigned long len, unsigned long pgoff, unsigned long flags)
17257+{
17258+ struct mm_struct *mm = current->mm;
17259+ struct vm_area_struct *vma;
17260+ unsigned long start_addr, pax_task_size = TASK_SIZE;
17261+
17262+#ifdef CONFIG_PAX_SEGMEXEC
17263+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17264+ pax_task_size = SEGMEXEC_TASK_SIZE;
17265+#endif
17266+
17267+ pax_task_size -= PAGE_SIZE;
17268+
17269+ if (len > pax_task_size)
17270+ return -ENOMEM;
17271+
17272+ if (flags & MAP_FIXED)
17273+ return addr;
17274+
17275+#ifdef CONFIG_PAX_RANDMMAP
17276+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17277+#endif
17278+
17279+ if (addr) {
17280+ addr = PAGE_ALIGN(addr);
17281+ if (pax_task_size - len >= addr) {
17282+ vma = find_vma(mm, addr);
17283+ if (check_heap_stack_gap(vma, addr, len))
17284+ return addr;
17285+ }
17286+ }
17287+ if (len > mm->cached_hole_size) {
17288+ start_addr = addr = mm->free_area_cache;
17289+ } else {
17290+ start_addr = addr = mm->mmap_base;
17291+ mm->cached_hole_size = 0;
17292+ }
17293+
17294+#ifdef CONFIG_PAX_PAGEEXEC
17295+ if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
17296+ start_addr = 0x00110000UL;
17297+
17298+#ifdef CONFIG_PAX_RANDMMAP
17299+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17300+ start_addr += mm->delta_mmap & 0x03FFF000UL;
17301+#endif
17302+
17303+ if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
17304+ start_addr = addr = mm->mmap_base;
17305+ else
17306+ addr = start_addr;
17307+ }
17308+#endif
17309+
17310+full_search:
17311+ for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
17312+ /* At this point: (!vma || addr < vma->vm_end). */
17313+ if (pax_task_size - len < addr) {
17314+ /*
17315+ * Start a new search - just in case we missed
17316+ * some holes.
17317+ */
17318+ if (start_addr != mm->mmap_base) {
17319+ start_addr = addr = mm->mmap_base;
17320+ mm->cached_hole_size = 0;
17321+ goto full_search;
17322+ }
17323+ return -ENOMEM;
17324+ }
17325+ if (check_heap_stack_gap(vma, addr, len))
17326+ break;
17327+ if (addr + mm->cached_hole_size < vma->vm_start)
17328+ mm->cached_hole_size = vma->vm_start - addr;
17329+ addr = vma->vm_end;
17330+ if (mm->start_brk <= addr && addr < mm->mmap_base) {
17331+ start_addr = addr = mm->mmap_base;
17332+ mm->cached_hole_size = 0;
17333+ goto full_search;
17334+ }
17335+ }
17336+
17337+ /*
17338+ * Remember the place where we stopped the search:
17339+ */
17340+ mm->free_area_cache = addr + len;
17341+ return addr;
17342+}
17343+
17344+unsigned long
17345+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17346+ const unsigned long len, const unsigned long pgoff,
17347+ const unsigned long flags)
17348+{
17349+ struct vm_area_struct *vma;
17350+ struct mm_struct *mm = current->mm;
17351+ unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
17352+
17353+#ifdef CONFIG_PAX_SEGMEXEC
17354+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17355+ pax_task_size = SEGMEXEC_TASK_SIZE;
17356+#endif
17357+
17358+ pax_task_size -= PAGE_SIZE;
17359+
17360+ /* requested length too big for entire address space */
17361+ if (len > pax_task_size)
17362+ return -ENOMEM;
17363+
17364+ if (flags & MAP_FIXED)
17365+ return addr;
17366+
17367+#ifdef CONFIG_PAX_PAGEEXEC
17368+ if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
17369+ goto bottomup;
17370+#endif
17371+
17372+#ifdef CONFIG_PAX_RANDMMAP
17373+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17374+#endif
17375+
17376+ /* requesting a specific address */
17377+ if (addr) {
17378+ addr = PAGE_ALIGN(addr);
17379+ if (pax_task_size - len >= addr) {
17380+ vma = find_vma(mm, addr);
17381+ if (check_heap_stack_gap(vma, addr, len))
17382+ return addr;
17383+ }
17384+ }
17385+
17386+ /* check if free_area_cache is useful for us */
17387+ if (len <= mm->cached_hole_size) {
17388+ mm->cached_hole_size = 0;
17389+ mm->free_area_cache = mm->mmap_base;
17390+ }
17391+
17392+ /* either no address requested or can't fit in requested address hole */
17393+ addr = mm->free_area_cache;
17394+
17395+ /* make sure it can fit in the remaining address space */
17396+ if (addr > len) {
17397+ vma = find_vma(mm, addr-len);
17398+ if (check_heap_stack_gap(vma, addr - len, len))
17399+ /* remember the address as a hint for next time */
17400+ return (mm->free_area_cache = addr-len);
17401+ }
17402+
17403+ if (mm->mmap_base < len)
17404+ goto bottomup;
17405+
17406+ addr = mm->mmap_base-len;
17407+
17408+ do {
17409+ /*
17410+ * Lookup failure means no vma is above this address,
17411+ * else if new region fits below vma->vm_start,
17412+ * return with success:
17413+ */
17414+ vma = find_vma(mm, addr);
17415+ if (check_heap_stack_gap(vma, addr, len))
17416+ /* remember the address as a hint for next time */
17417+ return (mm->free_area_cache = addr);
17418+
17419+ /* remember the largest hole we saw so far */
17420+ if (addr + mm->cached_hole_size < vma->vm_start)
17421+ mm->cached_hole_size = vma->vm_start - addr;
17422+
17423+ /* try just below the current vma->vm_start */
17424+ addr = skip_heap_stack_gap(vma, len);
17425+ } while (!IS_ERR_VALUE(addr));
17426+
17427+bottomup:
17428+ /*
17429+ * A failed mmap() very likely causes application failure,
17430+ * so fall back to the bottom-up function here. This scenario
17431+ * can happen with large stack limits and large mmap()
17432+ * allocations.
17433+ */
17434+
17435+#ifdef CONFIG_PAX_SEGMEXEC
17436+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17437+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
17438+ else
17439+#endif
17440+
17441+ mm->mmap_base = TASK_UNMAPPED_BASE;
17442+
17443+#ifdef CONFIG_PAX_RANDMMAP
17444+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17445+ mm->mmap_base += mm->delta_mmap;
17446+#endif
17447+
17448+ mm->free_area_cache = mm->mmap_base;
17449+ mm->cached_hole_size = ~0UL;
17450+ addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17451+ /*
17452+ * Restore the topdown base:
17453+ */
17454+ mm->mmap_base = base;
17455+ mm->free_area_cache = base;
17456+ mm->cached_hole_size = ~0UL;
17457+
17458+ return addr;
17459 }
17460diff -urNp linux-2.6.39.1/arch/x86/kernel/sys_x86_64.c linux-2.6.39.1/arch/x86/kernel/sys_x86_64.c
17461--- linux-2.6.39.1/arch/x86/kernel/sys_x86_64.c 2011-05-19 00:06:34.000000000 -0400
17462+++ linux-2.6.39.1/arch/x86/kernel/sys_x86_64.c 2011-05-22 19:36:30.000000000 -0400
17463@@ -32,8 +32,8 @@ out:
17464 return error;
17465 }
17466
17467-static void find_start_end(unsigned long flags, unsigned long *begin,
17468- unsigned long *end)
17469+static void find_start_end(struct mm_struct *mm, unsigned long flags,
17470+ unsigned long *begin, unsigned long *end)
17471 {
17472 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
17473 unsigned long new_begin;
17474@@ -52,7 +52,7 @@ static void find_start_end(unsigned long
17475 *begin = new_begin;
17476 }
17477 } else {
17478- *begin = TASK_UNMAPPED_BASE;
17479+ *begin = mm->mmap_base;
17480 *end = TASK_SIZE;
17481 }
17482 }
17483@@ -69,16 +69,19 @@ arch_get_unmapped_area(struct file *filp
17484 if (flags & MAP_FIXED)
17485 return addr;
17486
17487- find_start_end(flags, &begin, &end);
17488+ find_start_end(mm, flags, &begin, &end);
17489
17490 if (len > end)
17491 return -ENOMEM;
17492
17493+#ifdef CONFIG_PAX_RANDMMAP
17494+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17495+#endif
17496+
17497 if (addr) {
17498 addr = PAGE_ALIGN(addr);
17499 vma = find_vma(mm, addr);
17500- if (end - len >= addr &&
17501- (!vma || addr + len <= vma->vm_start))
17502+ if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
17503 return addr;
17504 }
17505 if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
17506@@ -106,7 +109,7 @@ full_search:
17507 }
17508 return -ENOMEM;
17509 }
17510- if (!vma || addr + len <= vma->vm_start) {
17511+ if (check_heap_stack_gap(vma, addr, len)) {
17512 /*
17513 * Remember the place where we stopped the search:
17514 */
17515@@ -128,7 +131,7 @@ arch_get_unmapped_area_topdown(struct fi
17516 {
17517 struct vm_area_struct *vma;
17518 struct mm_struct *mm = current->mm;
17519- unsigned long addr = addr0;
17520+ unsigned long base = mm->mmap_base, addr = addr0;
17521
17522 /* requested length too big for entire address space */
17523 if (len > TASK_SIZE)
17524@@ -141,13 +144,18 @@ arch_get_unmapped_area_topdown(struct fi
17525 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
17526 goto bottomup;
17527
17528+#ifdef CONFIG_PAX_RANDMMAP
17529+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17530+#endif
17531+
17532 /* requesting a specific address */
17533 if (addr) {
17534 addr = PAGE_ALIGN(addr);
17535- vma = find_vma(mm, addr);
17536- if (TASK_SIZE - len >= addr &&
17537- (!vma || addr + len <= vma->vm_start))
17538- return addr;
17539+ if (TASK_SIZE - len >= addr) {
17540+ vma = find_vma(mm, addr);
17541+ if (check_heap_stack_gap(vma, addr, len))
17542+ return addr;
17543+ }
17544 }
17545
17546 /* check if free_area_cache is useful for us */
17547@@ -162,7 +170,7 @@ arch_get_unmapped_area_topdown(struct fi
17548 /* make sure it can fit in the remaining address space */
17549 if (addr > len) {
17550 vma = find_vma(mm, addr-len);
17551- if (!vma || addr <= vma->vm_start)
17552+ if (check_heap_stack_gap(vma, addr - len, len))
17553 /* remember the address as a hint for next time */
17554 return mm->free_area_cache = addr-len;
17555 }
17556@@ -179,7 +187,7 @@ arch_get_unmapped_area_topdown(struct fi
17557 * return with success:
17558 */
17559 vma = find_vma(mm, addr);
17560- if (!vma || addr+len <= vma->vm_start)
17561+ if (check_heap_stack_gap(vma, addr, len))
17562 /* remember the address as a hint for next time */
17563 return mm->free_area_cache = addr;
17564
17565@@ -188,8 +196,8 @@ arch_get_unmapped_area_topdown(struct fi
17566 mm->cached_hole_size = vma->vm_start - addr;
17567
17568 /* try just below the current vma->vm_start */
17569- addr = vma->vm_start-len;
17570- } while (len < vma->vm_start);
17571+ addr = skip_heap_stack_gap(vma, len);
17572+ } while (!IS_ERR_VALUE(addr));
17573
17574 bottomup:
17575 /*
17576@@ -198,13 +206,21 @@ bottomup:
17577 * can happen with large stack limits and large mmap()
17578 * allocations.
17579 */
17580+ mm->mmap_base = TASK_UNMAPPED_BASE;
17581+
17582+#ifdef CONFIG_PAX_RANDMMAP
17583+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17584+ mm->mmap_base += mm->delta_mmap;
17585+#endif
17586+
17587+ mm->free_area_cache = mm->mmap_base;
17588 mm->cached_hole_size = ~0UL;
17589- mm->free_area_cache = TASK_UNMAPPED_BASE;
17590 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17591 /*
17592 * Restore the topdown base:
17593 */
17594- mm->free_area_cache = mm->mmap_base;
17595+ mm->mmap_base = base;
17596+ mm->free_area_cache = base;
17597 mm->cached_hole_size = ~0UL;
17598
17599 return addr;
17600diff -urNp linux-2.6.39.1/arch/x86/kernel/tboot.c linux-2.6.39.1/arch/x86/kernel/tboot.c
17601--- linux-2.6.39.1/arch/x86/kernel/tboot.c 2011-05-19 00:06:34.000000000 -0400
17602+++ linux-2.6.39.1/arch/x86/kernel/tboot.c 2011-05-22 19:36:30.000000000 -0400
17603@@ -218,7 +218,7 @@ static int tboot_setup_sleep(void)
17604
17605 void tboot_shutdown(u32 shutdown_type)
17606 {
17607- void (*shutdown)(void);
17608+ void (* __noreturn shutdown)(void);
17609
17610 if (!tboot_enabled())
17611 return;
17612@@ -240,7 +240,7 @@ void tboot_shutdown(u32 shutdown_type)
17613
17614 switch_to_tboot_pt();
17615
17616- shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
17617+ shutdown = (void *)tboot->shutdown_entry;
17618 shutdown();
17619
17620 /* should not reach here */
17621@@ -297,7 +297,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1
17622 tboot_shutdown(acpi_shutdown_map[sleep_state]);
17623 }
17624
17625-static atomic_t ap_wfs_count;
17626+static atomic_unchecked_t ap_wfs_count;
17627
17628 static int tboot_wait_for_aps(int num_aps)
17629 {
17630@@ -321,9 +321,9 @@ static int __cpuinit tboot_cpu_callback(
17631 {
17632 switch (action) {
17633 case CPU_DYING:
17634- atomic_inc(&ap_wfs_count);
17635+ atomic_inc_unchecked(&ap_wfs_count);
17636 if (num_online_cpus() == 1)
17637- if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
17638+ if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
17639 return NOTIFY_BAD;
17640 break;
17641 }
17642@@ -342,7 +342,7 @@ static __init int tboot_late_init(void)
17643
17644 tboot_create_trampoline();
17645
17646- atomic_set(&ap_wfs_count, 0);
17647+ atomic_set_unchecked(&ap_wfs_count, 0);
17648 register_hotcpu_notifier(&tboot_cpu_notifier);
17649 return 0;
17650 }
17651diff -urNp linux-2.6.39.1/arch/x86/kernel/time.c linux-2.6.39.1/arch/x86/kernel/time.c
17652--- linux-2.6.39.1/arch/x86/kernel/time.c 2011-05-19 00:06:34.000000000 -0400
17653+++ linux-2.6.39.1/arch/x86/kernel/time.c 2011-05-22 19:36:30.000000000 -0400
17654@@ -22,17 +22,13 @@
17655 #include <asm/hpet.h>
17656 #include <asm/time.h>
17657
17658-#ifdef CONFIG_X86_64
17659-volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
17660-#endif
17661-
17662 unsigned long profile_pc(struct pt_regs *regs)
17663 {
17664 unsigned long pc = instruction_pointer(regs);
17665
17666- if (!user_mode_vm(regs) && in_lock_functions(pc)) {
17667+ if (!user_mode(regs) && in_lock_functions(pc)) {
17668 #ifdef CONFIG_FRAME_POINTER
17669- return *(unsigned long *)(regs->bp + sizeof(long));
17670+ return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
17671 #else
17672 unsigned long *sp =
17673 (unsigned long *)kernel_stack_pointer(regs);
17674@@ -41,11 +37,17 @@ unsigned long profile_pc(struct pt_regs
17675 * or above a saved flags. Eflags has bits 22-31 zero,
17676 * kernel addresses don't.
17677 */
17678+
17679+#ifdef CONFIG_PAX_KERNEXEC
17680+ return ktla_ktva(sp[0]);
17681+#else
17682 if (sp[0] >> 22)
17683 return sp[0];
17684 if (sp[1] >> 22)
17685 return sp[1];
17686 #endif
17687+
17688+#endif
17689 }
17690 return pc;
17691 }
17692diff -urNp linux-2.6.39.1/arch/x86/kernel/tls.c linux-2.6.39.1/arch/x86/kernel/tls.c
17693--- linux-2.6.39.1/arch/x86/kernel/tls.c 2011-05-19 00:06:34.000000000 -0400
17694+++ linux-2.6.39.1/arch/x86/kernel/tls.c 2011-05-22 19:36:30.000000000 -0400
17695@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
17696 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
17697 return -EINVAL;
17698
17699+#ifdef CONFIG_PAX_SEGMEXEC
17700+ if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
17701+ return -EINVAL;
17702+#endif
17703+
17704 set_tls_desc(p, idx, &info, 1);
17705
17706 return 0;
17707diff -urNp linux-2.6.39.1/arch/x86/kernel/trampoline_32.S linux-2.6.39.1/arch/x86/kernel/trampoline_32.S
17708--- linux-2.6.39.1/arch/x86/kernel/trampoline_32.S 2011-05-19 00:06:34.000000000 -0400
17709+++ linux-2.6.39.1/arch/x86/kernel/trampoline_32.S 2011-05-22 19:36:30.000000000 -0400
17710@@ -32,6 +32,12 @@
17711 #include <asm/segment.h>
17712 #include <asm/page_types.h>
17713
17714+#ifdef CONFIG_PAX_KERNEXEC
17715+#define ta(X) (X)
17716+#else
17717+#define ta(X) ((X) - __PAGE_OFFSET)
17718+#endif
17719+
17720 #ifdef CONFIG_SMP
17721
17722 .section ".x86_trampoline","a"
17723@@ -62,7 +68,7 @@ r_base = .
17724 inc %ax # protected mode (PE) bit
17725 lmsw %ax # into protected mode
17726 # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
17727- ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
17728+ ljmpl $__BOOT_CS, $ta(startup_32_smp)
17729
17730 # These need to be in the same 64K segment as the above;
17731 # hence we don't use the boot_gdt_descr defined in head.S
17732diff -urNp linux-2.6.39.1/arch/x86/kernel/trampoline_64.S linux-2.6.39.1/arch/x86/kernel/trampoline_64.S
17733--- linux-2.6.39.1/arch/x86/kernel/trampoline_64.S 2011-05-19 00:06:34.000000000 -0400
17734+++ linux-2.6.39.1/arch/x86/kernel/trampoline_64.S 2011-05-22 19:36:30.000000000 -0400
17735@@ -90,7 +90,7 @@ startup_32:
17736 movl $__KERNEL_DS, %eax # Initialize the %ds segment register
17737 movl %eax, %ds
17738
17739- movl $X86_CR4_PAE, %eax
17740+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
17741 movl %eax, %cr4 # Enable PAE mode
17742
17743 # Setup trampoline 4 level pagetables
17744@@ -138,7 +138,7 @@ tidt:
17745 # so the kernel can live anywhere
17746 .balign 4
17747 tgdt:
17748- .short tgdt_end - tgdt # gdt limit
17749+ .short tgdt_end - tgdt - 1 # gdt limit
17750 .long tgdt - r_base
17751 .short 0
17752 .quad 0x00cf9b000000ffff # __KERNEL32_CS
17753diff -urNp linux-2.6.39.1/arch/x86/kernel/traps.c linux-2.6.39.1/arch/x86/kernel/traps.c
17754--- linux-2.6.39.1/arch/x86/kernel/traps.c 2011-05-19 00:06:34.000000000 -0400
17755+++ linux-2.6.39.1/arch/x86/kernel/traps.c 2011-05-22 19:36:30.000000000 -0400
17756@@ -70,12 +70,6 @@ asmlinkage int system_call(void);
17757
17758 /* Do we ignore FPU interrupts ? */
17759 char ignore_fpu_irq;
17760-
17761-/*
17762- * The IDT has to be page-aligned to simplify the Pentium
17763- * F0 0F bug workaround.
17764- */
17765-gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
17766 #endif
17767
17768 DECLARE_BITMAP(used_vectors, NR_VECTORS);
17769@@ -117,13 +111,13 @@ static inline void preempt_conditional_c
17770 }
17771
17772 static void __kprobes
17773-do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
17774+do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
17775 long error_code, siginfo_t *info)
17776 {
17777 struct task_struct *tsk = current;
17778
17779 #ifdef CONFIG_X86_32
17780- if (regs->flags & X86_VM_MASK) {
17781+ if (v8086_mode(regs)) {
17782 /*
17783 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
17784 * On nmi (interrupt 2), do_trap should not be called.
17785@@ -134,7 +128,7 @@ do_trap(int trapnr, int signr, char *str
17786 }
17787 #endif
17788
17789- if (!user_mode(regs))
17790+ if (!user_mode_novm(regs))
17791 goto kernel_trap;
17792
17793 #ifdef CONFIG_X86_32
17794@@ -157,7 +151,7 @@ trap_signal:
17795 printk_ratelimit()) {
17796 printk(KERN_INFO
17797 "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
17798- tsk->comm, tsk->pid, str,
17799+ tsk->comm, task_pid_nr(tsk), str,
17800 regs->ip, regs->sp, error_code);
17801 print_vma_addr(" in ", regs->ip);
17802 printk("\n");
17803@@ -174,8 +168,20 @@ kernel_trap:
17804 if (!fixup_exception(regs)) {
17805 tsk->thread.error_code = error_code;
17806 tsk->thread.trap_no = trapnr;
17807+
17808+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17809+ if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
17810+ str = "PAX: suspicious stack segment fault";
17811+#endif
17812+
17813 die(str, regs, error_code);
17814 }
17815+
17816+#ifdef CONFIG_PAX_REFCOUNT
17817+ if (trapnr == 4)
17818+ pax_report_refcount_overflow(regs);
17819+#endif
17820+
17821 return;
17822
17823 #ifdef CONFIG_X86_32
17824@@ -264,14 +270,30 @@ do_general_protection(struct pt_regs *re
17825 conditional_sti(regs);
17826
17827 #ifdef CONFIG_X86_32
17828- if (regs->flags & X86_VM_MASK)
17829+ if (v8086_mode(regs))
17830 goto gp_in_vm86;
17831 #endif
17832
17833 tsk = current;
17834- if (!user_mode(regs))
17835+ if (!user_mode_novm(regs))
17836 goto gp_in_kernel;
17837
17838+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
17839+ if (!(__supported_pte_mask & _PAGE_NX) && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
17840+ struct mm_struct *mm = tsk->mm;
17841+ unsigned long limit;
17842+
17843+ down_write(&mm->mmap_sem);
17844+ limit = mm->context.user_cs_limit;
17845+ if (limit < TASK_SIZE) {
17846+ track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
17847+ up_write(&mm->mmap_sem);
17848+ return;
17849+ }
17850+ up_write(&mm->mmap_sem);
17851+ }
17852+#endif
17853+
17854 tsk->thread.error_code = error_code;
17855 tsk->thread.trap_no = 13;
17856
17857@@ -304,6 +326,13 @@ gp_in_kernel:
17858 if (notify_die(DIE_GPF, "general protection fault", regs,
17859 error_code, 13, SIGSEGV) == NOTIFY_STOP)
17860 return;
17861+
17862+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17863+ if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
17864+ die("PAX: suspicious general protection fault", regs, error_code);
17865+ else
17866+#endif
17867+
17868 die("general protection fault", regs, error_code);
17869 }
17870
17871@@ -569,7 +598,7 @@ dotraplinkage void __kprobes do_debug(st
17872 /* It's safe to allow irq's after DR6 has been saved */
17873 preempt_conditional_sti(regs);
17874
17875- if (regs->flags & X86_VM_MASK) {
17876+ if (v8086_mode(regs)) {
17877 handle_vm86_trap((struct kernel_vm86_regs *) regs,
17878 error_code, 1);
17879 preempt_conditional_cli(regs);
17880@@ -583,7 +612,7 @@ dotraplinkage void __kprobes do_debug(st
17881 * We already checked v86 mode above, so we can check for kernel mode
17882 * by just checking the CPL of CS.
17883 */
17884- if ((dr6 & DR_STEP) && !user_mode(regs)) {
17885+ if ((dr6 & DR_STEP) && !user_mode_novm(regs)) {
17886 tsk->thread.debugreg6 &= ~DR_STEP;
17887 set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
17888 regs->flags &= ~X86_EFLAGS_TF;
17889@@ -612,7 +641,7 @@ void math_error(struct pt_regs *regs, in
17890 return;
17891 conditional_sti(regs);
17892
17893- if (!user_mode_vm(regs))
17894+ if (!user_mode(regs))
17895 {
17896 if (!fixup_exception(regs)) {
17897 task->thread.error_code = error_code;
17898@@ -723,7 +752,7 @@ asmlinkage void __attribute__((weak)) sm
17899 void __math_state_restore(void)
17900 {
17901 struct thread_info *thread = current_thread_info();
17902- struct task_struct *tsk = thread->task;
17903+ struct task_struct *tsk = current;
17904
17905 /*
17906 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
17907@@ -750,8 +779,7 @@ void __math_state_restore(void)
17908 */
17909 asmlinkage void math_state_restore(void)
17910 {
17911- struct thread_info *thread = current_thread_info();
17912- struct task_struct *tsk = thread->task;
17913+ struct task_struct *tsk = current;
17914
17915 if (!tsk_used_math(tsk)) {
17916 local_irq_enable();
17917diff -urNp linux-2.6.39.1/arch/x86/kernel/vm86_32.c linux-2.6.39.1/arch/x86/kernel/vm86_32.c
17918--- linux-2.6.39.1/arch/x86/kernel/vm86_32.c 2011-05-19 00:06:34.000000000 -0400
17919+++ linux-2.6.39.1/arch/x86/kernel/vm86_32.c 2011-05-22 19:41:32.000000000 -0400
17920@@ -41,6 +41,7 @@
17921 #include <linux/ptrace.h>
17922 #include <linux/audit.h>
17923 #include <linux/stddef.h>
17924+#include <linux/grsecurity.h>
17925
17926 #include <asm/uaccess.h>
17927 #include <asm/io.h>
17928@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
17929 do_exit(SIGSEGV);
17930 }
17931
17932- tss = &per_cpu(init_tss, get_cpu());
17933+ tss = init_tss + get_cpu();
17934 current->thread.sp0 = current->thread.saved_sp0;
17935 current->thread.sysenter_cs = __KERNEL_CS;
17936 load_sp0(tss, &current->thread);
17937@@ -208,6 +209,13 @@ int sys_vm86old(struct vm86_struct __use
17938 struct task_struct *tsk;
17939 int tmp, ret = -EPERM;
17940
17941+#ifdef CONFIG_GRKERNSEC_VM86
17942+ if (!capable(CAP_SYS_RAWIO)) {
17943+ gr_handle_vm86();
17944+ goto out;
17945+ }
17946+#endif
17947+
17948 tsk = current;
17949 if (tsk->thread.saved_sp0)
17950 goto out;
17951@@ -238,6 +246,14 @@ int sys_vm86(unsigned long cmd, unsigned
17952 int tmp, ret;
17953 struct vm86plus_struct __user *v86;
17954
17955+#ifdef CONFIG_GRKERNSEC_VM86
17956+ if (!capable(CAP_SYS_RAWIO)) {
17957+ gr_handle_vm86();
17958+ ret = -EPERM;
17959+ goto out;
17960+ }
17961+#endif
17962+
17963 tsk = current;
17964 switch (cmd) {
17965 case VM86_REQUEST_IRQ:
17966@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
17967 tsk->thread.saved_fs = info->regs32->fs;
17968 tsk->thread.saved_gs = get_user_gs(info->regs32);
17969
17970- tss = &per_cpu(init_tss, get_cpu());
17971+ tss = init_tss + get_cpu();
17972 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
17973 if (cpu_has_sep)
17974 tsk->thread.sysenter_cs = 0;
17975@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
17976 goto cannot_handle;
17977 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
17978 goto cannot_handle;
17979- intr_ptr = (unsigned long __user *) (i << 2);
17980+ intr_ptr = (__force unsigned long __user *) (i << 2);
17981 if (get_user(segoffs, intr_ptr))
17982 goto cannot_handle;
17983 if ((segoffs >> 16) == BIOSSEG)
17984diff -urNp linux-2.6.39.1/arch/x86/kernel/vmlinux.lds.S linux-2.6.39.1/arch/x86/kernel/vmlinux.lds.S
17985--- linux-2.6.39.1/arch/x86/kernel/vmlinux.lds.S 2011-05-19 00:06:34.000000000 -0400
17986+++ linux-2.6.39.1/arch/x86/kernel/vmlinux.lds.S 2011-05-22 19:36:30.000000000 -0400
17987@@ -26,6 +26,13 @@
17988 #include <asm/page_types.h>
17989 #include <asm/cache.h>
17990 #include <asm/boot.h>
17991+#include <asm/segment.h>
17992+
17993+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17994+#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
17995+#else
17996+#define __KERNEL_TEXT_OFFSET 0
17997+#endif
17998
17999 #undef i386 /* in case the preprocessor is a 32bit one */
18000
18001@@ -34,11 +41,9 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONF
18002 #ifdef CONFIG_X86_32
18003 OUTPUT_ARCH(i386)
18004 ENTRY(phys_startup_32)
18005-jiffies = jiffies_64;
18006 #else
18007 OUTPUT_ARCH(i386:x86-64)
18008 ENTRY(phys_startup_64)
18009-jiffies_64 = jiffies;
18010 #endif
18011
18012 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
18013@@ -69,31 +74,46 @@ jiffies_64 = jiffies;
18014
18015 PHDRS {
18016 text PT_LOAD FLAGS(5); /* R_E */
18017+#ifdef CONFIG_X86_32
18018+ module PT_LOAD FLAGS(5); /* R_E */
18019+#endif
18020+#ifdef CONFIG_XEN
18021+ rodata PT_LOAD FLAGS(5); /* R_E */
18022+#else
18023+ rodata PT_LOAD FLAGS(4); /* R__ */
18024+#endif
18025 data PT_LOAD FLAGS(6); /* RW_ */
18026 #ifdef CONFIG_X86_64
18027 user PT_LOAD FLAGS(5); /* R_E */
18028+#endif
18029+ init.begin PT_LOAD FLAGS(6); /* RW_ */
18030 #ifdef CONFIG_SMP
18031 percpu PT_LOAD FLAGS(6); /* RW_ */
18032 #endif
18033+ text.init PT_LOAD FLAGS(5); /* R_E */
18034+ text.exit PT_LOAD FLAGS(5); /* R_E */
18035 init PT_LOAD FLAGS(7); /* RWE */
18036-#endif
18037 note PT_NOTE FLAGS(0); /* ___ */
18038 }
18039
18040 SECTIONS
18041 {
18042 #ifdef CONFIG_X86_32
18043- . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
18044- phys_startup_32 = startup_32 - LOAD_OFFSET;
18045+ . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
18046 #else
18047- . = __START_KERNEL;
18048- phys_startup_64 = startup_64 - LOAD_OFFSET;
18049+ . = __START_KERNEL;
18050 #endif
18051
18052 /* Text and read-only data */
18053- .text : AT(ADDR(.text) - LOAD_OFFSET) {
18054- _text = .;
18055+ .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
18056 /* bootstrapping code */
18057+#ifdef CONFIG_X86_32
18058+ phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18059+#else
18060+ phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18061+#endif
18062+ __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18063+ _text = .;
18064 HEAD_TEXT
18065 #ifdef CONFIG_X86_32
18066 . = ALIGN(PAGE_SIZE);
18067@@ -109,13 +129,47 @@ SECTIONS
18068 IRQENTRY_TEXT
18069 *(.fixup)
18070 *(.gnu.warning)
18071- /* End of text section */
18072- _etext = .;
18073 } :text = 0x9090
18074
18075- NOTES :text :note
18076+ . += __KERNEL_TEXT_OFFSET;
18077+
18078+#ifdef CONFIG_X86_32
18079+ . = ALIGN(PAGE_SIZE);
18080+ .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
18081+
18082+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
18083+ MODULES_EXEC_VADDR = .;
18084+ BYTE(0)
18085+ . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
18086+ . = ALIGN(HPAGE_SIZE);
18087+ MODULES_EXEC_END = . - 1;
18088+#endif
18089+
18090+ } :module
18091+#endif
18092+
18093+ .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
18094+ /* End of text section */
18095+ _etext = . - __KERNEL_TEXT_OFFSET;
18096+ }
18097
18098- EXCEPTION_TABLE(16) :text = 0x9090
18099+#ifdef CONFIG_X86_32
18100+ . = ALIGN(PAGE_SIZE);
18101+ .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
18102+ *(.idt)
18103+ . = ALIGN(PAGE_SIZE);
18104+ *(.empty_zero_page)
18105+ *(.initial_pg_fixmap)
18106+ *(.initial_pg_pmd)
18107+ *(.initial_page_table)
18108+ *(.swapper_pg_dir)
18109+ } :rodata
18110+#endif
18111+
18112+ . = ALIGN(PAGE_SIZE);
18113+ NOTES :rodata :note
18114+
18115+ EXCEPTION_TABLE(16) :rodata
18116
18117 #if defined(CONFIG_DEBUG_RODATA)
18118 /* .text should occupy whole number of pages */
18119@@ -127,16 +181,20 @@ SECTIONS
18120
18121 /* Data */
18122 .data : AT(ADDR(.data) - LOAD_OFFSET) {
18123+
18124+#ifdef CONFIG_PAX_KERNEXEC
18125+ . = ALIGN(HPAGE_SIZE);
18126+#else
18127+ . = ALIGN(PAGE_SIZE);
18128+#endif
18129+
18130 /* Start of data section */
18131 _sdata = .;
18132
18133 /* init_task */
18134 INIT_TASK_DATA(THREAD_SIZE)
18135
18136-#ifdef CONFIG_X86_32
18137- /* 32 bit has nosave before _edata */
18138 NOSAVE_DATA
18139-#endif
18140
18141 PAGE_ALIGNED_DATA(PAGE_SIZE)
18142
18143@@ -145,6 +203,8 @@ SECTIONS
18144 DATA_DATA
18145 CONSTRUCTORS
18146
18147+ jiffies = jiffies_64;
18148+
18149 /* rarely changed data like cpu maps */
18150 READ_MOSTLY_DATA(INTERNODE_CACHE_BYTES)
18151
18152@@ -199,12 +259,6 @@ SECTIONS
18153 }
18154 vgetcpu_mode = VVIRT(.vgetcpu_mode);
18155
18156- . = ALIGN(L1_CACHE_BYTES);
18157- .jiffies : AT(VLOAD(.jiffies)) {
18158- *(.jiffies)
18159- }
18160- jiffies = VVIRT(.jiffies);
18161-
18162 .vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
18163 *(.vsyscall_3)
18164 }
18165@@ -220,12 +274,19 @@ SECTIONS
18166 #endif /* CONFIG_X86_64 */
18167
18168 /* Init code and data - will be freed after init */
18169- . = ALIGN(PAGE_SIZE);
18170 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
18171+ BYTE(0)
18172+
18173+#ifdef CONFIG_PAX_KERNEXEC
18174+ . = ALIGN(HPAGE_SIZE);
18175+#else
18176+ . = ALIGN(PAGE_SIZE);
18177+#endif
18178+
18179 __init_begin = .; /* paired with __init_end */
18180- }
18181+ } :init.begin
18182
18183-#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
18184+#ifdef CONFIG_SMP
18185 /*
18186 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
18187 * output PHDR, so the next output section - .init.text - should
18188@@ -234,12 +295,27 @@ SECTIONS
18189 PERCPU_VADDR(INTERNODE_CACHE_BYTES, 0, :percpu)
18190 #endif
18191
18192- INIT_TEXT_SECTION(PAGE_SIZE)
18193-#ifdef CONFIG_X86_64
18194- :init
18195-#endif
18196+ . = ALIGN(PAGE_SIZE);
18197+ init_begin = .;
18198+ .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
18199+ VMLINUX_SYMBOL(_sinittext) = .;
18200+ INIT_TEXT
18201+ VMLINUX_SYMBOL(_einittext) = .;
18202+ . = ALIGN(PAGE_SIZE);
18203+ } :text.init
18204
18205- INIT_DATA_SECTION(16)
18206+ /*
18207+ * .exit.text is discard at runtime, not link time, to deal with
18208+ * references from .altinstructions and .eh_frame
18209+ */
18210+ .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
18211+ EXIT_TEXT
18212+ . = ALIGN(16);
18213+ } :text.exit
18214+ . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
18215+
18216+ . = ALIGN(PAGE_SIZE);
18217+ INIT_DATA_SECTION(16) :init
18218
18219 /*
18220 * Code and data for a variety of lowlevel trampolines, to be
18221@@ -306,19 +382,12 @@ SECTIONS
18222 }
18223
18224 . = ALIGN(8);
18225- /*
18226- * .exit.text is discard at runtime, not link time, to deal with
18227- * references from .altinstructions and .eh_frame
18228- */
18229- .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
18230- EXIT_TEXT
18231- }
18232
18233 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
18234 EXIT_DATA
18235 }
18236
18237-#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
18238+#ifndef CONFIG_SMP
18239 PERCPU(INTERNODE_CACHE_BYTES, PAGE_SIZE)
18240 #endif
18241
18242@@ -337,16 +406,10 @@ SECTIONS
18243 .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
18244 __smp_locks = .;
18245 *(.smp_locks)
18246- . = ALIGN(PAGE_SIZE);
18247 __smp_locks_end = .;
18248+ . = ALIGN(PAGE_SIZE);
18249 }
18250
18251-#ifdef CONFIG_X86_64
18252- .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
18253- NOSAVE_DATA
18254- }
18255-#endif
18256-
18257 /* BSS */
18258 . = ALIGN(PAGE_SIZE);
18259 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
18260@@ -362,6 +425,7 @@ SECTIONS
18261 __brk_base = .;
18262 . += 64 * 1024; /* 64k alignment slop space */
18263 *(.brk_reservation) /* areas brk users have reserved */
18264+ . = ALIGN(HPAGE_SIZE);
18265 __brk_limit = .;
18266 }
18267
18268@@ -388,13 +452,12 @@ SECTIONS
18269 * for the boot processor.
18270 */
18271 #define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
18272-INIT_PER_CPU(gdt_page);
18273 INIT_PER_CPU(irq_stack_union);
18274
18275 /*
18276 * Build-time check on the image size:
18277 */
18278-. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
18279+. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
18280 "kernel image bigger than KERNEL_IMAGE_SIZE");
18281
18282 #ifdef CONFIG_SMP
18283diff -urNp linux-2.6.39.1/arch/x86/kernel/vsyscall_64.c linux-2.6.39.1/arch/x86/kernel/vsyscall_64.c
18284--- linux-2.6.39.1/arch/x86/kernel/vsyscall_64.c 2011-05-19 00:06:34.000000000 -0400
18285+++ linux-2.6.39.1/arch/x86/kernel/vsyscall_64.c 2011-05-22 19:36:30.000000000 -0400
18286@@ -80,6 +80,7 @@ void update_vsyscall(struct timespec *wa
18287
18288 write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
18289 /* copy vsyscall data */
18290+ strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
18291 vsyscall_gtod_data.clock.vread = clock->vread;
18292 vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
18293 vsyscall_gtod_data.clock.mask = clock->mask;
18294@@ -208,7 +209,7 @@ vgetcpu(unsigned *cpu, unsigned *node, s
18295 We do this here because otherwise user space would do it on
18296 its own in a likely inferior way (no access to jiffies).
18297 If you don't like it pass NULL. */
18298- if (tcache && tcache->blob[0] == (j = __jiffies)) {
18299+ if (tcache && tcache->blob[0] == (j = jiffies)) {
18300 p = tcache->blob[1];
18301 } else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
18302 /* Load per CPU data from RDTSCP */
18303diff -urNp linux-2.6.39.1/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.39.1/arch/x86/kernel/x8664_ksyms_64.c
18304--- linux-2.6.39.1/arch/x86/kernel/x8664_ksyms_64.c 2011-05-19 00:06:34.000000000 -0400
18305+++ linux-2.6.39.1/arch/x86/kernel/x8664_ksyms_64.c 2011-05-22 19:36:30.000000000 -0400
18306@@ -29,8 +29,6 @@ EXPORT_SYMBOL(__put_user_8);
18307 EXPORT_SYMBOL(copy_user_generic_string);
18308 EXPORT_SYMBOL(copy_user_generic_unrolled);
18309 EXPORT_SYMBOL(__copy_user_nocache);
18310-EXPORT_SYMBOL(_copy_from_user);
18311-EXPORT_SYMBOL(_copy_to_user);
18312
18313 EXPORT_SYMBOL(copy_page);
18314 EXPORT_SYMBOL(clear_page);
18315diff -urNp linux-2.6.39.1/arch/x86/kernel/xsave.c linux-2.6.39.1/arch/x86/kernel/xsave.c
18316--- linux-2.6.39.1/arch/x86/kernel/xsave.c 2011-05-19 00:06:34.000000000 -0400
18317+++ linux-2.6.39.1/arch/x86/kernel/xsave.c 2011-05-22 19:36:30.000000000 -0400
18318@@ -130,7 +130,7 @@ int check_for_xstate(struct i387_fxsave_
18319 fx_sw_user->xstate_size > fx_sw_user->extended_size)
18320 return -EINVAL;
18321
18322- err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
18323+ err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
18324 fx_sw_user->extended_size -
18325 FP_XSTATE_MAGIC2_SIZE));
18326 if (err)
18327@@ -267,7 +267,7 @@ fx_only:
18328 * the other extended state.
18329 */
18330 xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
18331- return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
18332+ return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
18333 }
18334
18335 /*
18336@@ -299,7 +299,7 @@ int restore_i387_xstate(void __user *buf
18337 if (use_xsave())
18338 err = restore_user_xstate(buf);
18339 else
18340- err = fxrstor_checking((__force struct i387_fxsave_struct *)
18341+ err = fxrstor_checking((struct i387_fxsave_struct __user *)
18342 buf);
18343 if (unlikely(err)) {
18344 /*
18345diff -urNp linux-2.6.39.1/arch/x86/kvm/emulate.c linux-2.6.39.1/arch/x86/kvm/emulate.c
18346--- linux-2.6.39.1/arch/x86/kvm/emulate.c 2011-05-19 00:06:34.000000000 -0400
18347+++ linux-2.6.39.1/arch/x86/kvm/emulate.c 2011-05-22 19:36:30.000000000 -0400
18348@@ -89,7 +89,7 @@
18349 #define Src2ImmByte (2<<29)
18350 #define Src2One (3<<29)
18351 #define Src2Imm (4<<29)
18352-#define Src2Mask (7<<29)
18353+#define Src2Mask (7U<<29)
18354
18355 #define X2(x...) x, x
18356 #define X3(x...) X2(x), x
18357@@ -190,6 +190,7 @@ struct group_dual {
18358
18359 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix, _dsttype) \
18360 do { \
18361+ unsigned long _tmp; \
18362 __asm__ __volatile__ ( \
18363 _PRE_EFLAGS("0", "4", "2") \
18364 _op _suffix " %"_x"3,%1; " \
18365@@ -203,8 +204,6 @@ struct group_dual {
18366 /* Raw emulation: instruction has two explicit operands. */
18367 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
18368 do { \
18369- unsigned long _tmp; \
18370- \
18371 switch ((_dst).bytes) { \
18372 case 2: \
18373 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w",u16);\
18374@@ -220,7 +219,6 @@ struct group_dual {
18375
18376 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
18377 do { \
18378- unsigned long _tmp; \
18379 switch ((_dst).bytes) { \
18380 case 1: \
18381 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b",u8); \
18382diff -urNp linux-2.6.39.1/arch/x86/kvm/lapic.c linux-2.6.39.1/arch/x86/kvm/lapic.c
18383--- linux-2.6.39.1/arch/x86/kvm/lapic.c 2011-05-19 00:06:34.000000000 -0400
18384+++ linux-2.6.39.1/arch/x86/kvm/lapic.c 2011-05-22 19:36:30.000000000 -0400
18385@@ -53,7 +53,7 @@
18386 #define APIC_BUS_CYCLE_NS 1
18387
18388 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
18389-#define apic_debug(fmt, arg...)
18390+#define apic_debug(fmt, arg...) do {} while (0)
18391
18392 #define APIC_LVT_NUM 6
18393 /* 14 is the version for Xeon and Pentium 8.4.8*/
18394diff -urNp linux-2.6.39.1/arch/x86/kvm/mmu.c linux-2.6.39.1/arch/x86/kvm/mmu.c
18395--- linux-2.6.39.1/arch/x86/kvm/mmu.c 2011-05-19 00:06:34.000000000 -0400
18396+++ linux-2.6.39.1/arch/x86/kvm/mmu.c 2011-05-22 19:36:30.000000000 -0400
18397@@ -3240,7 +3240,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
18398
18399 pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
18400
18401- invlpg_counter = atomic_read(&vcpu->kvm->arch.invlpg_counter);
18402+ invlpg_counter = atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter);
18403
18404 /*
18405 * Assume that the pte write on a page table of the same type
18406@@ -3275,7 +3275,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
18407 smp_rmb();
18408
18409 spin_lock(&vcpu->kvm->mmu_lock);
18410- if (atomic_read(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18411+ if (atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18412 gentry = 0;
18413 kvm_mmu_free_some_pages(vcpu);
18414 ++vcpu->kvm->stat.mmu_pte_write;
18415diff -urNp linux-2.6.39.1/arch/x86/kvm/paging_tmpl.h linux-2.6.39.1/arch/x86/kvm/paging_tmpl.h
18416--- linux-2.6.39.1/arch/x86/kvm/paging_tmpl.h 2011-05-19 00:06:34.000000000 -0400
18417+++ linux-2.6.39.1/arch/x86/kvm/paging_tmpl.h 2011-05-22 19:36:30.000000000 -0400
18418@@ -552,6 +552,8 @@ static int FNAME(page_fault)(struct kvm_
18419 unsigned long mmu_seq;
18420 bool map_writable;
18421
18422+ pax_track_stack();
18423+
18424 pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
18425
18426 r = mmu_topup_memory_caches(vcpu);
18427@@ -672,7 +674,7 @@ static void FNAME(invlpg)(struct kvm_vcp
18428 if (need_flush)
18429 kvm_flush_remote_tlbs(vcpu->kvm);
18430
18431- atomic_inc(&vcpu->kvm->arch.invlpg_counter);
18432+ atomic_inc_unchecked(&vcpu->kvm->arch.invlpg_counter);
18433
18434 spin_unlock(&vcpu->kvm->mmu_lock);
18435
18436diff -urNp linux-2.6.39.1/arch/x86/kvm/svm.c linux-2.6.39.1/arch/x86/kvm/svm.c
18437--- linux-2.6.39.1/arch/x86/kvm/svm.c 2011-05-19 00:06:34.000000000 -0400
18438+++ linux-2.6.39.1/arch/x86/kvm/svm.c 2011-05-22 19:36:30.000000000 -0400
18439@@ -3278,7 +3278,11 @@ static void reload_tss(struct kvm_vcpu *
18440 int cpu = raw_smp_processor_id();
18441
18442 struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
18443+
18444+ pax_open_kernel();
18445 sd->tss_desc->type = 9; /* available 32/64-bit TSS */
18446+ pax_close_kernel();
18447+
18448 load_TR_desc();
18449 }
18450
18451@@ -3656,6 +3660,10 @@ static void svm_vcpu_run(struct kvm_vcpu
18452 #endif
18453 #endif
18454
18455+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18456+ __set_fs(current_thread_info()->addr_limit);
18457+#endif
18458+
18459 reload_tss(vcpu);
18460
18461 local_irq_disable();
18462@@ -3871,7 +3879,7 @@ static void svm_fpu_deactivate(struct kv
18463 update_cr0_intercept(svm);
18464 }
18465
18466-static struct kvm_x86_ops svm_x86_ops = {
18467+static const struct kvm_x86_ops svm_x86_ops = {
18468 .cpu_has_kvm_support = has_svm,
18469 .disabled_by_bios = is_disabled,
18470 .hardware_setup = svm_hardware_setup,
18471diff -urNp linux-2.6.39.1/arch/x86/kvm/vmx.c linux-2.6.39.1/arch/x86/kvm/vmx.c
18472--- linux-2.6.39.1/arch/x86/kvm/vmx.c 2011-05-19 00:06:34.000000000 -0400
18473+++ linux-2.6.39.1/arch/x86/kvm/vmx.c 2011-05-22 19:36:30.000000000 -0400
18474@@ -725,7 +725,11 @@ static void reload_tss(void)
18475 struct desc_struct *descs;
18476
18477 descs = (void *)gdt->address;
18478+
18479+ pax_open_kernel();
18480 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
18481+ pax_close_kernel();
18482+
18483 load_TR_desc();
18484 }
18485
18486@@ -1648,8 +1652,11 @@ static __init int hardware_setup(void)
18487 if (!cpu_has_vmx_flexpriority())
18488 flexpriority_enabled = 0;
18489
18490- if (!cpu_has_vmx_tpr_shadow())
18491- kvm_x86_ops->update_cr8_intercept = NULL;
18492+ if (!cpu_has_vmx_tpr_shadow()) {
18493+ pax_open_kernel();
18494+ *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
18495+ pax_close_kernel();
18496+ }
18497
18498 if (enable_ept && !cpu_has_vmx_ept_2m_page())
18499 kvm_disable_largepages();
18500@@ -2693,7 +2700,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
18501 vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
18502
18503 asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
18504- vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
18505+ vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
18506 vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
18507 vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
18508 vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host));
18509@@ -4068,6 +4075,12 @@ static void __noclone vmx_vcpu_run(struc
18510 "jmp .Lkvm_vmx_return \n\t"
18511 ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
18512 ".Lkvm_vmx_return: "
18513+
18514+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18515+ "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
18516+ ".Lkvm_vmx_return2: "
18517+#endif
18518+
18519 /* Save guest registers, load host registers, keep flags */
18520 "mov %0, %c[wordsize](%%"R"sp) \n\t"
18521 "pop %0 \n\t"
18522@@ -4116,6 +4129,11 @@ static void __noclone vmx_vcpu_run(struc
18523 #endif
18524 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
18525 [wordsize]"i"(sizeof(ulong))
18526+
18527+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18528+ ,[cs]"i"(__KERNEL_CS)
18529+#endif
18530+
18531 : "cc", "memory"
18532 , R"ax", R"bx", R"di", R"si"
18533 #ifdef CONFIG_X86_64
18534@@ -4130,7 +4148,16 @@ static void __noclone vmx_vcpu_run(struc
18535
18536 vmx->idt_vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD);
18537
18538- asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
18539+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
18540+
18541+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18542+ loadsegment(fs, __KERNEL_PERCPU);
18543+#endif
18544+
18545+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18546+ __set_fs(current_thread_info()->addr_limit);
18547+#endif
18548+
18549 vmx->launched = 1;
18550
18551 vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
18552@@ -4368,7 +4395,7 @@ static void vmx_set_supported_cpuid(u32
18553 {
18554 }
18555
18556-static struct kvm_x86_ops vmx_x86_ops = {
18557+static const struct kvm_x86_ops vmx_x86_ops = {
18558 .cpu_has_kvm_support = cpu_has_kvm_support,
18559 .disabled_by_bios = vmx_disabled_by_bios,
18560 .hardware_setup = hardware_setup,
18561diff -urNp linux-2.6.39.1/arch/x86/kvm/x86.c linux-2.6.39.1/arch/x86/kvm/x86.c
18562--- linux-2.6.39.1/arch/x86/kvm/x86.c 2011-05-19 00:06:34.000000000 -0400
18563+++ linux-2.6.39.1/arch/x86/kvm/x86.c 2011-05-22 19:36:30.000000000 -0400
18564@@ -94,7 +94,7 @@ static void update_cr8_intercept(struct
18565 static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
18566 struct kvm_cpuid_entry2 __user *entries);
18567
18568-struct kvm_x86_ops *kvm_x86_ops;
18569+const struct kvm_x86_ops *kvm_x86_ops;
18570 EXPORT_SYMBOL_GPL(kvm_x86_ops);
18571
18572 int ignore_msrs = 0;
18573@@ -2050,6 +2050,8 @@ long kvm_arch_dev_ioctl(struct file *fil
18574 if (n < msr_list.nmsrs)
18575 goto out;
18576 r = -EFAULT;
18577+ if (num_msrs_to_save > ARRAY_SIZE(msrs_to_save))
18578+ goto out;
18579 if (copy_to_user(user_msr_list->indices, &msrs_to_save,
18580 num_msrs_to_save * sizeof(u32)))
18581 goto out;
18582@@ -2217,15 +2219,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(str
18583 struct kvm_cpuid2 *cpuid,
18584 struct kvm_cpuid_entry2 __user *entries)
18585 {
18586- int r;
18587+ int r, i;
18588
18589 r = -E2BIG;
18590 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
18591 goto out;
18592 r = -EFAULT;
18593- if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
18594- cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18595+ if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18596 goto out;
18597+ for (i = 0; i < cpuid->nent; ++i) {
18598+ struct kvm_cpuid_entry2 cpuid_entry;
18599+ if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
18600+ goto out;
18601+ vcpu->arch.cpuid_entries[i] = cpuid_entry;
18602+ }
18603 vcpu->arch.cpuid_nent = cpuid->nent;
18604 kvm_apic_set_version(vcpu);
18605 kvm_x86_ops->cpuid_update(vcpu);
18606@@ -2240,15 +2247,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(str
18607 struct kvm_cpuid2 *cpuid,
18608 struct kvm_cpuid_entry2 __user *entries)
18609 {
18610- int r;
18611+ int r, i;
18612
18613 r = -E2BIG;
18614 if (cpuid->nent < vcpu->arch.cpuid_nent)
18615 goto out;
18616 r = -EFAULT;
18617- if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
18618- vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18619+ if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18620 goto out;
18621+ for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
18622+ struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
18623+ if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
18624+ goto out;
18625+ }
18626 return 0;
18627
18628 out:
18629@@ -2526,7 +2537,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
18630 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
18631 struct kvm_interrupt *irq)
18632 {
18633- if (irq->irq < 0 || irq->irq >= 256)
18634+ if (irq->irq >= 256)
18635 return -EINVAL;
18636 if (irqchip_in_kernel(vcpu->kvm))
18637 return -ENXIO;
18638@@ -4672,7 +4683,7 @@ static unsigned long kvm_get_guest_ip(vo
18639 return ip;
18640 }
18641
18642-static struct perf_guest_info_callbacks kvm_guest_cbs = {
18643+static const struct perf_guest_info_callbacks kvm_guest_cbs = {
18644 .is_in_guest = kvm_is_in_guest,
18645 .is_user_mode = kvm_is_user_mode,
18646 .get_guest_ip = kvm_get_guest_ip,
18647@@ -4690,10 +4701,10 @@ void kvm_after_handle_nmi(struct kvm_vcp
18648 }
18649 EXPORT_SYMBOL_GPL(kvm_after_handle_nmi);
18650
18651-int kvm_arch_init(void *opaque)
18652+int kvm_arch_init(const void *opaque)
18653 {
18654 int r;
18655- struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
18656+ const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
18657
18658 if (kvm_x86_ops) {
18659 printk(KERN_ERR "kvm: already loaded the other module\n");
18660diff -urNp linux-2.6.39.1/arch/x86/lib/atomic64_32.c linux-2.6.39.1/arch/x86/lib/atomic64_32.c
18661--- linux-2.6.39.1/arch/x86/lib/atomic64_32.c 2011-05-19 00:06:34.000000000 -0400
18662+++ linux-2.6.39.1/arch/x86/lib/atomic64_32.c 2011-05-22 19:36:30.000000000 -0400
18663@@ -8,18 +8,30 @@
18664
18665 long long atomic64_read_cx8(long long, const atomic64_t *v);
18666 EXPORT_SYMBOL(atomic64_read_cx8);
18667+long long atomic64_read_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18668+EXPORT_SYMBOL(atomic64_read_unchecked_cx8);
18669 long long atomic64_set_cx8(long long, const atomic64_t *v);
18670 EXPORT_SYMBOL(atomic64_set_cx8);
18671+long long atomic64_set_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18672+EXPORT_SYMBOL(atomic64_set_unchecked_cx8);
18673 long long atomic64_xchg_cx8(long long, unsigned high);
18674 EXPORT_SYMBOL(atomic64_xchg_cx8);
18675 long long atomic64_add_return_cx8(long long a, atomic64_t *v);
18676 EXPORT_SYMBOL(atomic64_add_return_cx8);
18677+long long atomic64_add_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18678+EXPORT_SYMBOL(atomic64_add_return_unchecked_cx8);
18679 long long atomic64_sub_return_cx8(long long a, atomic64_t *v);
18680 EXPORT_SYMBOL(atomic64_sub_return_cx8);
18681+long long atomic64_sub_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18682+EXPORT_SYMBOL(atomic64_sub_return_unchecked_cx8);
18683 long long atomic64_inc_return_cx8(long long a, atomic64_t *v);
18684 EXPORT_SYMBOL(atomic64_inc_return_cx8);
18685+long long atomic64_inc_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18686+EXPORT_SYMBOL(atomic64_inc_return_unchecked_cx8);
18687 long long atomic64_dec_return_cx8(long long a, atomic64_t *v);
18688 EXPORT_SYMBOL(atomic64_dec_return_cx8);
18689+long long atomic64_dec_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18690+EXPORT_SYMBOL(atomic64_dec_return_unchecked_cx8);
18691 long long atomic64_dec_if_positive_cx8(atomic64_t *v);
18692 EXPORT_SYMBOL(atomic64_dec_if_positive_cx8);
18693 int atomic64_inc_not_zero_cx8(atomic64_t *v);
18694@@ -30,26 +42,46 @@ EXPORT_SYMBOL(atomic64_add_unless_cx8);
18695 #ifndef CONFIG_X86_CMPXCHG64
18696 long long atomic64_read_386(long long, const atomic64_t *v);
18697 EXPORT_SYMBOL(atomic64_read_386);
18698+long long atomic64_read_unchecked_386(long long, const atomic64_unchecked_t *v);
18699+EXPORT_SYMBOL(atomic64_read_unchecked_386);
18700 long long atomic64_set_386(long long, const atomic64_t *v);
18701 EXPORT_SYMBOL(atomic64_set_386);
18702+long long atomic64_set_unchecked_386(long long, const atomic64_unchecked_t *v);
18703+EXPORT_SYMBOL(atomic64_set_unchecked_386);
18704 long long atomic64_xchg_386(long long, unsigned high);
18705 EXPORT_SYMBOL(atomic64_xchg_386);
18706 long long atomic64_add_return_386(long long a, atomic64_t *v);
18707 EXPORT_SYMBOL(atomic64_add_return_386);
18708+long long atomic64_add_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18709+EXPORT_SYMBOL(atomic64_add_return_unchecked_386);
18710 long long atomic64_sub_return_386(long long a, atomic64_t *v);
18711 EXPORT_SYMBOL(atomic64_sub_return_386);
18712+long long atomic64_sub_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18713+EXPORT_SYMBOL(atomic64_sub_return_unchecked_386);
18714 long long atomic64_inc_return_386(long long a, atomic64_t *v);
18715 EXPORT_SYMBOL(atomic64_inc_return_386);
18716+long long atomic64_inc_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18717+EXPORT_SYMBOL(atomic64_inc_return_unchecked_386);
18718 long long atomic64_dec_return_386(long long a, atomic64_t *v);
18719 EXPORT_SYMBOL(atomic64_dec_return_386);
18720+long long atomic64_dec_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18721+EXPORT_SYMBOL(atomic64_dec_return_unchecked_386);
18722 long long atomic64_add_386(long long a, atomic64_t *v);
18723 EXPORT_SYMBOL(atomic64_add_386);
18724+long long atomic64_add_unchecked_386(long long a, atomic64_unchecked_t *v);
18725+EXPORT_SYMBOL(atomic64_add_unchecked_386);
18726 long long atomic64_sub_386(long long a, atomic64_t *v);
18727 EXPORT_SYMBOL(atomic64_sub_386);
18728+long long atomic64_sub_unchecked_386(long long a, atomic64_unchecked_t *v);
18729+EXPORT_SYMBOL(atomic64_sub_unchecked_386);
18730 long long atomic64_inc_386(long long a, atomic64_t *v);
18731 EXPORT_SYMBOL(atomic64_inc_386);
18732+long long atomic64_inc_unchecked_386(long long a, atomic64_unchecked_t *v);
18733+EXPORT_SYMBOL(atomic64_inc_unchecked_386);
18734 long long atomic64_dec_386(long long a, atomic64_t *v);
18735 EXPORT_SYMBOL(atomic64_dec_386);
18736+long long atomic64_dec_unchecked_386(long long a, atomic64_unchecked_t *v);
18737+EXPORT_SYMBOL(atomic64_dec_unchecked_386);
18738 long long atomic64_dec_if_positive_386(atomic64_t *v);
18739 EXPORT_SYMBOL(atomic64_dec_if_positive_386);
18740 int atomic64_inc_not_zero_386(atomic64_t *v);
18741diff -urNp linux-2.6.39.1/arch/x86/lib/atomic64_386_32.S linux-2.6.39.1/arch/x86/lib/atomic64_386_32.S
18742--- linux-2.6.39.1/arch/x86/lib/atomic64_386_32.S 2011-05-19 00:06:34.000000000 -0400
18743+++ linux-2.6.39.1/arch/x86/lib/atomic64_386_32.S 2011-05-22 19:36:30.000000000 -0400
18744@@ -48,6 +48,10 @@ BEGIN(read)
18745 movl (v), %eax
18746 movl 4(v), %edx
18747 RET_ENDP
18748+BEGIN(read_unchecked)
18749+ movl (v), %eax
18750+ movl 4(v), %edx
18751+RET_ENDP
18752 #undef v
18753
18754 #define v %esi
18755@@ -55,6 +59,10 @@ BEGIN(set)
18756 movl %ebx, (v)
18757 movl %ecx, 4(v)
18758 RET_ENDP
18759+BEGIN(set_unchecked)
18760+ movl %ebx, (v)
18761+ movl %ecx, 4(v)
18762+RET_ENDP
18763 #undef v
18764
18765 #define v %esi
18766@@ -70,6 +78,20 @@ RET_ENDP
18767 BEGIN(add)
18768 addl %eax, (v)
18769 adcl %edx, 4(v)
18770+
18771+#ifdef CONFIG_PAX_REFCOUNT
18772+ jno 0f
18773+ subl %eax, (v)
18774+ sbbl %edx, 4(v)
18775+ int $4
18776+0:
18777+ _ASM_EXTABLE(0b, 0b)
18778+#endif
18779+
18780+RET_ENDP
18781+BEGIN(add_unchecked)
18782+ addl %eax, (v)
18783+ adcl %edx, 4(v)
18784 RET_ENDP
18785 #undef v
18786
18787@@ -77,6 +99,24 @@ RET_ENDP
18788 BEGIN(add_return)
18789 addl (v), %eax
18790 adcl 4(v), %edx
18791+
18792+#ifdef CONFIG_PAX_REFCOUNT
18793+ into
18794+1234:
18795+ _ASM_EXTABLE(1234b, 2f)
18796+#endif
18797+
18798+ movl %eax, (v)
18799+ movl %edx, 4(v)
18800+
18801+#ifdef CONFIG_PAX_REFCOUNT
18802+2:
18803+#endif
18804+
18805+RET_ENDP
18806+BEGIN(add_return_unchecked)
18807+ addl (v), %eax
18808+ adcl 4(v), %edx
18809 movl %eax, (v)
18810 movl %edx, 4(v)
18811 RET_ENDP
18812@@ -86,6 +126,20 @@ RET_ENDP
18813 BEGIN(sub)
18814 subl %eax, (v)
18815 sbbl %edx, 4(v)
18816+
18817+#ifdef CONFIG_PAX_REFCOUNT
18818+ jno 0f
18819+ addl %eax, (v)
18820+ adcl %edx, 4(v)
18821+ int $4
18822+0:
18823+ _ASM_EXTABLE(0b, 0b)
18824+#endif
18825+
18826+RET_ENDP
18827+BEGIN(sub_unchecked)
18828+ subl %eax, (v)
18829+ sbbl %edx, 4(v)
18830 RET_ENDP
18831 #undef v
18832
18833@@ -96,6 +150,27 @@ BEGIN(sub_return)
18834 sbbl $0, %edx
18835 addl (v), %eax
18836 adcl 4(v), %edx
18837+
18838+#ifdef CONFIG_PAX_REFCOUNT
18839+ into
18840+1234:
18841+ _ASM_EXTABLE(1234b, 2f)
18842+#endif
18843+
18844+ movl %eax, (v)
18845+ movl %edx, 4(v)
18846+
18847+#ifdef CONFIG_PAX_REFCOUNT
18848+2:
18849+#endif
18850+
18851+RET_ENDP
18852+BEGIN(sub_return_unchecked)
18853+ negl %edx
18854+ negl %eax
18855+ sbbl $0, %edx
18856+ addl (v), %eax
18857+ adcl 4(v), %edx
18858 movl %eax, (v)
18859 movl %edx, 4(v)
18860 RET_ENDP
18861@@ -105,6 +180,20 @@ RET_ENDP
18862 BEGIN(inc)
18863 addl $1, (v)
18864 adcl $0, 4(v)
18865+
18866+#ifdef CONFIG_PAX_REFCOUNT
18867+ jno 0f
18868+ subl $1, (v)
18869+ sbbl $0, 4(v)
18870+ int $4
18871+0:
18872+ _ASM_EXTABLE(0b, 0b)
18873+#endif
18874+
18875+RET_ENDP
18876+BEGIN(inc_unchecked)
18877+ addl $1, (v)
18878+ adcl $0, 4(v)
18879 RET_ENDP
18880 #undef v
18881
18882@@ -114,6 +203,26 @@ BEGIN(inc_return)
18883 movl 4(v), %edx
18884 addl $1, %eax
18885 adcl $0, %edx
18886+
18887+#ifdef CONFIG_PAX_REFCOUNT
18888+ into
18889+1234:
18890+ _ASM_EXTABLE(1234b, 2f)
18891+#endif
18892+
18893+ movl %eax, (v)
18894+ movl %edx, 4(v)
18895+
18896+#ifdef CONFIG_PAX_REFCOUNT
18897+2:
18898+#endif
18899+
18900+RET_ENDP
18901+BEGIN(inc_return_unchecked)
18902+ movl (v), %eax
18903+ movl 4(v), %edx
18904+ addl $1, %eax
18905+ adcl $0, %edx
18906 movl %eax, (v)
18907 movl %edx, 4(v)
18908 RET_ENDP
18909@@ -123,6 +232,20 @@ RET_ENDP
18910 BEGIN(dec)
18911 subl $1, (v)
18912 sbbl $0, 4(v)
18913+
18914+#ifdef CONFIG_PAX_REFCOUNT
18915+ jno 0f
18916+ addl $1, (v)
18917+ adcl $0, 4(v)
18918+ int $4
18919+0:
18920+ _ASM_EXTABLE(0b, 0b)
18921+#endif
18922+
18923+RET_ENDP
18924+BEGIN(dec_unchecked)
18925+ subl $1, (v)
18926+ sbbl $0, 4(v)
18927 RET_ENDP
18928 #undef v
18929
18930@@ -132,6 +255,26 @@ BEGIN(dec_return)
18931 movl 4(v), %edx
18932 subl $1, %eax
18933 sbbl $0, %edx
18934+
18935+#ifdef CONFIG_PAX_REFCOUNT
18936+ into
18937+1234:
18938+ _ASM_EXTABLE(1234b, 2f)
18939+#endif
18940+
18941+ movl %eax, (v)
18942+ movl %edx, 4(v)
18943+
18944+#ifdef CONFIG_PAX_REFCOUNT
18945+2:
18946+#endif
18947+
18948+RET_ENDP
18949+BEGIN(dec_return_unchecked)
18950+ movl (v), %eax
18951+ movl 4(v), %edx
18952+ subl $1, %eax
18953+ sbbl $0, %edx
18954 movl %eax, (v)
18955 movl %edx, 4(v)
18956 RET_ENDP
18957@@ -143,6 +286,13 @@ BEGIN(add_unless)
18958 adcl %edx, %edi
18959 addl (v), %eax
18960 adcl 4(v), %edx
18961+
18962+#ifdef CONFIG_PAX_REFCOUNT
18963+ into
18964+1234:
18965+ _ASM_EXTABLE(1234b, 2f)
18966+#endif
18967+
18968 cmpl %eax, %esi
18969 je 3f
18970 1:
18971@@ -168,6 +318,13 @@ BEGIN(inc_not_zero)
18972 1:
18973 addl $1, %eax
18974 adcl $0, %edx
18975+
18976+#ifdef CONFIG_PAX_REFCOUNT
18977+ into
18978+1234:
18979+ _ASM_EXTABLE(1234b, 2f)
18980+#endif
18981+
18982 movl %eax, (v)
18983 movl %edx, 4(v)
18984 movl $1, %eax
18985@@ -186,6 +343,13 @@ BEGIN(dec_if_positive)
18986 movl 4(v), %edx
18987 subl $1, %eax
18988 sbbl $0, %edx
18989+
18990+#ifdef CONFIG_PAX_REFCOUNT
18991+ into
18992+1234:
18993+ _ASM_EXTABLE(1234b, 1f)
18994+#endif
18995+
18996 js 1f
18997 movl %eax, (v)
18998 movl %edx, 4(v)
18999diff -urNp linux-2.6.39.1/arch/x86/lib/atomic64_cx8_32.S linux-2.6.39.1/arch/x86/lib/atomic64_cx8_32.S
19000--- linux-2.6.39.1/arch/x86/lib/atomic64_cx8_32.S 2011-05-19 00:06:34.000000000 -0400
19001+++ linux-2.6.39.1/arch/x86/lib/atomic64_cx8_32.S 2011-05-22 19:36:30.000000000 -0400
19002@@ -39,6 +39,14 @@ ENTRY(atomic64_read_cx8)
19003 CFI_ENDPROC
19004 ENDPROC(atomic64_read_cx8)
19005
19006+ENTRY(atomic64_read_unchecked_cx8)
19007+ CFI_STARTPROC
19008+
19009+ read64 %ecx
19010+ ret
19011+ CFI_ENDPROC
19012+ENDPROC(atomic64_read_unchecked_cx8)
19013+
19014 ENTRY(atomic64_set_cx8)
19015 CFI_STARTPROC
19016
19017@@ -52,6 +60,19 @@ ENTRY(atomic64_set_cx8)
19018 CFI_ENDPROC
19019 ENDPROC(atomic64_set_cx8)
19020
19021+ENTRY(atomic64_set_unchecked_cx8)
19022+ CFI_STARTPROC
19023+
19024+1:
19025+/* we don't need LOCK_PREFIX since aligned 64-bit writes
19026+ * are atomic on 586 and newer */
19027+ cmpxchg8b (%esi)
19028+ jne 1b
19029+
19030+ ret
19031+ CFI_ENDPROC
19032+ENDPROC(atomic64_set_unchecked_cx8)
19033+
19034 ENTRY(atomic64_xchg_cx8)
19035 CFI_STARTPROC
19036
19037@@ -66,8 +87,8 @@ ENTRY(atomic64_xchg_cx8)
19038 CFI_ENDPROC
19039 ENDPROC(atomic64_xchg_cx8)
19040
19041-.macro addsub_return func ins insc
19042-ENTRY(atomic64_\func\()_return_cx8)
19043+.macro addsub_return func ins insc unchecked=""
19044+ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
19045 CFI_STARTPROC
19046 SAVE ebp
19047 SAVE ebx
19048@@ -84,27 +105,43 @@ ENTRY(atomic64_\func\()_return_cx8)
19049 movl %edx, %ecx
19050 \ins\()l %esi, %ebx
19051 \insc\()l %edi, %ecx
19052+
19053+.ifb \unchecked
19054+#ifdef CONFIG_PAX_REFCOUNT
19055+ into
19056+2:
19057+ _ASM_EXTABLE(2b, 3f)
19058+#endif
19059+.endif
19060+
19061 LOCK_PREFIX
19062 cmpxchg8b (%ebp)
19063 jne 1b
19064-
19065-10:
19066 movl %ebx, %eax
19067 movl %ecx, %edx
19068+
19069+.ifb \unchecked
19070+#ifdef CONFIG_PAX_REFCOUNT
19071+3:
19072+#endif
19073+.endif
19074+
19075 RESTORE edi
19076 RESTORE esi
19077 RESTORE ebx
19078 RESTORE ebp
19079 ret
19080 CFI_ENDPROC
19081-ENDPROC(atomic64_\func\()_return_cx8)
19082+ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
19083 .endm
19084
19085 addsub_return add add adc
19086 addsub_return sub sub sbb
19087+addsub_return add add adc _unchecked
19088+addsub_return sub sub sbb _unchecked
19089
19090-.macro incdec_return func ins insc
19091-ENTRY(atomic64_\func\()_return_cx8)
19092+.macro incdec_return func ins insc unchecked
19093+ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
19094 CFI_STARTPROC
19095 SAVE ebx
19096
19097@@ -114,21 +151,38 @@ ENTRY(atomic64_\func\()_return_cx8)
19098 movl %edx, %ecx
19099 \ins\()l $1, %ebx
19100 \insc\()l $0, %ecx
19101+
19102+.ifb \unchecked
19103+#ifdef CONFIG_PAX_REFCOUNT
19104+ into
19105+2:
19106+ _ASM_EXTABLE(2b, 3f)
19107+#endif
19108+.endif
19109+
19110 LOCK_PREFIX
19111 cmpxchg8b (%esi)
19112 jne 1b
19113
19114-10:
19115 movl %ebx, %eax
19116 movl %ecx, %edx
19117+
19118+.ifb \unchecked
19119+#ifdef CONFIG_PAX_REFCOUNT
19120+3:
19121+#endif
19122+.endif
19123+
19124 RESTORE ebx
19125 ret
19126 CFI_ENDPROC
19127-ENDPROC(atomic64_\func\()_return_cx8)
19128+ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
19129 .endm
19130
19131 incdec_return inc add adc
19132 incdec_return dec sub sbb
19133+incdec_return inc add adc _unchecked
19134+incdec_return dec sub sbb _unchecked
19135
19136 ENTRY(atomic64_dec_if_positive_cx8)
19137 CFI_STARTPROC
19138@@ -140,6 +194,13 @@ ENTRY(atomic64_dec_if_positive_cx8)
19139 movl %edx, %ecx
19140 subl $1, %ebx
19141 sbb $0, %ecx
19142+
19143+#ifdef CONFIG_PAX_REFCOUNT
19144+ into
19145+1234:
19146+ _ASM_EXTABLE(1234b, 2f)
19147+#endif
19148+
19149 js 2f
19150 LOCK_PREFIX
19151 cmpxchg8b (%esi)
19152@@ -174,6 +235,13 @@ ENTRY(atomic64_add_unless_cx8)
19153 movl %edx, %ecx
19154 addl %esi, %ebx
19155 adcl %edi, %ecx
19156+
19157+#ifdef CONFIG_PAX_REFCOUNT
19158+ into
19159+1234:
19160+ _ASM_EXTABLE(1234b, 3f)
19161+#endif
19162+
19163 LOCK_PREFIX
19164 cmpxchg8b (%ebp)
19165 jne 1b
19166@@ -206,6 +274,13 @@ ENTRY(atomic64_inc_not_zero_cx8)
19167 movl %edx, %ecx
19168 addl $1, %ebx
19169 adcl $0, %ecx
19170+
19171+#ifdef CONFIG_PAX_REFCOUNT
19172+ into
19173+1234:
19174+ _ASM_EXTABLE(1234b, 3f)
19175+#endif
19176+
19177 LOCK_PREFIX
19178 cmpxchg8b (%esi)
19179 jne 1b
19180diff -urNp linux-2.6.39.1/arch/x86/lib/checksum_32.S linux-2.6.39.1/arch/x86/lib/checksum_32.S
19181--- linux-2.6.39.1/arch/x86/lib/checksum_32.S 2011-05-19 00:06:34.000000000 -0400
19182+++ linux-2.6.39.1/arch/x86/lib/checksum_32.S 2011-05-22 19:36:30.000000000 -0400
19183@@ -28,7 +28,8 @@
19184 #include <linux/linkage.h>
19185 #include <asm/dwarf2.h>
19186 #include <asm/errno.h>
19187-
19188+#include <asm/segment.h>
19189+
19190 /*
19191 * computes a partial checksum, e.g. for TCP/UDP fragments
19192 */
19193@@ -296,9 +297,24 @@ unsigned int csum_partial_copy_generic (
19194
19195 #define ARGBASE 16
19196 #define FP 12
19197-
19198-ENTRY(csum_partial_copy_generic)
19199+
19200+ENTRY(csum_partial_copy_generic_to_user)
19201 CFI_STARTPROC
19202+
19203+#ifdef CONFIG_PAX_MEMORY_UDEREF
19204+ pushl_cfi %gs
19205+ popl_cfi %es
19206+ jmp csum_partial_copy_generic
19207+#endif
19208+
19209+ENTRY(csum_partial_copy_generic_from_user)
19210+
19211+#ifdef CONFIG_PAX_MEMORY_UDEREF
19212+ pushl_cfi %gs
19213+ popl_cfi %ds
19214+#endif
19215+
19216+ENTRY(csum_partial_copy_generic)
19217 subl $4,%esp
19218 CFI_ADJUST_CFA_OFFSET 4
19219 pushl_cfi %edi
19220@@ -320,7 +336,7 @@ ENTRY(csum_partial_copy_generic)
19221 jmp 4f
19222 SRC(1: movw (%esi), %bx )
19223 addl $2, %esi
19224-DST( movw %bx, (%edi) )
19225+DST( movw %bx, %es:(%edi) )
19226 addl $2, %edi
19227 addw %bx, %ax
19228 adcl $0, %eax
19229@@ -332,30 +348,30 @@ DST( movw %bx, (%edi) )
19230 SRC(1: movl (%esi), %ebx )
19231 SRC( movl 4(%esi), %edx )
19232 adcl %ebx, %eax
19233-DST( movl %ebx, (%edi) )
19234+DST( movl %ebx, %es:(%edi) )
19235 adcl %edx, %eax
19236-DST( movl %edx, 4(%edi) )
19237+DST( movl %edx, %es:4(%edi) )
19238
19239 SRC( movl 8(%esi), %ebx )
19240 SRC( movl 12(%esi), %edx )
19241 adcl %ebx, %eax
19242-DST( movl %ebx, 8(%edi) )
19243+DST( movl %ebx, %es:8(%edi) )
19244 adcl %edx, %eax
19245-DST( movl %edx, 12(%edi) )
19246+DST( movl %edx, %es:12(%edi) )
19247
19248 SRC( movl 16(%esi), %ebx )
19249 SRC( movl 20(%esi), %edx )
19250 adcl %ebx, %eax
19251-DST( movl %ebx, 16(%edi) )
19252+DST( movl %ebx, %es:16(%edi) )
19253 adcl %edx, %eax
19254-DST( movl %edx, 20(%edi) )
19255+DST( movl %edx, %es:20(%edi) )
19256
19257 SRC( movl 24(%esi), %ebx )
19258 SRC( movl 28(%esi), %edx )
19259 adcl %ebx, %eax
19260-DST( movl %ebx, 24(%edi) )
19261+DST( movl %ebx, %es:24(%edi) )
19262 adcl %edx, %eax
19263-DST( movl %edx, 28(%edi) )
19264+DST( movl %edx, %es:28(%edi) )
19265
19266 lea 32(%esi), %esi
19267 lea 32(%edi), %edi
19268@@ -369,7 +385,7 @@ DST( movl %edx, 28(%edi) )
19269 shrl $2, %edx # This clears CF
19270 SRC(3: movl (%esi), %ebx )
19271 adcl %ebx, %eax
19272-DST( movl %ebx, (%edi) )
19273+DST( movl %ebx, %es:(%edi) )
19274 lea 4(%esi), %esi
19275 lea 4(%edi), %edi
19276 dec %edx
19277@@ -381,12 +397,12 @@ DST( movl %ebx, (%edi) )
19278 jb 5f
19279 SRC( movw (%esi), %cx )
19280 leal 2(%esi), %esi
19281-DST( movw %cx, (%edi) )
19282+DST( movw %cx, %es:(%edi) )
19283 leal 2(%edi), %edi
19284 je 6f
19285 shll $16,%ecx
19286 SRC(5: movb (%esi), %cl )
19287-DST( movb %cl, (%edi) )
19288+DST( movb %cl, %es:(%edi) )
19289 6: addl %ecx, %eax
19290 adcl $0, %eax
19291 7:
19292@@ -397,7 +413,7 @@ DST( movb %cl, (%edi) )
19293
19294 6001:
19295 movl ARGBASE+20(%esp), %ebx # src_err_ptr
19296- movl $-EFAULT, (%ebx)
19297+ movl $-EFAULT, %ss:(%ebx)
19298
19299 # zero the complete destination - computing the rest
19300 # is too much work
19301@@ -410,11 +426,15 @@ DST( movb %cl, (%edi) )
19302
19303 6002:
19304 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19305- movl $-EFAULT,(%ebx)
19306+ movl $-EFAULT,%ss:(%ebx)
19307 jmp 5000b
19308
19309 .previous
19310
19311+ pushl_cfi %ss
19312+ popl_cfi %ds
19313+ pushl_cfi %ss
19314+ popl_cfi %es
19315 popl_cfi %ebx
19316 CFI_RESTORE ebx
19317 popl_cfi %esi
19318@@ -424,26 +444,43 @@ DST( movb %cl, (%edi) )
19319 popl_cfi %ecx # equivalent to addl $4,%esp
19320 ret
19321 CFI_ENDPROC
19322-ENDPROC(csum_partial_copy_generic)
19323+ENDPROC(csum_partial_copy_generic_to_user)
19324
19325 #else
19326
19327 /* Version for PentiumII/PPro */
19328
19329 #define ROUND1(x) \
19330+ nop; nop; nop; \
19331 SRC(movl x(%esi), %ebx ) ; \
19332 addl %ebx, %eax ; \
19333- DST(movl %ebx, x(%edi) ) ;
19334+ DST(movl %ebx, %es:x(%edi)) ;
19335
19336 #define ROUND(x) \
19337+ nop; nop; nop; \
19338 SRC(movl x(%esi), %ebx ) ; \
19339 adcl %ebx, %eax ; \
19340- DST(movl %ebx, x(%edi) ) ;
19341+ DST(movl %ebx, %es:x(%edi)) ;
19342
19343 #define ARGBASE 12
19344-
19345-ENTRY(csum_partial_copy_generic)
19346+
19347+ENTRY(csum_partial_copy_generic_to_user)
19348 CFI_STARTPROC
19349+
19350+#ifdef CONFIG_PAX_MEMORY_UDEREF
19351+ pushl_cfi %gs
19352+ popl_cfi %es
19353+ jmp csum_partial_copy_generic
19354+#endif
19355+
19356+ENTRY(csum_partial_copy_generic_from_user)
19357+
19358+#ifdef CONFIG_PAX_MEMORY_UDEREF
19359+ pushl_cfi %gs
19360+ popl_cfi %ds
19361+#endif
19362+
19363+ENTRY(csum_partial_copy_generic)
19364 pushl_cfi %ebx
19365 CFI_REL_OFFSET ebx, 0
19366 pushl_cfi %edi
19367@@ -464,7 +501,7 @@ ENTRY(csum_partial_copy_generic)
19368 subl %ebx, %edi
19369 lea -1(%esi),%edx
19370 andl $-32,%edx
19371- lea 3f(%ebx,%ebx), %ebx
19372+ lea 3f(%ebx,%ebx,2), %ebx
19373 testl %esi, %esi
19374 jmp *%ebx
19375 1: addl $64,%esi
19376@@ -485,19 +522,19 @@ ENTRY(csum_partial_copy_generic)
19377 jb 5f
19378 SRC( movw (%esi), %dx )
19379 leal 2(%esi), %esi
19380-DST( movw %dx, (%edi) )
19381+DST( movw %dx, %es:(%edi) )
19382 leal 2(%edi), %edi
19383 je 6f
19384 shll $16,%edx
19385 5:
19386 SRC( movb (%esi), %dl )
19387-DST( movb %dl, (%edi) )
19388+DST( movb %dl, %es:(%edi) )
19389 6: addl %edx, %eax
19390 adcl $0, %eax
19391 7:
19392 .section .fixup, "ax"
19393 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
19394- movl $-EFAULT, (%ebx)
19395+ movl $-EFAULT, %ss:(%ebx)
19396 # zero the complete destination (computing the rest is too much work)
19397 movl ARGBASE+8(%esp),%edi # dst
19398 movl ARGBASE+12(%esp),%ecx # len
19399@@ -505,10 +542,17 @@ DST( movb %dl, (%edi) )
19400 rep; stosb
19401 jmp 7b
19402 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19403- movl $-EFAULT, (%ebx)
19404+ movl $-EFAULT, %ss:(%ebx)
19405 jmp 7b
19406 .previous
19407
19408+#ifdef CONFIG_PAX_MEMORY_UDEREF
19409+ pushl_cfi %ss
19410+ popl_cfi %ds
19411+ pushl_cfi %ss
19412+ popl_cfi %es
19413+#endif
19414+
19415 popl_cfi %esi
19416 CFI_RESTORE esi
19417 popl_cfi %edi
19418@@ -517,7 +561,7 @@ DST( movb %dl, (%edi) )
19419 CFI_RESTORE ebx
19420 ret
19421 CFI_ENDPROC
19422-ENDPROC(csum_partial_copy_generic)
19423+ENDPROC(csum_partial_copy_generic_to_user)
19424
19425 #undef ROUND
19426 #undef ROUND1
19427diff -urNp linux-2.6.39.1/arch/x86/lib/clear_page_64.S linux-2.6.39.1/arch/x86/lib/clear_page_64.S
19428--- linux-2.6.39.1/arch/x86/lib/clear_page_64.S 2011-05-19 00:06:34.000000000 -0400
19429+++ linux-2.6.39.1/arch/x86/lib/clear_page_64.S 2011-05-22 19:36:30.000000000 -0400
19430@@ -43,7 +43,7 @@ ENDPROC(clear_page)
19431
19432 #include <asm/cpufeature.h>
19433
19434- .section .altinstr_replacement,"ax"
19435+ .section .altinstr_replacement,"a"
19436 1: .byte 0xeb /* jmp <disp8> */
19437 .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
19438 2:
19439diff -urNp linux-2.6.39.1/arch/x86/lib/copy_page_64.S linux-2.6.39.1/arch/x86/lib/copy_page_64.S
19440--- linux-2.6.39.1/arch/x86/lib/copy_page_64.S 2011-05-19 00:06:34.000000000 -0400
19441+++ linux-2.6.39.1/arch/x86/lib/copy_page_64.S 2011-05-22 19:36:30.000000000 -0400
19442@@ -104,7 +104,7 @@ ENDPROC(copy_page)
19443
19444 #include <asm/cpufeature.h>
19445
19446- .section .altinstr_replacement,"ax"
19447+ .section .altinstr_replacement,"a"
19448 1: .byte 0xeb /* jmp <disp8> */
19449 .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
19450 2:
19451diff -urNp linux-2.6.39.1/arch/x86/lib/copy_user_64.S linux-2.6.39.1/arch/x86/lib/copy_user_64.S
19452--- linux-2.6.39.1/arch/x86/lib/copy_user_64.S 2011-06-03 00:04:13.000000000 -0400
19453+++ linux-2.6.39.1/arch/x86/lib/copy_user_64.S 2011-06-03 00:32:05.000000000 -0400
19454@@ -15,13 +15,14 @@
19455 #include <asm/asm-offsets.h>
19456 #include <asm/thread_info.h>
19457 #include <asm/cpufeature.h>
19458+#include <asm/pgtable.h>
19459
19460 .macro ALTERNATIVE_JUMP feature,orig,alt
19461 0:
19462 .byte 0xe9 /* 32bit jump */
19463 .long \orig-1f /* by default jump to orig */
19464 1:
19465- .section .altinstr_replacement,"ax"
19466+ .section .altinstr_replacement,"a"
19467 2: .byte 0xe9 /* near jump with 32bit immediate */
19468 .long \alt-1b /* offset */ /* or alternatively to alt */
19469 .previous
19470@@ -64,37 +65,13 @@
19471 #endif
19472 .endm
19473
19474-/* Standard copy_to_user with segment limit checking */
19475-ENTRY(_copy_to_user)
19476- CFI_STARTPROC
19477- GET_THREAD_INFO(%rax)
19478- movq %rdi,%rcx
19479- addq %rdx,%rcx
19480- jc bad_to_user
19481- cmpq TI_addr_limit(%rax),%rcx
19482- ja bad_to_user
19483- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
19484- CFI_ENDPROC
19485-ENDPROC(_copy_to_user)
19486-
19487-/* Standard copy_from_user with segment limit checking */
19488-ENTRY(_copy_from_user)
19489- CFI_STARTPROC
19490- GET_THREAD_INFO(%rax)
19491- movq %rsi,%rcx
19492- addq %rdx,%rcx
19493- jc bad_from_user
19494- cmpq TI_addr_limit(%rax),%rcx
19495- ja bad_from_user
19496- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
19497- CFI_ENDPROC
19498-ENDPROC(_copy_from_user)
19499-
19500 .section .fixup,"ax"
19501 /* must zero dest */
19502 ENTRY(bad_from_user)
19503 bad_from_user:
19504 CFI_STARTPROC
19505+ testl %edx,%edx
19506+ js bad_to_user
19507 movl %edx,%ecx
19508 xorl %eax,%eax
19509 rep
19510diff -urNp linux-2.6.39.1/arch/x86/lib/copy_user_nocache_64.S linux-2.6.39.1/arch/x86/lib/copy_user_nocache_64.S
19511--- linux-2.6.39.1/arch/x86/lib/copy_user_nocache_64.S 2011-05-19 00:06:34.000000000 -0400
19512+++ linux-2.6.39.1/arch/x86/lib/copy_user_nocache_64.S 2011-05-22 19:36:30.000000000 -0400
19513@@ -14,6 +14,7 @@
19514 #include <asm/current.h>
19515 #include <asm/asm-offsets.h>
19516 #include <asm/thread_info.h>
19517+#include <asm/pgtable.h>
19518
19519 .macro ALIGN_DESTINATION
19520 #ifdef FIX_ALIGNMENT
19521@@ -50,6 +51,15 @@
19522 */
19523 ENTRY(__copy_user_nocache)
19524 CFI_STARTPROC
19525+
19526+#ifdef CONFIG_PAX_MEMORY_UDEREF
19527+ mov $PAX_USER_SHADOW_BASE,%rcx
19528+ cmp %rcx,%rsi
19529+ jae 1f
19530+ add %rcx,%rsi
19531+1:
19532+#endif
19533+
19534 cmpl $8,%edx
19535 jb 20f /* less then 8 bytes, go to byte copy loop */
19536 ALIGN_DESTINATION
19537diff -urNp linux-2.6.39.1/arch/x86/lib/csum-wrappers_64.c linux-2.6.39.1/arch/x86/lib/csum-wrappers_64.c
19538--- linux-2.6.39.1/arch/x86/lib/csum-wrappers_64.c 2011-05-19 00:06:34.000000000 -0400
19539+++ linux-2.6.39.1/arch/x86/lib/csum-wrappers_64.c 2011-05-22 19:36:30.000000000 -0400
19540@@ -52,6 +52,12 @@ csum_partial_copy_from_user(const void _
19541 len -= 2;
19542 }
19543 }
19544+
19545+#ifdef CONFIG_PAX_MEMORY_UDEREF
19546+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
19547+ src += PAX_USER_SHADOW_BASE;
19548+#endif
19549+
19550 isum = csum_partial_copy_generic((__force const void *)src,
19551 dst, len, isum, errp, NULL);
19552 if (unlikely(*errp))
19553@@ -105,6 +111,12 @@ csum_partial_copy_to_user(const void *sr
19554 }
19555
19556 *errp = 0;
19557+
19558+#ifdef CONFIG_PAX_MEMORY_UDEREF
19559+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
19560+ dst += PAX_USER_SHADOW_BASE;
19561+#endif
19562+
19563 return csum_partial_copy_generic(src, (void __force *)dst,
19564 len, isum, NULL, errp);
19565 }
19566diff -urNp linux-2.6.39.1/arch/x86/lib/getuser.S linux-2.6.39.1/arch/x86/lib/getuser.S
19567--- linux-2.6.39.1/arch/x86/lib/getuser.S 2011-05-19 00:06:34.000000000 -0400
19568+++ linux-2.6.39.1/arch/x86/lib/getuser.S 2011-05-22 19:36:30.000000000 -0400
19569@@ -33,14 +33,35 @@
19570 #include <asm/asm-offsets.h>
19571 #include <asm/thread_info.h>
19572 #include <asm/asm.h>
19573+#include <asm/segment.h>
19574+#include <asm/pgtable.h>
19575+
19576+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
19577+#define __copyuser_seg gs;
19578+#else
19579+#define __copyuser_seg
19580+#endif
19581
19582 .text
19583 ENTRY(__get_user_1)
19584 CFI_STARTPROC
19585+
19586+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19587 GET_THREAD_INFO(%_ASM_DX)
19588 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19589 jae bad_get_user
19590-1: movzb (%_ASM_AX),%edx
19591+
19592+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19593+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19594+ cmp %_ASM_DX,%_ASM_AX
19595+ jae 1234f
19596+ add %_ASM_DX,%_ASM_AX
19597+1234:
19598+#endif
19599+
19600+#endif
19601+
19602+1: __copyuser_seg movzb (%_ASM_AX),%edx
19603 xor %eax,%eax
19604 ret
19605 CFI_ENDPROC
19606@@ -49,11 +70,24 @@ ENDPROC(__get_user_1)
19607 ENTRY(__get_user_2)
19608 CFI_STARTPROC
19609 add $1,%_ASM_AX
19610+
19611+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19612 jc bad_get_user
19613 GET_THREAD_INFO(%_ASM_DX)
19614 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19615 jae bad_get_user
19616-2: movzwl -1(%_ASM_AX),%edx
19617+
19618+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19619+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19620+ cmp %_ASM_DX,%_ASM_AX
19621+ jae 1234f
19622+ add %_ASM_DX,%_ASM_AX
19623+1234:
19624+#endif
19625+
19626+#endif
19627+
19628+2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
19629 xor %eax,%eax
19630 ret
19631 CFI_ENDPROC
19632@@ -62,11 +96,24 @@ ENDPROC(__get_user_2)
19633 ENTRY(__get_user_4)
19634 CFI_STARTPROC
19635 add $3,%_ASM_AX
19636+
19637+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19638 jc bad_get_user
19639 GET_THREAD_INFO(%_ASM_DX)
19640 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19641 jae bad_get_user
19642-3: mov -3(%_ASM_AX),%edx
19643+
19644+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19645+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19646+ cmp %_ASM_DX,%_ASM_AX
19647+ jae 1234f
19648+ add %_ASM_DX,%_ASM_AX
19649+1234:
19650+#endif
19651+
19652+#endif
19653+
19654+3: __copyuser_seg mov -3(%_ASM_AX),%edx
19655 xor %eax,%eax
19656 ret
19657 CFI_ENDPROC
19658@@ -80,6 +127,15 @@ ENTRY(__get_user_8)
19659 GET_THREAD_INFO(%_ASM_DX)
19660 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19661 jae bad_get_user
19662+
19663+#ifdef CONFIG_PAX_MEMORY_UDEREF
19664+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19665+ cmp %_ASM_DX,%_ASM_AX
19666+ jae 1234f
19667+ add %_ASM_DX,%_ASM_AX
19668+1234:
19669+#endif
19670+
19671 4: movq -7(%_ASM_AX),%_ASM_DX
19672 xor %eax,%eax
19673 ret
19674diff -urNp linux-2.6.39.1/arch/x86/lib/insn.c linux-2.6.39.1/arch/x86/lib/insn.c
19675--- linux-2.6.39.1/arch/x86/lib/insn.c 2011-05-19 00:06:34.000000000 -0400
19676+++ linux-2.6.39.1/arch/x86/lib/insn.c 2011-05-22 19:36:30.000000000 -0400
19677@@ -21,6 +21,11 @@
19678 #include <linux/string.h>
19679 #include <asm/inat.h>
19680 #include <asm/insn.h>
19681+#ifdef __KERNEL__
19682+#include <asm/pgtable_types.h>
19683+#else
19684+#define ktla_ktva(addr) addr
19685+#endif
19686
19687 #define get_next(t, insn) \
19688 ({t r; r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
19689@@ -40,8 +45,8 @@
19690 void insn_init(struct insn *insn, const void *kaddr, int x86_64)
19691 {
19692 memset(insn, 0, sizeof(*insn));
19693- insn->kaddr = kaddr;
19694- insn->next_byte = kaddr;
19695+ insn->kaddr = ktla_ktva(kaddr);
19696+ insn->next_byte = ktla_ktva(kaddr);
19697 insn->x86_64 = x86_64 ? 1 : 0;
19698 insn->opnd_bytes = 4;
19699 if (x86_64)
19700diff -urNp linux-2.6.39.1/arch/x86/lib/mmx_32.c linux-2.6.39.1/arch/x86/lib/mmx_32.c
19701--- linux-2.6.39.1/arch/x86/lib/mmx_32.c 2011-05-19 00:06:34.000000000 -0400
19702+++ linux-2.6.39.1/arch/x86/lib/mmx_32.c 2011-05-22 19:36:30.000000000 -0400
19703@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
19704 {
19705 void *p;
19706 int i;
19707+ unsigned long cr0;
19708
19709 if (unlikely(in_interrupt()))
19710 return __memcpy(to, from, len);
19711@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
19712 kernel_fpu_begin();
19713
19714 __asm__ __volatile__ (
19715- "1: prefetch (%0)\n" /* This set is 28 bytes */
19716- " prefetch 64(%0)\n"
19717- " prefetch 128(%0)\n"
19718- " prefetch 192(%0)\n"
19719- " prefetch 256(%0)\n"
19720+ "1: prefetch (%1)\n" /* This set is 28 bytes */
19721+ " prefetch 64(%1)\n"
19722+ " prefetch 128(%1)\n"
19723+ " prefetch 192(%1)\n"
19724+ " prefetch 256(%1)\n"
19725 "2: \n"
19726 ".section .fixup, \"ax\"\n"
19727- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19728+ "3: \n"
19729+
19730+#ifdef CONFIG_PAX_KERNEXEC
19731+ " movl %%cr0, %0\n"
19732+ " movl %0, %%eax\n"
19733+ " andl $0xFFFEFFFF, %%eax\n"
19734+ " movl %%eax, %%cr0\n"
19735+#endif
19736+
19737+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19738+
19739+#ifdef CONFIG_PAX_KERNEXEC
19740+ " movl %0, %%cr0\n"
19741+#endif
19742+
19743 " jmp 2b\n"
19744 ".previous\n"
19745 _ASM_EXTABLE(1b, 3b)
19746- : : "r" (from));
19747+ : "=&r" (cr0) : "r" (from) : "ax");
19748
19749 for ( ; i > 5; i--) {
19750 __asm__ __volatile__ (
19751- "1: prefetch 320(%0)\n"
19752- "2: movq (%0), %%mm0\n"
19753- " movq 8(%0), %%mm1\n"
19754- " movq 16(%0), %%mm2\n"
19755- " movq 24(%0), %%mm3\n"
19756- " movq %%mm0, (%1)\n"
19757- " movq %%mm1, 8(%1)\n"
19758- " movq %%mm2, 16(%1)\n"
19759- " movq %%mm3, 24(%1)\n"
19760- " movq 32(%0), %%mm0\n"
19761- " movq 40(%0), %%mm1\n"
19762- " movq 48(%0), %%mm2\n"
19763- " movq 56(%0), %%mm3\n"
19764- " movq %%mm0, 32(%1)\n"
19765- " movq %%mm1, 40(%1)\n"
19766- " movq %%mm2, 48(%1)\n"
19767- " movq %%mm3, 56(%1)\n"
19768+ "1: prefetch 320(%1)\n"
19769+ "2: movq (%1), %%mm0\n"
19770+ " movq 8(%1), %%mm1\n"
19771+ " movq 16(%1), %%mm2\n"
19772+ " movq 24(%1), %%mm3\n"
19773+ " movq %%mm0, (%2)\n"
19774+ " movq %%mm1, 8(%2)\n"
19775+ " movq %%mm2, 16(%2)\n"
19776+ " movq %%mm3, 24(%2)\n"
19777+ " movq 32(%1), %%mm0\n"
19778+ " movq 40(%1), %%mm1\n"
19779+ " movq 48(%1), %%mm2\n"
19780+ " movq 56(%1), %%mm3\n"
19781+ " movq %%mm0, 32(%2)\n"
19782+ " movq %%mm1, 40(%2)\n"
19783+ " movq %%mm2, 48(%2)\n"
19784+ " movq %%mm3, 56(%2)\n"
19785 ".section .fixup, \"ax\"\n"
19786- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19787+ "3:\n"
19788+
19789+#ifdef CONFIG_PAX_KERNEXEC
19790+ " movl %%cr0, %0\n"
19791+ " movl %0, %%eax\n"
19792+ " andl $0xFFFEFFFF, %%eax\n"
19793+ " movl %%eax, %%cr0\n"
19794+#endif
19795+
19796+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19797+
19798+#ifdef CONFIG_PAX_KERNEXEC
19799+ " movl %0, %%cr0\n"
19800+#endif
19801+
19802 " jmp 2b\n"
19803 ".previous\n"
19804 _ASM_EXTABLE(1b, 3b)
19805- : : "r" (from), "r" (to) : "memory");
19806+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
19807
19808 from += 64;
19809 to += 64;
19810@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
19811 static void fast_copy_page(void *to, void *from)
19812 {
19813 int i;
19814+ unsigned long cr0;
19815
19816 kernel_fpu_begin();
19817
19818@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
19819 * but that is for later. -AV
19820 */
19821 __asm__ __volatile__(
19822- "1: prefetch (%0)\n"
19823- " prefetch 64(%0)\n"
19824- " prefetch 128(%0)\n"
19825- " prefetch 192(%0)\n"
19826- " prefetch 256(%0)\n"
19827+ "1: prefetch (%1)\n"
19828+ " prefetch 64(%1)\n"
19829+ " prefetch 128(%1)\n"
19830+ " prefetch 192(%1)\n"
19831+ " prefetch 256(%1)\n"
19832 "2: \n"
19833 ".section .fixup, \"ax\"\n"
19834- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19835+ "3: \n"
19836+
19837+#ifdef CONFIG_PAX_KERNEXEC
19838+ " movl %%cr0, %0\n"
19839+ " movl %0, %%eax\n"
19840+ " andl $0xFFFEFFFF, %%eax\n"
19841+ " movl %%eax, %%cr0\n"
19842+#endif
19843+
19844+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19845+
19846+#ifdef CONFIG_PAX_KERNEXEC
19847+ " movl %0, %%cr0\n"
19848+#endif
19849+
19850 " jmp 2b\n"
19851 ".previous\n"
19852- _ASM_EXTABLE(1b, 3b) : : "r" (from));
19853+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
19854
19855 for (i = 0; i < (4096-320)/64; i++) {
19856 __asm__ __volatile__ (
19857- "1: prefetch 320(%0)\n"
19858- "2: movq (%0), %%mm0\n"
19859- " movntq %%mm0, (%1)\n"
19860- " movq 8(%0), %%mm1\n"
19861- " movntq %%mm1, 8(%1)\n"
19862- " movq 16(%0), %%mm2\n"
19863- " movntq %%mm2, 16(%1)\n"
19864- " movq 24(%0), %%mm3\n"
19865- " movntq %%mm3, 24(%1)\n"
19866- " movq 32(%0), %%mm4\n"
19867- " movntq %%mm4, 32(%1)\n"
19868- " movq 40(%0), %%mm5\n"
19869- " movntq %%mm5, 40(%1)\n"
19870- " movq 48(%0), %%mm6\n"
19871- " movntq %%mm6, 48(%1)\n"
19872- " movq 56(%0), %%mm7\n"
19873- " movntq %%mm7, 56(%1)\n"
19874+ "1: prefetch 320(%1)\n"
19875+ "2: movq (%1), %%mm0\n"
19876+ " movntq %%mm0, (%2)\n"
19877+ " movq 8(%1), %%mm1\n"
19878+ " movntq %%mm1, 8(%2)\n"
19879+ " movq 16(%1), %%mm2\n"
19880+ " movntq %%mm2, 16(%2)\n"
19881+ " movq 24(%1), %%mm3\n"
19882+ " movntq %%mm3, 24(%2)\n"
19883+ " movq 32(%1), %%mm4\n"
19884+ " movntq %%mm4, 32(%2)\n"
19885+ " movq 40(%1), %%mm5\n"
19886+ " movntq %%mm5, 40(%2)\n"
19887+ " movq 48(%1), %%mm6\n"
19888+ " movntq %%mm6, 48(%2)\n"
19889+ " movq 56(%1), %%mm7\n"
19890+ " movntq %%mm7, 56(%2)\n"
19891 ".section .fixup, \"ax\"\n"
19892- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19893+ "3:\n"
19894+
19895+#ifdef CONFIG_PAX_KERNEXEC
19896+ " movl %%cr0, %0\n"
19897+ " movl %0, %%eax\n"
19898+ " andl $0xFFFEFFFF, %%eax\n"
19899+ " movl %%eax, %%cr0\n"
19900+#endif
19901+
19902+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19903+
19904+#ifdef CONFIG_PAX_KERNEXEC
19905+ " movl %0, %%cr0\n"
19906+#endif
19907+
19908 " jmp 2b\n"
19909 ".previous\n"
19910- _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
19911+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
19912
19913 from += 64;
19914 to += 64;
19915@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
19916 static void fast_copy_page(void *to, void *from)
19917 {
19918 int i;
19919+ unsigned long cr0;
19920
19921 kernel_fpu_begin();
19922
19923 __asm__ __volatile__ (
19924- "1: prefetch (%0)\n"
19925- " prefetch 64(%0)\n"
19926- " prefetch 128(%0)\n"
19927- " prefetch 192(%0)\n"
19928- " prefetch 256(%0)\n"
19929+ "1: prefetch (%1)\n"
19930+ " prefetch 64(%1)\n"
19931+ " prefetch 128(%1)\n"
19932+ " prefetch 192(%1)\n"
19933+ " prefetch 256(%1)\n"
19934 "2: \n"
19935 ".section .fixup, \"ax\"\n"
19936- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19937+ "3: \n"
19938+
19939+#ifdef CONFIG_PAX_KERNEXEC
19940+ " movl %%cr0, %0\n"
19941+ " movl %0, %%eax\n"
19942+ " andl $0xFFFEFFFF, %%eax\n"
19943+ " movl %%eax, %%cr0\n"
19944+#endif
19945+
19946+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19947+
19948+#ifdef CONFIG_PAX_KERNEXEC
19949+ " movl %0, %%cr0\n"
19950+#endif
19951+
19952 " jmp 2b\n"
19953 ".previous\n"
19954- _ASM_EXTABLE(1b, 3b) : : "r" (from));
19955+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
19956
19957 for (i = 0; i < 4096/64; i++) {
19958 __asm__ __volatile__ (
19959- "1: prefetch 320(%0)\n"
19960- "2: movq (%0), %%mm0\n"
19961- " movq 8(%0), %%mm1\n"
19962- " movq 16(%0), %%mm2\n"
19963- " movq 24(%0), %%mm3\n"
19964- " movq %%mm0, (%1)\n"
19965- " movq %%mm1, 8(%1)\n"
19966- " movq %%mm2, 16(%1)\n"
19967- " movq %%mm3, 24(%1)\n"
19968- " movq 32(%0), %%mm0\n"
19969- " movq 40(%0), %%mm1\n"
19970- " movq 48(%0), %%mm2\n"
19971- " movq 56(%0), %%mm3\n"
19972- " movq %%mm0, 32(%1)\n"
19973- " movq %%mm1, 40(%1)\n"
19974- " movq %%mm2, 48(%1)\n"
19975- " movq %%mm3, 56(%1)\n"
19976+ "1: prefetch 320(%1)\n"
19977+ "2: movq (%1), %%mm0\n"
19978+ " movq 8(%1), %%mm1\n"
19979+ " movq 16(%1), %%mm2\n"
19980+ " movq 24(%1), %%mm3\n"
19981+ " movq %%mm0, (%2)\n"
19982+ " movq %%mm1, 8(%2)\n"
19983+ " movq %%mm2, 16(%2)\n"
19984+ " movq %%mm3, 24(%2)\n"
19985+ " movq 32(%1), %%mm0\n"
19986+ " movq 40(%1), %%mm1\n"
19987+ " movq 48(%1), %%mm2\n"
19988+ " movq 56(%1), %%mm3\n"
19989+ " movq %%mm0, 32(%2)\n"
19990+ " movq %%mm1, 40(%2)\n"
19991+ " movq %%mm2, 48(%2)\n"
19992+ " movq %%mm3, 56(%2)\n"
19993 ".section .fixup, \"ax\"\n"
19994- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19995+ "3:\n"
19996+
19997+#ifdef CONFIG_PAX_KERNEXEC
19998+ " movl %%cr0, %0\n"
19999+ " movl %0, %%eax\n"
20000+ " andl $0xFFFEFFFF, %%eax\n"
20001+ " movl %%eax, %%cr0\n"
20002+#endif
20003+
20004+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20005+
20006+#ifdef CONFIG_PAX_KERNEXEC
20007+ " movl %0, %%cr0\n"
20008+#endif
20009+
20010 " jmp 2b\n"
20011 ".previous\n"
20012 _ASM_EXTABLE(1b, 3b)
20013- : : "r" (from), "r" (to) : "memory");
20014+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20015
20016 from += 64;
20017 to += 64;
20018diff -urNp linux-2.6.39.1/arch/x86/lib/putuser.S linux-2.6.39.1/arch/x86/lib/putuser.S
20019--- linux-2.6.39.1/arch/x86/lib/putuser.S 2011-05-19 00:06:34.000000000 -0400
20020+++ linux-2.6.39.1/arch/x86/lib/putuser.S 2011-05-22 19:36:30.000000000 -0400
20021@@ -15,7 +15,8 @@
20022 #include <asm/thread_info.h>
20023 #include <asm/errno.h>
20024 #include <asm/asm.h>
20025-
20026+#include <asm/segment.h>
20027+#include <asm/pgtable.h>
20028
20029 /*
20030 * __put_user_X
20031@@ -29,52 +30,119 @@
20032 * as they get called from within inline assembly.
20033 */
20034
20035-#define ENTER CFI_STARTPROC ; \
20036- GET_THREAD_INFO(%_ASM_BX)
20037+#define ENTER CFI_STARTPROC
20038 #define EXIT ret ; \
20039 CFI_ENDPROC
20040
20041+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20042+#define _DEST %_ASM_CX,%_ASM_BX
20043+#else
20044+#define _DEST %_ASM_CX
20045+#endif
20046+
20047+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
20048+#define __copyuser_seg gs;
20049+#else
20050+#define __copyuser_seg
20051+#endif
20052+
20053 .text
20054 ENTRY(__put_user_1)
20055 ENTER
20056+
20057+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20058+ GET_THREAD_INFO(%_ASM_BX)
20059 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
20060 jae bad_put_user
20061-1: movb %al,(%_ASM_CX)
20062+
20063+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20064+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20065+ cmp %_ASM_BX,%_ASM_CX
20066+ jb 1234f
20067+ xor %ebx,%ebx
20068+1234:
20069+#endif
20070+
20071+#endif
20072+
20073+1: __copyuser_seg movb %al,(_DEST)
20074 xor %eax,%eax
20075 EXIT
20076 ENDPROC(__put_user_1)
20077
20078 ENTRY(__put_user_2)
20079 ENTER
20080+
20081+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20082+ GET_THREAD_INFO(%_ASM_BX)
20083 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20084 sub $1,%_ASM_BX
20085 cmp %_ASM_BX,%_ASM_CX
20086 jae bad_put_user
20087-2: movw %ax,(%_ASM_CX)
20088+
20089+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20090+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20091+ cmp %_ASM_BX,%_ASM_CX
20092+ jb 1234f
20093+ xor %ebx,%ebx
20094+1234:
20095+#endif
20096+
20097+#endif
20098+
20099+2: __copyuser_seg movw %ax,(_DEST)
20100 xor %eax,%eax
20101 EXIT
20102 ENDPROC(__put_user_2)
20103
20104 ENTRY(__put_user_4)
20105 ENTER
20106+
20107+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20108+ GET_THREAD_INFO(%_ASM_BX)
20109 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20110 sub $3,%_ASM_BX
20111 cmp %_ASM_BX,%_ASM_CX
20112 jae bad_put_user
20113-3: movl %eax,(%_ASM_CX)
20114+
20115+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20116+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20117+ cmp %_ASM_BX,%_ASM_CX
20118+ jb 1234f
20119+ xor %ebx,%ebx
20120+1234:
20121+#endif
20122+
20123+#endif
20124+
20125+3: __copyuser_seg movl %eax,(_DEST)
20126 xor %eax,%eax
20127 EXIT
20128 ENDPROC(__put_user_4)
20129
20130 ENTRY(__put_user_8)
20131 ENTER
20132+
20133+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20134+ GET_THREAD_INFO(%_ASM_BX)
20135 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20136 sub $7,%_ASM_BX
20137 cmp %_ASM_BX,%_ASM_CX
20138 jae bad_put_user
20139-4: mov %_ASM_AX,(%_ASM_CX)
20140+
20141+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20142+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20143+ cmp %_ASM_BX,%_ASM_CX
20144+ jb 1234f
20145+ xor %ebx,%ebx
20146+1234:
20147+#endif
20148+
20149+#endif
20150+
20151+4: __copyuser_seg mov %_ASM_AX,(_DEST)
20152 #ifdef CONFIG_X86_32
20153-5: movl %edx,4(%_ASM_CX)
20154+5: __copyuser_seg movl %edx,4(_DEST)
20155 #endif
20156 xor %eax,%eax
20157 EXIT
20158diff -urNp linux-2.6.39.1/arch/x86/lib/usercopy_32.c linux-2.6.39.1/arch/x86/lib/usercopy_32.c
20159--- linux-2.6.39.1/arch/x86/lib/usercopy_32.c 2011-05-19 00:06:34.000000000 -0400
20160+++ linux-2.6.39.1/arch/x86/lib/usercopy_32.c 2011-05-22 19:36:30.000000000 -0400
20161@@ -43,7 +43,7 @@ do { \
20162 __asm__ __volatile__( \
20163 " testl %1,%1\n" \
20164 " jz 2f\n" \
20165- "0: lodsb\n" \
20166+ "0: "__copyuser_seg"lodsb\n" \
20167 " stosb\n" \
20168 " testb %%al,%%al\n" \
20169 " jz 1f\n" \
20170@@ -128,10 +128,12 @@ do { \
20171 int __d0; \
20172 might_fault(); \
20173 __asm__ __volatile__( \
20174+ __COPYUSER_SET_ES \
20175 "0: rep; stosl\n" \
20176 " movl %2,%0\n" \
20177 "1: rep; stosb\n" \
20178 "2:\n" \
20179+ __COPYUSER_RESTORE_ES \
20180 ".section .fixup,\"ax\"\n" \
20181 "3: lea 0(%2,%0,4),%0\n" \
20182 " jmp 2b\n" \
20183@@ -200,6 +202,7 @@ long strnlen_user(const char __user *s,
20184 might_fault();
20185
20186 __asm__ __volatile__(
20187+ __COPYUSER_SET_ES
20188 " testl %0, %0\n"
20189 " jz 3f\n"
20190 " andl %0,%%ecx\n"
20191@@ -208,6 +211,7 @@ long strnlen_user(const char __user *s,
20192 " subl %%ecx,%0\n"
20193 " addl %0,%%eax\n"
20194 "1:\n"
20195+ __COPYUSER_RESTORE_ES
20196 ".section .fixup,\"ax\"\n"
20197 "2: xorl %%eax,%%eax\n"
20198 " jmp 1b\n"
20199@@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
20200
20201 #ifdef CONFIG_X86_INTEL_USERCOPY
20202 static unsigned long
20203-__copy_user_intel(void __user *to, const void *from, unsigned long size)
20204+__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
20205 {
20206 int d0, d1;
20207 __asm__ __volatile__(
20208@@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const
20209 " .align 2,0x90\n"
20210 "3: movl 0(%4), %%eax\n"
20211 "4: movl 4(%4), %%edx\n"
20212- "5: movl %%eax, 0(%3)\n"
20213- "6: movl %%edx, 4(%3)\n"
20214+ "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
20215+ "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
20216 "7: movl 8(%4), %%eax\n"
20217 "8: movl 12(%4),%%edx\n"
20218- "9: movl %%eax, 8(%3)\n"
20219- "10: movl %%edx, 12(%3)\n"
20220+ "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
20221+ "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
20222 "11: movl 16(%4), %%eax\n"
20223 "12: movl 20(%4), %%edx\n"
20224- "13: movl %%eax, 16(%3)\n"
20225- "14: movl %%edx, 20(%3)\n"
20226+ "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
20227+ "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
20228 "15: movl 24(%4), %%eax\n"
20229 "16: movl 28(%4), %%edx\n"
20230- "17: movl %%eax, 24(%3)\n"
20231- "18: movl %%edx, 28(%3)\n"
20232+ "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
20233+ "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
20234 "19: movl 32(%4), %%eax\n"
20235 "20: movl 36(%4), %%edx\n"
20236- "21: movl %%eax, 32(%3)\n"
20237- "22: movl %%edx, 36(%3)\n"
20238+ "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
20239+ "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
20240 "23: movl 40(%4), %%eax\n"
20241 "24: movl 44(%4), %%edx\n"
20242- "25: movl %%eax, 40(%3)\n"
20243- "26: movl %%edx, 44(%3)\n"
20244+ "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
20245+ "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
20246 "27: movl 48(%4), %%eax\n"
20247 "28: movl 52(%4), %%edx\n"
20248- "29: movl %%eax, 48(%3)\n"
20249- "30: movl %%edx, 52(%3)\n"
20250+ "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
20251+ "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
20252 "31: movl 56(%4), %%eax\n"
20253 "32: movl 60(%4), %%edx\n"
20254- "33: movl %%eax, 56(%3)\n"
20255- "34: movl %%edx, 60(%3)\n"
20256+ "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
20257+ "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
20258 " addl $-64, %0\n"
20259 " addl $64, %4\n"
20260 " addl $64, %3\n"
20261@@ -278,10 +282,119 @@ __copy_user_intel(void __user *to, const
20262 " shrl $2, %0\n"
20263 " andl $3, %%eax\n"
20264 " cld\n"
20265+ __COPYUSER_SET_ES
20266 "99: rep; movsl\n"
20267 "36: movl %%eax, %0\n"
20268 "37: rep; movsb\n"
20269 "100:\n"
20270+ __COPYUSER_RESTORE_ES
20271+ ".section .fixup,\"ax\"\n"
20272+ "101: lea 0(%%eax,%0,4),%0\n"
20273+ " jmp 100b\n"
20274+ ".previous\n"
20275+ ".section __ex_table,\"a\"\n"
20276+ " .align 4\n"
20277+ " .long 1b,100b\n"
20278+ " .long 2b,100b\n"
20279+ " .long 3b,100b\n"
20280+ " .long 4b,100b\n"
20281+ " .long 5b,100b\n"
20282+ " .long 6b,100b\n"
20283+ " .long 7b,100b\n"
20284+ " .long 8b,100b\n"
20285+ " .long 9b,100b\n"
20286+ " .long 10b,100b\n"
20287+ " .long 11b,100b\n"
20288+ " .long 12b,100b\n"
20289+ " .long 13b,100b\n"
20290+ " .long 14b,100b\n"
20291+ " .long 15b,100b\n"
20292+ " .long 16b,100b\n"
20293+ " .long 17b,100b\n"
20294+ " .long 18b,100b\n"
20295+ " .long 19b,100b\n"
20296+ " .long 20b,100b\n"
20297+ " .long 21b,100b\n"
20298+ " .long 22b,100b\n"
20299+ " .long 23b,100b\n"
20300+ " .long 24b,100b\n"
20301+ " .long 25b,100b\n"
20302+ " .long 26b,100b\n"
20303+ " .long 27b,100b\n"
20304+ " .long 28b,100b\n"
20305+ " .long 29b,100b\n"
20306+ " .long 30b,100b\n"
20307+ " .long 31b,100b\n"
20308+ " .long 32b,100b\n"
20309+ " .long 33b,100b\n"
20310+ " .long 34b,100b\n"
20311+ " .long 35b,100b\n"
20312+ " .long 36b,100b\n"
20313+ " .long 37b,100b\n"
20314+ " .long 99b,101b\n"
20315+ ".previous"
20316+ : "=&c"(size), "=&D" (d0), "=&S" (d1)
20317+ : "1"(to), "2"(from), "0"(size)
20318+ : "eax", "edx", "memory");
20319+ return size;
20320+}
20321+
20322+static unsigned long
20323+__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
20324+{
20325+ int d0, d1;
20326+ __asm__ __volatile__(
20327+ " .align 2,0x90\n"
20328+ "1: "__copyuser_seg" movl 32(%4), %%eax\n"
20329+ " cmpl $67, %0\n"
20330+ " jbe 3f\n"
20331+ "2: "__copyuser_seg" movl 64(%4), %%eax\n"
20332+ " .align 2,0x90\n"
20333+ "3: "__copyuser_seg" movl 0(%4), %%eax\n"
20334+ "4: "__copyuser_seg" movl 4(%4), %%edx\n"
20335+ "5: movl %%eax, 0(%3)\n"
20336+ "6: movl %%edx, 4(%3)\n"
20337+ "7: "__copyuser_seg" movl 8(%4), %%eax\n"
20338+ "8: "__copyuser_seg" movl 12(%4),%%edx\n"
20339+ "9: movl %%eax, 8(%3)\n"
20340+ "10: movl %%edx, 12(%3)\n"
20341+ "11: "__copyuser_seg" movl 16(%4), %%eax\n"
20342+ "12: "__copyuser_seg" movl 20(%4), %%edx\n"
20343+ "13: movl %%eax, 16(%3)\n"
20344+ "14: movl %%edx, 20(%3)\n"
20345+ "15: "__copyuser_seg" movl 24(%4), %%eax\n"
20346+ "16: "__copyuser_seg" movl 28(%4), %%edx\n"
20347+ "17: movl %%eax, 24(%3)\n"
20348+ "18: movl %%edx, 28(%3)\n"
20349+ "19: "__copyuser_seg" movl 32(%4), %%eax\n"
20350+ "20: "__copyuser_seg" movl 36(%4), %%edx\n"
20351+ "21: movl %%eax, 32(%3)\n"
20352+ "22: movl %%edx, 36(%3)\n"
20353+ "23: "__copyuser_seg" movl 40(%4), %%eax\n"
20354+ "24: "__copyuser_seg" movl 44(%4), %%edx\n"
20355+ "25: movl %%eax, 40(%3)\n"
20356+ "26: movl %%edx, 44(%3)\n"
20357+ "27: "__copyuser_seg" movl 48(%4), %%eax\n"
20358+ "28: "__copyuser_seg" movl 52(%4), %%edx\n"
20359+ "29: movl %%eax, 48(%3)\n"
20360+ "30: movl %%edx, 52(%3)\n"
20361+ "31: "__copyuser_seg" movl 56(%4), %%eax\n"
20362+ "32: "__copyuser_seg" movl 60(%4), %%edx\n"
20363+ "33: movl %%eax, 56(%3)\n"
20364+ "34: movl %%edx, 60(%3)\n"
20365+ " addl $-64, %0\n"
20366+ " addl $64, %4\n"
20367+ " addl $64, %3\n"
20368+ " cmpl $63, %0\n"
20369+ " ja 1b\n"
20370+ "35: movl %0, %%eax\n"
20371+ " shrl $2, %0\n"
20372+ " andl $3, %%eax\n"
20373+ " cld\n"
20374+ "99: rep; "__copyuser_seg" movsl\n"
20375+ "36: movl %%eax, %0\n"
20376+ "37: rep; "__copyuser_seg" movsb\n"
20377+ "100:\n"
20378 ".section .fixup,\"ax\"\n"
20379 "101: lea 0(%%eax,%0,4),%0\n"
20380 " jmp 100b\n"
20381@@ -339,41 +452,41 @@ __copy_user_zeroing_intel(void *to, cons
20382 int d0, d1;
20383 __asm__ __volatile__(
20384 " .align 2,0x90\n"
20385- "0: movl 32(%4), %%eax\n"
20386+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20387 " cmpl $67, %0\n"
20388 " jbe 2f\n"
20389- "1: movl 64(%4), %%eax\n"
20390+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20391 " .align 2,0x90\n"
20392- "2: movl 0(%4), %%eax\n"
20393- "21: movl 4(%4), %%edx\n"
20394+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20395+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20396 " movl %%eax, 0(%3)\n"
20397 " movl %%edx, 4(%3)\n"
20398- "3: movl 8(%4), %%eax\n"
20399- "31: movl 12(%4),%%edx\n"
20400+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20401+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20402 " movl %%eax, 8(%3)\n"
20403 " movl %%edx, 12(%3)\n"
20404- "4: movl 16(%4), %%eax\n"
20405- "41: movl 20(%4), %%edx\n"
20406+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20407+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20408 " movl %%eax, 16(%3)\n"
20409 " movl %%edx, 20(%3)\n"
20410- "10: movl 24(%4), %%eax\n"
20411- "51: movl 28(%4), %%edx\n"
20412+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20413+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20414 " movl %%eax, 24(%3)\n"
20415 " movl %%edx, 28(%3)\n"
20416- "11: movl 32(%4), %%eax\n"
20417- "61: movl 36(%4), %%edx\n"
20418+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20419+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20420 " movl %%eax, 32(%3)\n"
20421 " movl %%edx, 36(%3)\n"
20422- "12: movl 40(%4), %%eax\n"
20423- "71: movl 44(%4), %%edx\n"
20424+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20425+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20426 " movl %%eax, 40(%3)\n"
20427 " movl %%edx, 44(%3)\n"
20428- "13: movl 48(%4), %%eax\n"
20429- "81: movl 52(%4), %%edx\n"
20430+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20431+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20432 " movl %%eax, 48(%3)\n"
20433 " movl %%edx, 52(%3)\n"
20434- "14: movl 56(%4), %%eax\n"
20435- "91: movl 60(%4), %%edx\n"
20436+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20437+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20438 " movl %%eax, 56(%3)\n"
20439 " movl %%edx, 60(%3)\n"
20440 " addl $-64, %0\n"
20441@@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, cons
20442 " shrl $2, %0\n"
20443 " andl $3, %%eax\n"
20444 " cld\n"
20445- "6: rep; movsl\n"
20446+ "6: rep; "__copyuser_seg" movsl\n"
20447 " movl %%eax,%0\n"
20448- "7: rep; movsb\n"
20449+ "7: rep; "__copyuser_seg" movsb\n"
20450 "8:\n"
20451 ".section .fixup,\"ax\"\n"
20452 "9: lea 0(%%eax,%0,4),%0\n"
20453@@ -440,41 +553,41 @@ static unsigned long __copy_user_zeroing
20454
20455 __asm__ __volatile__(
20456 " .align 2,0x90\n"
20457- "0: movl 32(%4), %%eax\n"
20458+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20459 " cmpl $67, %0\n"
20460 " jbe 2f\n"
20461- "1: movl 64(%4), %%eax\n"
20462+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20463 " .align 2,0x90\n"
20464- "2: movl 0(%4), %%eax\n"
20465- "21: movl 4(%4), %%edx\n"
20466+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20467+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20468 " movnti %%eax, 0(%3)\n"
20469 " movnti %%edx, 4(%3)\n"
20470- "3: movl 8(%4), %%eax\n"
20471- "31: movl 12(%4),%%edx\n"
20472+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20473+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20474 " movnti %%eax, 8(%3)\n"
20475 " movnti %%edx, 12(%3)\n"
20476- "4: movl 16(%4), %%eax\n"
20477- "41: movl 20(%4), %%edx\n"
20478+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20479+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20480 " movnti %%eax, 16(%3)\n"
20481 " movnti %%edx, 20(%3)\n"
20482- "10: movl 24(%4), %%eax\n"
20483- "51: movl 28(%4), %%edx\n"
20484+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20485+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20486 " movnti %%eax, 24(%3)\n"
20487 " movnti %%edx, 28(%3)\n"
20488- "11: movl 32(%4), %%eax\n"
20489- "61: movl 36(%4), %%edx\n"
20490+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20491+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20492 " movnti %%eax, 32(%3)\n"
20493 " movnti %%edx, 36(%3)\n"
20494- "12: movl 40(%4), %%eax\n"
20495- "71: movl 44(%4), %%edx\n"
20496+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20497+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20498 " movnti %%eax, 40(%3)\n"
20499 " movnti %%edx, 44(%3)\n"
20500- "13: movl 48(%4), %%eax\n"
20501- "81: movl 52(%4), %%edx\n"
20502+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20503+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20504 " movnti %%eax, 48(%3)\n"
20505 " movnti %%edx, 52(%3)\n"
20506- "14: movl 56(%4), %%eax\n"
20507- "91: movl 60(%4), %%edx\n"
20508+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20509+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20510 " movnti %%eax, 56(%3)\n"
20511 " movnti %%edx, 60(%3)\n"
20512 " addl $-64, %0\n"
20513@@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing
20514 " shrl $2, %0\n"
20515 " andl $3, %%eax\n"
20516 " cld\n"
20517- "6: rep; movsl\n"
20518+ "6: rep; "__copyuser_seg" movsl\n"
20519 " movl %%eax,%0\n"
20520- "7: rep; movsb\n"
20521+ "7: rep; "__copyuser_seg" movsb\n"
20522 "8:\n"
20523 ".section .fixup,\"ax\"\n"
20524 "9: lea 0(%%eax,%0,4),%0\n"
20525@@ -537,41 +650,41 @@ static unsigned long __copy_user_intel_n
20526
20527 __asm__ __volatile__(
20528 " .align 2,0x90\n"
20529- "0: movl 32(%4), %%eax\n"
20530+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20531 " cmpl $67, %0\n"
20532 " jbe 2f\n"
20533- "1: movl 64(%4), %%eax\n"
20534+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20535 " .align 2,0x90\n"
20536- "2: movl 0(%4), %%eax\n"
20537- "21: movl 4(%4), %%edx\n"
20538+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20539+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20540 " movnti %%eax, 0(%3)\n"
20541 " movnti %%edx, 4(%3)\n"
20542- "3: movl 8(%4), %%eax\n"
20543- "31: movl 12(%4),%%edx\n"
20544+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20545+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20546 " movnti %%eax, 8(%3)\n"
20547 " movnti %%edx, 12(%3)\n"
20548- "4: movl 16(%4), %%eax\n"
20549- "41: movl 20(%4), %%edx\n"
20550+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20551+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20552 " movnti %%eax, 16(%3)\n"
20553 " movnti %%edx, 20(%3)\n"
20554- "10: movl 24(%4), %%eax\n"
20555- "51: movl 28(%4), %%edx\n"
20556+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20557+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20558 " movnti %%eax, 24(%3)\n"
20559 " movnti %%edx, 28(%3)\n"
20560- "11: movl 32(%4), %%eax\n"
20561- "61: movl 36(%4), %%edx\n"
20562+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20563+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20564 " movnti %%eax, 32(%3)\n"
20565 " movnti %%edx, 36(%3)\n"
20566- "12: movl 40(%4), %%eax\n"
20567- "71: movl 44(%4), %%edx\n"
20568+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20569+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20570 " movnti %%eax, 40(%3)\n"
20571 " movnti %%edx, 44(%3)\n"
20572- "13: movl 48(%4), %%eax\n"
20573- "81: movl 52(%4), %%edx\n"
20574+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20575+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20576 " movnti %%eax, 48(%3)\n"
20577 " movnti %%edx, 52(%3)\n"
20578- "14: movl 56(%4), %%eax\n"
20579- "91: movl 60(%4), %%edx\n"
20580+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20581+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20582 " movnti %%eax, 56(%3)\n"
20583 " movnti %%edx, 60(%3)\n"
20584 " addl $-64, %0\n"
20585@@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_n
20586 " shrl $2, %0\n"
20587 " andl $3, %%eax\n"
20588 " cld\n"
20589- "6: rep; movsl\n"
20590+ "6: rep; "__copyuser_seg" movsl\n"
20591 " movl %%eax,%0\n"
20592- "7: rep; movsb\n"
20593+ "7: rep; "__copyuser_seg" movsb\n"
20594 "8:\n"
20595 ".section .fixup,\"ax\"\n"
20596 "9: lea 0(%%eax,%0,4),%0\n"
20597@@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_n
20598 */
20599 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
20600 unsigned long size);
20601-unsigned long __copy_user_intel(void __user *to, const void *from,
20602+unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
20603+ unsigned long size);
20604+unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
20605 unsigned long size);
20606 unsigned long __copy_user_zeroing_intel_nocache(void *to,
20607 const void __user *from, unsigned long size);
20608 #endif /* CONFIG_X86_INTEL_USERCOPY */
20609
20610 /* Generic arbitrary sized copy. */
20611-#define __copy_user(to, from, size) \
20612+#define __copy_user(to, from, size, prefix, set, restore) \
20613 do { \
20614 int __d0, __d1, __d2; \
20615 __asm__ __volatile__( \
20616+ set \
20617 " cmp $7,%0\n" \
20618 " jbe 1f\n" \
20619 " movl %1,%0\n" \
20620 " negl %0\n" \
20621 " andl $7,%0\n" \
20622 " subl %0,%3\n" \
20623- "4: rep; movsb\n" \
20624+ "4: rep; "prefix"movsb\n" \
20625 " movl %3,%0\n" \
20626 " shrl $2,%0\n" \
20627 " andl $3,%3\n" \
20628 " .align 2,0x90\n" \
20629- "0: rep; movsl\n" \
20630+ "0: rep; "prefix"movsl\n" \
20631 " movl %3,%0\n" \
20632- "1: rep; movsb\n" \
20633+ "1: rep; "prefix"movsb\n" \
20634 "2:\n" \
20635+ restore \
20636 ".section .fixup,\"ax\"\n" \
20637 "5: addl %3,%0\n" \
20638 " jmp 2b\n" \
20639@@ -682,14 +799,14 @@ do { \
20640 " negl %0\n" \
20641 " andl $7,%0\n" \
20642 " subl %0,%3\n" \
20643- "4: rep; movsb\n" \
20644+ "4: rep; "__copyuser_seg"movsb\n" \
20645 " movl %3,%0\n" \
20646 " shrl $2,%0\n" \
20647 " andl $3,%3\n" \
20648 " .align 2,0x90\n" \
20649- "0: rep; movsl\n" \
20650+ "0: rep; "__copyuser_seg"movsl\n" \
20651 " movl %3,%0\n" \
20652- "1: rep; movsb\n" \
20653+ "1: rep; "__copyuser_seg"movsb\n" \
20654 "2:\n" \
20655 ".section .fixup,\"ax\"\n" \
20656 "5: addl %3,%0\n" \
20657@@ -775,9 +892,9 @@ survive:
20658 }
20659 #endif
20660 if (movsl_is_ok(to, from, n))
20661- __copy_user(to, from, n);
20662+ __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
20663 else
20664- n = __copy_user_intel(to, from, n);
20665+ n = __generic_copy_to_user_intel(to, from, n);
20666 return n;
20667 }
20668 EXPORT_SYMBOL(__copy_to_user_ll);
20669@@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero
20670 unsigned long n)
20671 {
20672 if (movsl_is_ok(to, from, n))
20673- __copy_user(to, from, n);
20674+ __copy_user(to, from, n, __copyuser_seg, "", "");
20675 else
20676- n = __copy_user_intel((void __user *)to,
20677- (const void *)from, n);
20678+ n = __generic_copy_from_user_intel(to, from, n);
20679 return n;
20680 }
20681 EXPORT_SYMBOL(__copy_from_user_ll_nozero);
20682@@ -827,65 +943,50 @@ unsigned long __copy_from_user_ll_nocach
20683 if (n > 64 && cpu_has_xmm2)
20684 n = __copy_user_intel_nocache(to, from, n);
20685 else
20686- __copy_user(to, from, n);
20687+ __copy_user(to, from, n, __copyuser_seg, "", "");
20688 #else
20689- __copy_user(to, from, n);
20690+ __copy_user(to, from, n, __copyuser_seg, "", "");
20691 #endif
20692 return n;
20693 }
20694 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
20695
20696-/**
20697- * copy_to_user: - Copy a block of data into user space.
20698- * @to: Destination address, in user space.
20699- * @from: Source address, in kernel space.
20700- * @n: Number of bytes to copy.
20701- *
20702- * Context: User context only. This function may sleep.
20703- *
20704- * Copy data from kernel space to user space.
20705- *
20706- * Returns number of bytes that could not be copied.
20707- * On success, this will be zero.
20708- */
20709-unsigned long
20710-copy_to_user(void __user *to, const void *from, unsigned long n)
20711+void copy_from_user_overflow(void)
20712 {
20713- if (access_ok(VERIFY_WRITE, to, n))
20714- n = __copy_to_user(to, from, n);
20715- return n;
20716+ WARN(1, "Buffer overflow detected!\n");
20717 }
20718-EXPORT_SYMBOL(copy_to_user);
20719+EXPORT_SYMBOL(copy_from_user_overflow);
20720
20721-/**
20722- * copy_from_user: - Copy a block of data from user space.
20723- * @to: Destination address, in kernel space.
20724- * @from: Source address, in user space.
20725- * @n: Number of bytes to copy.
20726- *
20727- * Context: User context only. This function may sleep.
20728- *
20729- * Copy data from user space to kernel space.
20730- *
20731- * Returns number of bytes that could not be copied.
20732- * On success, this will be zero.
20733- *
20734- * If some data could not be copied, this function will pad the copied
20735- * data to the requested size using zero bytes.
20736- */
20737-unsigned long
20738-_copy_from_user(void *to, const void __user *from, unsigned long n)
20739+void copy_to_user_overflow(void)
20740 {
20741- if (access_ok(VERIFY_READ, from, n))
20742- n = __copy_from_user(to, from, n);
20743- else
20744- memset(to, 0, n);
20745- return n;
20746+ WARN(1, "Buffer overflow detected!\n");
20747 }
20748-EXPORT_SYMBOL(_copy_from_user);
20749+EXPORT_SYMBOL(copy_to_user_overflow);
20750
20751-void copy_from_user_overflow(void)
20752+#ifdef CONFIG_PAX_MEMORY_UDEREF
20753+void __set_fs(mm_segment_t x)
20754 {
20755- WARN(1, "Buffer overflow detected!\n");
20756+ switch (x.seg) {
20757+ case 0:
20758+ loadsegment(gs, 0);
20759+ break;
20760+ case TASK_SIZE_MAX:
20761+ loadsegment(gs, __USER_DS);
20762+ break;
20763+ case -1UL:
20764+ loadsegment(gs, __KERNEL_DS);
20765+ break;
20766+ default:
20767+ BUG();
20768+ }
20769+ return;
20770 }
20771-EXPORT_SYMBOL(copy_from_user_overflow);
20772+EXPORT_SYMBOL(__set_fs);
20773+
20774+void set_fs(mm_segment_t x)
20775+{
20776+ current_thread_info()->addr_limit = x;
20777+ __set_fs(x);
20778+}
20779+EXPORT_SYMBOL(set_fs);
20780+#endif
20781diff -urNp linux-2.6.39.1/arch/x86/lib/usercopy_64.c linux-2.6.39.1/arch/x86/lib/usercopy_64.c
20782--- linux-2.6.39.1/arch/x86/lib/usercopy_64.c 2011-05-19 00:06:34.000000000 -0400
20783+++ linux-2.6.39.1/arch/x86/lib/usercopy_64.c 2011-05-22 19:36:30.000000000 -0400
20784@@ -42,6 +42,12 @@ long
20785 __strncpy_from_user(char *dst, const char __user *src, long count)
20786 {
20787 long res;
20788+
20789+#ifdef CONFIG_PAX_MEMORY_UDEREF
20790+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
20791+ src += PAX_USER_SHADOW_BASE;
20792+#endif
20793+
20794 __do_strncpy_from_user(dst, src, count, res);
20795 return res;
20796 }
20797@@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *
20798 {
20799 long __d0;
20800 might_fault();
20801+
20802+#ifdef CONFIG_PAX_MEMORY_UDEREF
20803+ if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
20804+ addr += PAX_USER_SHADOW_BASE;
20805+#endif
20806+
20807 /* no memory constraint because it doesn't change any memory gcc knows
20808 about */
20809 asm volatile(
20810@@ -151,10 +163,18 @@ EXPORT_SYMBOL(strlen_user);
20811
20812 unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
20813 {
20814- if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
20815+ if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
20816+
20817+#ifdef CONFIG_PAX_MEMORY_UDEREF
20818+ if ((unsigned long)to < PAX_USER_SHADOW_BASE)
20819+ to += PAX_USER_SHADOW_BASE;
20820+ if ((unsigned long)from < PAX_USER_SHADOW_BASE)
20821+ from += PAX_USER_SHADOW_BASE;
20822+#endif
20823+
20824 return copy_user_generic((__force void *)to, (__force void *)from, len);
20825- }
20826- return len;
20827+ }
20828+ return len;
20829 }
20830 EXPORT_SYMBOL(copy_in_user);
20831
20832diff -urNp linux-2.6.39.1/arch/x86/Makefile linux-2.6.39.1/arch/x86/Makefile
20833--- linux-2.6.39.1/arch/x86/Makefile 2011-05-19 00:06:34.000000000 -0400
20834+++ linux-2.6.39.1/arch/x86/Makefile 2011-05-22 19:36:30.000000000 -0400
20835@@ -195,3 +195,12 @@ define archhelp
20836 echo ' FDARGS="..." arguments for the booted kernel'
20837 echo ' FDINITRD=file initrd for the booted kernel'
20838 endef
20839+
20840+define OLD_LD
20841+
20842+*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
20843+*** Please upgrade your binutils to 2.18 or newer
20844+endef
20845+
20846+archprepare:
20847+ $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
20848diff -urNp linux-2.6.39.1/arch/x86/mm/extable.c linux-2.6.39.1/arch/x86/mm/extable.c
20849--- linux-2.6.39.1/arch/x86/mm/extable.c 2011-05-19 00:06:34.000000000 -0400
20850+++ linux-2.6.39.1/arch/x86/mm/extable.c 2011-05-22 19:36:30.000000000 -0400
20851@@ -1,14 +1,71 @@
20852 #include <linux/module.h>
20853 #include <linux/spinlock.h>
20854+#include <linux/sort.h>
20855 #include <asm/uaccess.h>
20856+#include <asm/pgtable.h>
20857
20858+/*
20859+ * The exception table needs to be sorted so that the binary
20860+ * search that we use to find entries in it works properly.
20861+ * This is used both for the kernel exception table and for
20862+ * the exception tables of modules that get loaded.
20863+ */
20864+static int cmp_ex(const void *a, const void *b)
20865+{
20866+ const struct exception_table_entry *x = a, *y = b;
20867+
20868+ /* avoid overflow */
20869+ if (x->insn > y->insn)
20870+ return 1;
20871+ if (x->insn < y->insn)
20872+ return -1;
20873+ return 0;
20874+}
20875+
20876+static void swap_ex(void *a, void *b, int size)
20877+{
20878+ struct exception_table_entry t, *x = a, *y = b;
20879+
20880+ t = *x;
20881+
20882+ pax_open_kernel();
20883+ *x = *y;
20884+ *y = t;
20885+ pax_close_kernel();
20886+}
20887+
20888+void sort_extable(struct exception_table_entry *start,
20889+ struct exception_table_entry *finish)
20890+{
20891+ sort(start, finish - start, sizeof(struct exception_table_entry),
20892+ cmp_ex, swap_ex);
20893+}
20894+
20895+#ifdef CONFIG_MODULES
20896+/*
20897+ * If the exception table is sorted, any referring to the module init
20898+ * will be at the beginning or the end.
20899+ */
20900+void trim_init_extable(struct module *m)
20901+{
20902+ /*trim the beginning*/
20903+ while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
20904+ m->extable++;
20905+ m->num_exentries--;
20906+ }
20907+ /*trim the end*/
20908+ while (m->num_exentries &&
20909+ within_module_init(m->extable[m->num_exentries-1].insn, m))
20910+ m->num_exentries--;
20911+}
20912+#endif /* CONFIG_MODULES */
20913
20914 int fixup_exception(struct pt_regs *regs)
20915 {
20916 const struct exception_table_entry *fixup;
20917
20918 #ifdef CONFIG_PNPBIOS
20919- if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
20920+ if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
20921 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
20922 extern u32 pnp_bios_is_utter_crap;
20923 pnp_bios_is_utter_crap = 1;
20924diff -urNp linux-2.6.39.1/arch/x86/mm/fault.c linux-2.6.39.1/arch/x86/mm/fault.c
20925--- linux-2.6.39.1/arch/x86/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
20926+++ linux-2.6.39.1/arch/x86/mm/fault.c 2011-06-06 17:34:04.000000000 -0400
20927@@ -12,10 +12,18 @@
20928 #include <linux/mmiotrace.h> /* kmmio_handler, ... */
20929 #include <linux/perf_event.h> /* perf_sw_event */
20930 #include <linux/hugetlb.h> /* hstate_index_to_shift */
20931+#include <linux/unistd.h>
20932+#include <linux/compiler.h>
20933
20934 #include <asm/traps.h> /* dotraplinkage, ... */
20935 #include <asm/pgalloc.h> /* pgd_*(), ... */
20936 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
20937+#include <asm/vsyscall.h>
20938+#include <asm/tlbflush.h>
20939+
20940+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20941+#include <asm/stacktrace.h>
20942+#endif
20943
20944 /*
20945 * Page fault error code bits:
20946@@ -53,7 +61,7 @@ static inline int __kprobes notify_page_
20947 int ret = 0;
20948
20949 /* kprobe_running() needs smp_processor_id() */
20950- if (kprobes_built_in() && !user_mode_vm(regs)) {
20951+ if (kprobes_built_in() && !user_mode(regs)) {
20952 preempt_disable();
20953 if (kprobe_running() && kprobe_fault_handler(regs, 14))
20954 ret = 1;
20955@@ -114,7 +122,10 @@ check_prefetch_opcode(struct pt_regs *re
20956 return !instr_lo || (instr_lo>>1) == 1;
20957 case 0x00:
20958 /* Prefetch instruction is 0x0F0D or 0x0F18 */
20959- if (probe_kernel_address(instr, opcode))
20960+ if (user_mode(regs)) {
20961+ if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1))
20962+ return 0;
20963+ } else if (probe_kernel_address(instr, opcode))
20964 return 0;
20965
20966 *prefetch = (instr_lo == 0xF) &&
20967@@ -148,7 +159,10 @@ is_prefetch(struct pt_regs *regs, unsign
20968 while (instr < max_instr) {
20969 unsigned char opcode;
20970
20971- if (probe_kernel_address(instr, opcode))
20972+ if (user_mode(regs)) {
20973+ if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1))
20974+ break;
20975+ } else if (probe_kernel_address(instr, opcode))
20976 break;
20977
20978 instr++;
20979@@ -179,6 +193,30 @@ force_sig_info_fault(int si_signo, int s
20980 force_sig_info(si_signo, &info, tsk);
20981 }
20982
20983+#ifdef CONFIG_PAX_EMUTRAMP
20984+static int pax_handle_fetch_fault(struct pt_regs *regs);
20985+#endif
20986+
20987+#ifdef CONFIG_PAX_PAGEEXEC
20988+static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
20989+{
20990+ pgd_t *pgd;
20991+ pud_t *pud;
20992+ pmd_t *pmd;
20993+
20994+ pgd = pgd_offset(mm, address);
20995+ if (!pgd_present(*pgd))
20996+ return NULL;
20997+ pud = pud_offset(pgd, address);
20998+ if (!pud_present(*pud))
20999+ return NULL;
21000+ pmd = pmd_offset(pud, address);
21001+ if (!pmd_present(*pmd))
21002+ return NULL;
21003+ return pmd;
21004+}
21005+#endif
21006+
21007 DEFINE_SPINLOCK(pgd_lock);
21008 LIST_HEAD(pgd_list);
21009
21010@@ -229,10 +267,22 @@ void vmalloc_sync_all(void)
21011 for (address = VMALLOC_START & PMD_MASK;
21012 address >= TASK_SIZE && address < FIXADDR_TOP;
21013 address += PMD_SIZE) {
21014+
21015+#ifdef CONFIG_PAX_PER_CPU_PGD
21016+ unsigned long cpu;
21017+#else
21018 struct page *page;
21019+#endif
21020
21021 spin_lock(&pgd_lock);
21022+
21023+#ifdef CONFIG_PAX_PER_CPU_PGD
21024+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
21025+ pgd_t *pgd = get_cpu_pgd(cpu);
21026+ pmd_t *ret;
21027+#else
21028 list_for_each_entry(page, &pgd_list, lru) {
21029+ pgd_t *pgd = page_address(page);
21030 spinlock_t *pgt_lock;
21031 pmd_t *ret;
21032
21033@@ -240,8 +290,13 @@ void vmalloc_sync_all(void)
21034 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
21035
21036 spin_lock(pgt_lock);
21037- ret = vmalloc_sync_one(page_address(page), address);
21038+#endif
21039+
21040+ ret = vmalloc_sync_one(pgd, address);
21041+
21042+#ifndef CONFIG_PAX_PER_CPU_PGD
21043 spin_unlock(pgt_lock);
21044+#endif
21045
21046 if (!ret)
21047 break;
21048@@ -275,6 +330,11 @@ static noinline __kprobes int vmalloc_fa
21049 * an interrupt in the middle of a task switch..
21050 */
21051 pgd_paddr = read_cr3();
21052+
21053+#ifdef CONFIG_PAX_PER_CPU_PGD
21054+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
21055+#endif
21056+
21057 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
21058 if (!pmd_k)
21059 return -1;
21060@@ -370,7 +430,14 @@ static noinline __kprobes int vmalloc_fa
21061 * happen within a race in page table update. In the later
21062 * case just flush:
21063 */
21064+
21065+#ifdef CONFIG_PAX_PER_CPU_PGD
21066+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
21067+ pgd = pgd_offset_cpu(smp_processor_id(), address);
21068+#else
21069 pgd = pgd_offset(current->active_mm, address);
21070+#endif
21071+
21072 pgd_ref = pgd_offset_k(address);
21073 if (pgd_none(*pgd_ref))
21074 return -1;
21075@@ -532,7 +599,7 @@ static int is_errata93(struct pt_regs *r
21076 static int is_errata100(struct pt_regs *regs, unsigned long address)
21077 {
21078 #ifdef CONFIG_X86_64
21079- if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
21080+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
21081 return 1;
21082 #endif
21083 return 0;
21084@@ -559,7 +626,7 @@ static int is_f00f_bug(struct pt_regs *r
21085 }
21086
21087 static const char nx_warning[] = KERN_CRIT
21088-"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
21089+"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
21090
21091 static void
21092 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
21093@@ -568,15 +635,26 @@ show_fault_oops(struct pt_regs *regs, un
21094 if (!oops_may_print())
21095 return;
21096
21097- if (error_code & PF_INSTR) {
21098+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) {
21099 unsigned int level;
21100
21101 pte_t *pte = lookup_address(address, &level);
21102
21103 if (pte && pte_present(*pte) && !pte_exec(*pte))
21104- printk(nx_warning, current_uid());
21105+ printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
21106 }
21107
21108+#ifdef CONFIG_PAX_KERNEXEC
21109+ if (init_mm.start_code <= address && address < init_mm.end_code) {
21110+ if (current->signal->curr_ip)
21111+ printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21112+ &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
21113+ else
21114+ printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21115+ current->comm, task_pid_nr(current), current_uid(), current_euid());
21116+ }
21117+#endif
21118+
21119 printk(KERN_ALERT "BUG: unable to handle kernel ");
21120 if (address < PAGE_SIZE)
21121 printk(KERN_CONT "NULL pointer dereference");
21122@@ -701,6 +779,68 @@ __bad_area_nosemaphore(struct pt_regs *r
21123 unsigned long address, int si_code)
21124 {
21125 struct task_struct *tsk = current;
21126+ struct mm_struct *mm = tsk->mm;
21127+
21128+#ifdef CONFIG_X86_64
21129+ if (mm && (error_code & PF_INSTR) && mm->context.vdso) {
21130+ if (regs->ip == (unsigned long)vgettimeofday) {
21131+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
21132+ return;
21133+ } else if (regs->ip == (unsigned long)vtime) {
21134+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
21135+ return;
21136+ } else if (regs->ip == (unsigned long)vgetcpu) {
21137+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
21138+ return;
21139+ }
21140+ }
21141+#endif
21142+
21143+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21144+ if (mm && (error_code & PF_USER)) {
21145+ unsigned long ip = regs->ip;
21146+
21147+ if (v8086_mode(regs))
21148+ ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
21149+
21150+ /*
21151+ * It's possible to have interrupts off here:
21152+ */
21153+ local_irq_enable();
21154+
21155+#ifdef CONFIG_PAX_PAGEEXEC
21156+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
21157+ (((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && ip == address))) {
21158+
21159+#ifdef CONFIG_PAX_EMUTRAMP
21160+ switch (pax_handle_fetch_fault(regs)) {
21161+ case 2:
21162+ return;
21163+ }
21164+#endif
21165+
21166+ pax_report_fault(regs, (void *)ip, (void *)regs->sp);
21167+ do_group_exit(SIGKILL);
21168+ }
21169+#endif
21170+
21171+#ifdef CONFIG_PAX_SEGMEXEC
21172+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address)) {
21173+
21174+#ifdef CONFIG_PAX_EMUTRAMP
21175+ switch (pax_handle_fetch_fault(regs)) {
21176+ case 2:
21177+ return;
21178+ }
21179+#endif
21180+
21181+ pax_report_fault(regs, (void *)ip, (void *)regs->sp);
21182+ do_group_exit(SIGKILL);
21183+ }
21184+#endif
21185+
21186+ }
21187+#endif
21188
21189 /* User mode accesses just cause a SIGSEGV */
21190 if (error_code & PF_USER) {
21191@@ -855,6 +995,99 @@ static int spurious_fault_check(unsigned
21192 return 1;
21193 }
21194
21195+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21196+static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
21197+{
21198+ pte_t *pte;
21199+ pmd_t *pmd;
21200+ spinlock_t *ptl;
21201+ unsigned char pte_mask;
21202+
21203+ if ((__supported_pte_mask & _PAGE_NX) || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
21204+ !(mm->pax_flags & MF_PAX_PAGEEXEC))
21205+ return 0;
21206+
21207+ /* PaX: it's our fault, let's handle it if we can */
21208+
21209+ /* PaX: take a look at read faults before acquiring any locks */
21210+ if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
21211+ /* instruction fetch attempt from a protected page in user mode */
21212+ up_read(&mm->mmap_sem);
21213+
21214+#ifdef CONFIG_PAX_EMUTRAMP
21215+ switch (pax_handle_fetch_fault(regs)) {
21216+ case 2:
21217+ return 1;
21218+ }
21219+#endif
21220+
21221+ pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
21222+ do_group_exit(SIGKILL);
21223+ }
21224+
21225+ pmd = pax_get_pmd(mm, address);
21226+ if (unlikely(!pmd))
21227+ return 0;
21228+
21229+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
21230+ if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
21231+ pte_unmap_unlock(pte, ptl);
21232+ return 0;
21233+ }
21234+
21235+ if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
21236+ /* write attempt to a protected page in user mode */
21237+ pte_unmap_unlock(pte, ptl);
21238+ return 0;
21239+ }
21240+
21241+#ifdef CONFIG_SMP
21242+ if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
21243+#else
21244+ if (likely(address > get_limit(regs->cs)))
21245+#endif
21246+ {
21247+ set_pte(pte, pte_mkread(*pte));
21248+ __flush_tlb_one(address);
21249+ pte_unmap_unlock(pte, ptl);
21250+ up_read(&mm->mmap_sem);
21251+ return 1;
21252+ }
21253+
21254+ pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
21255+
21256+ /*
21257+ * PaX: fill DTLB with user rights and retry
21258+ */
21259+ __asm__ __volatile__ (
21260+ "orb %2,(%1)\n"
21261+#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
21262+/*
21263+ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
21264+ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
21265+ * page fault when examined during a TLB load attempt. this is true not only
21266+ * for PTEs holding a non-present entry but also present entries that will
21267+ * raise a page fault (such as those set up by PaX, or the copy-on-write
21268+ * mechanism). in effect it means that we do *not* need to flush the TLBs
21269+ * for our target pages since their PTEs are simply not in the TLBs at all.
21270+
21271+ * the best thing in omitting it is that we gain around 15-20% speed in the
21272+ * fast path of the page fault handler and can get rid of tracing since we
21273+ * can no longer flush unintended entries.
21274+ */
21275+ "invlpg (%0)\n"
21276+#endif
21277+ __copyuser_seg"testb $0,(%0)\n"
21278+ "xorb %3,(%1)\n"
21279+ :
21280+ : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
21281+ : "memory", "cc");
21282+ pte_unmap_unlock(pte, ptl);
21283+ up_read(&mm->mmap_sem);
21284+ return 1;
21285+}
21286+#endif
21287+
21288 /*
21289 * Handle a spurious fault caused by a stale TLB entry.
21290 *
21291@@ -927,6 +1160,9 @@ int show_unhandled_signals = 1;
21292 static inline int
21293 access_error(unsigned long error_code, struct vm_area_struct *vma)
21294 {
21295+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
21296+ return 1;
21297+
21298 if (error_code & PF_WRITE) {
21299 /* write, present and write, not present: */
21300 if (unlikely(!(vma->vm_flags & VM_WRITE)))
21301@@ -960,19 +1196,33 @@ do_page_fault(struct pt_regs *regs, unsi
21302 {
21303 struct vm_area_struct *vma;
21304 struct task_struct *tsk;
21305- unsigned long address;
21306 struct mm_struct *mm;
21307 int fault;
21308 int write = error_code & PF_WRITE;
21309 unsigned int flags = FAULT_FLAG_ALLOW_RETRY |
21310 (write ? FAULT_FLAG_WRITE : 0);
21311
21312+ /* Get the faulting address: */
21313+ unsigned long address = read_cr2();
21314+
21315+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21316+ if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
21317+ if (!search_exception_tables(regs->ip)) {
21318+ bad_area_nosemaphore(regs, error_code, address);
21319+ return;
21320+ }
21321+ if (address < PAX_USER_SHADOW_BASE) {
21322+ printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
21323+ printk(KERN_ERR "PAX: faulting IP: %pA\n", (void *)regs->ip);
21324+ show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
21325+ } else
21326+ address -= PAX_USER_SHADOW_BASE;
21327+ }
21328+#endif
21329+
21330 tsk = current;
21331 mm = tsk->mm;
21332
21333- /* Get the faulting address: */
21334- address = read_cr2();
21335-
21336 /*
21337 * Detect and handle instructions that would cause a page fault for
21338 * both a tracked kernel page and a userspace page.
21339@@ -1032,7 +1282,7 @@ do_page_fault(struct pt_regs *regs, unsi
21340 * User-mode registers count as a user access even for any
21341 * potential system fault or CPU buglet:
21342 */
21343- if (user_mode_vm(regs)) {
21344+ if (user_mode(regs)) {
21345 local_irq_enable();
21346 error_code |= PF_USER;
21347 } else {
21348@@ -1087,6 +1337,11 @@ retry:
21349 might_sleep();
21350 }
21351
21352+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21353+ if (pax_handle_pageexec_fault(regs, mm, address, error_code))
21354+ return;
21355+#endif
21356+
21357 vma = find_vma(mm, address);
21358 if (unlikely(!vma)) {
21359 bad_area(regs, error_code, address);
21360@@ -1098,18 +1353,24 @@ retry:
21361 bad_area(regs, error_code, address);
21362 return;
21363 }
21364- if (error_code & PF_USER) {
21365- /*
21366- * Accessing the stack below %sp is always a bug.
21367- * The large cushion allows instructions like enter
21368- * and pusha to work. ("enter $65535, $31" pushes
21369- * 32 pointers and then decrements %sp by 65535.)
21370- */
21371- if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
21372- bad_area(regs, error_code, address);
21373- return;
21374- }
21375+ /*
21376+ * Accessing the stack below %sp is always a bug.
21377+ * The large cushion allows instructions like enter
21378+ * and pusha to work. ("enter $65535, $31" pushes
21379+ * 32 pointers and then decrements %sp by 65535.)
21380+ */
21381+ if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
21382+ bad_area(regs, error_code, address);
21383+ return;
21384 }
21385+
21386+#ifdef CONFIG_PAX_SEGMEXEC
21387+ if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
21388+ bad_area(regs, error_code, address);
21389+ return;
21390+ }
21391+#endif
21392+
21393 if (unlikely(expand_stack(vma, address))) {
21394 bad_area(regs, error_code, address);
21395 return;
21396@@ -1164,3 +1425,199 @@ good_area:
21397
21398 up_read(&mm->mmap_sem);
21399 }
21400+
21401+#ifdef CONFIG_PAX_EMUTRAMP
21402+static int pax_handle_fetch_fault_32(struct pt_regs *regs)
21403+{
21404+ int err;
21405+
21406+ do { /* PaX: gcc trampoline emulation #1 */
21407+ unsigned char mov1, mov2;
21408+ unsigned short jmp;
21409+ unsigned int addr1, addr2;
21410+
21411+#ifdef CONFIG_X86_64
21412+ if ((regs->ip + 11) >> 32)
21413+ break;
21414+#endif
21415+
21416+ err = get_user(mov1, (unsigned char __user *)regs->ip);
21417+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21418+ err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
21419+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21420+ err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
21421+
21422+ if (err)
21423+ break;
21424+
21425+ if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
21426+ regs->cx = addr1;
21427+ regs->ax = addr2;
21428+ regs->ip = addr2;
21429+ return 2;
21430+ }
21431+ } while (0);
21432+
21433+ do { /* PaX: gcc trampoline emulation #2 */
21434+ unsigned char mov, jmp;
21435+ unsigned int addr1, addr2;
21436+
21437+#ifdef CONFIG_X86_64
21438+ if ((regs->ip + 9) >> 32)
21439+ break;
21440+#endif
21441+
21442+ err = get_user(mov, (unsigned char __user *)regs->ip);
21443+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21444+ err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
21445+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21446+
21447+ if (err)
21448+ break;
21449+
21450+ if (mov == 0xB9 && jmp == 0xE9) {
21451+ regs->cx = addr1;
21452+ regs->ip = (unsigned int)(regs->ip + addr2 + 10);
21453+ return 2;
21454+ }
21455+ } while (0);
21456+
21457+ return 1; /* PaX in action */
21458+}
21459+
21460+#ifdef CONFIG_X86_64
21461+static int pax_handle_fetch_fault_64(struct pt_regs *regs)
21462+{
21463+ int err;
21464+
21465+ do { /* PaX: gcc trampoline emulation #1 */
21466+ unsigned short mov1, mov2, jmp1;
21467+ unsigned char jmp2;
21468+ unsigned int addr1;
21469+ unsigned long addr2;
21470+
21471+ err = get_user(mov1, (unsigned short __user *)regs->ip);
21472+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
21473+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
21474+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
21475+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
21476+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
21477+
21478+ if (err)
21479+ break;
21480+
21481+ if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21482+ regs->r11 = addr1;
21483+ regs->r10 = addr2;
21484+ regs->ip = addr1;
21485+ return 2;
21486+ }
21487+ } while (0);
21488+
21489+ do { /* PaX: gcc trampoline emulation #2 */
21490+ unsigned short mov1, mov2, jmp1;
21491+ unsigned char jmp2;
21492+ unsigned long addr1, addr2;
21493+
21494+ err = get_user(mov1, (unsigned short __user *)regs->ip);
21495+ err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
21496+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
21497+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
21498+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
21499+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
21500+
21501+ if (err)
21502+ break;
21503+
21504+ if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21505+ regs->r11 = addr1;
21506+ regs->r10 = addr2;
21507+ regs->ip = addr1;
21508+ return 2;
21509+ }
21510+ } while (0);
21511+
21512+ return 1; /* PaX in action */
21513+}
21514+#endif
21515+
21516+/*
21517+ * PaX: decide what to do with offenders (regs->ip = fault address)
21518+ *
21519+ * returns 1 when task should be killed
21520+ * 2 when gcc trampoline was detected
21521+ */
21522+static int pax_handle_fetch_fault(struct pt_regs *regs)
21523+{
21524+ if (v8086_mode(regs))
21525+ return 1;
21526+
21527+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
21528+ return 1;
21529+
21530+#ifdef CONFIG_X86_32
21531+ return pax_handle_fetch_fault_32(regs);
21532+#else
21533+ if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
21534+ return pax_handle_fetch_fault_32(regs);
21535+ else
21536+ return pax_handle_fetch_fault_64(regs);
21537+#endif
21538+}
21539+#endif
21540+
21541+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21542+void pax_report_insns(void *pc, void *sp)
21543+{
21544+ long i;
21545+
21546+ printk(KERN_ERR "PAX: bytes at PC: ");
21547+ for (i = 0; i < 20; i++) {
21548+ unsigned char c;
21549+ if (get_user(c, (__force unsigned char __user *)pc+i))
21550+ printk(KERN_CONT "?? ");
21551+ else
21552+ printk(KERN_CONT "%02x ", c);
21553+ }
21554+ printk("\n");
21555+
21556+ printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
21557+ for (i = -1; i < 80 / (long)sizeof(long); i++) {
21558+ unsigned long c;
21559+ if (get_user(c, (__force unsigned long __user *)sp+i))
21560+#ifdef CONFIG_X86_32
21561+ printk(KERN_CONT "???????? ");
21562+#else
21563+ printk(KERN_CONT "???????????????? ");
21564+#endif
21565+ else
21566+ printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
21567+ }
21568+ printk("\n");
21569+}
21570+#endif
21571+
21572+/**
21573+ * probe_kernel_write(): safely attempt to write to a location
21574+ * @dst: address to write to
21575+ * @src: pointer to the data that shall be written
21576+ * @size: size of the data chunk
21577+ *
21578+ * Safely write to address @dst from the buffer at @src. If a kernel fault
21579+ * happens, handle that and return -EFAULT.
21580+ */
21581+long notrace probe_kernel_write(void *dst, const void *src, size_t size)
21582+{
21583+ long ret;
21584+ mm_segment_t old_fs = get_fs();
21585+
21586+ set_fs(KERNEL_DS);
21587+ pagefault_disable();
21588+ pax_open_kernel();
21589+ ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
21590+ pax_close_kernel();
21591+ pagefault_enable();
21592+ set_fs(old_fs);
21593+
21594+ return ret ? -EFAULT : 0;
21595+}
21596diff -urNp linux-2.6.39.1/arch/x86/mm/gup.c linux-2.6.39.1/arch/x86/mm/gup.c
21597--- linux-2.6.39.1/arch/x86/mm/gup.c 2011-05-19 00:06:34.000000000 -0400
21598+++ linux-2.6.39.1/arch/x86/mm/gup.c 2011-05-22 19:36:30.000000000 -0400
21599@@ -263,7 +263,7 @@ int __get_user_pages_fast(unsigned long
21600 addr = start;
21601 len = (unsigned long) nr_pages << PAGE_SHIFT;
21602 end = start + len;
21603- if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
21604+ if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
21605 (void __user *)start, len)))
21606 return 0;
21607
21608diff -urNp linux-2.6.39.1/arch/x86/mm/highmem_32.c linux-2.6.39.1/arch/x86/mm/highmem_32.c
21609--- linux-2.6.39.1/arch/x86/mm/highmem_32.c 2011-05-19 00:06:34.000000000 -0400
21610+++ linux-2.6.39.1/arch/x86/mm/highmem_32.c 2011-05-22 19:36:30.000000000 -0400
21611@@ -44,7 +44,10 @@ void *kmap_atomic_prot(struct page *page
21612 idx = type + KM_TYPE_NR*smp_processor_id();
21613 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
21614 BUG_ON(!pte_none(*(kmap_pte-idx)));
21615+
21616+ pax_open_kernel();
21617 set_pte(kmap_pte-idx, mk_pte(page, prot));
21618+ pax_close_kernel();
21619
21620 return (void *)vaddr;
21621 }
21622diff -urNp linux-2.6.39.1/arch/x86/mm/hugetlbpage.c linux-2.6.39.1/arch/x86/mm/hugetlbpage.c
21623--- linux-2.6.39.1/arch/x86/mm/hugetlbpage.c 2011-05-19 00:06:34.000000000 -0400
21624+++ linux-2.6.39.1/arch/x86/mm/hugetlbpage.c 2011-05-22 19:36:30.000000000 -0400
21625@@ -266,13 +266,20 @@ static unsigned long hugetlb_get_unmappe
21626 struct hstate *h = hstate_file(file);
21627 struct mm_struct *mm = current->mm;
21628 struct vm_area_struct *vma;
21629- unsigned long start_addr;
21630+ unsigned long start_addr, pax_task_size = TASK_SIZE;
21631+
21632+#ifdef CONFIG_PAX_SEGMEXEC
21633+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
21634+ pax_task_size = SEGMEXEC_TASK_SIZE;
21635+#endif
21636+
21637+ pax_task_size -= PAGE_SIZE;
21638
21639 if (len > mm->cached_hole_size) {
21640- start_addr = mm->free_area_cache;
21641+ start_addr = mm->free_area_cache;
21642 } else {
21643- start_addr = TASK_UNMAPPED_BASE;
21644- mm->cached_hole_size = 0;
21645+ start_addr = mm->mmap_base;
21646+ mm->cached_hole_size = 0;
21647 }
21648
21649 full_search:
21650@@ -280,26 +287,27 @@ full_search:
21651
21652 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
21653 /* At this point: (!vma || addr < vma->vm_end). */
21654- if (TASK_SIZE - len < addr) {
21655+ if (pax_task_size - len < addr) {
21656 /*
21657 * Start a new search - just in case we missed
21658 * some holes.
21659 */
21660- if (start_addr != TASK_UNMAPPED_BASE) {
21661- start_addr = TASK_UNMAPPED_BASE;
21662+ if (start_addr != mm->mmap_base) {
21663+ start_addr = mm->mmap_base;
21664 mm->cached_hole_size = 0;
21665 goto full_search;
21666 }
21667 return -ENOMEM;
21668 }
21669- if (!vma || addr + len <= vma->vm_start) {
21670- mm->free_area_cache = addr + len;
21671- return addr;
21672- }
21673+ if (check_heap_stack_gap(vma, addr, len))
21674+ break;
21675 if (addr + mm->cached_hole_size < vma->vm_start)
21676 mm->cached_hole_size = vma->vm_start - addr;
21677 addr = ALIGN(vma->vm_end, huge_page_size(h));
21678 }
21679+
21680+ mm->free_area_cache = addr + len;
21681+ return addr;
21682 }
21683
21684 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
21685@@ -308,10 +316,9 @@ static unsigned long hugetlb_get_unmappe
21686 {
21687 struct hstate *h = hstate_file(file);
21688 struct mm_struct *mm = current->mm;
21689- struct vm_area_struct *vma, *prev_vma;
21690- unsigned long base = mm->mmap_base, addr = addr0;
21691+ struct vm_area_struct *vma;
21692+ unsigned long base = mm->mmap_base, addr;
21693 unsigned long largest_hole = mm->cached_hole_size;
21694- int first_time = 1;
21695
21696 /* don't allow allocations above current base */
21697 if (mm->free_area_cache > base)
21698@@ -321,64 +328,63 @@ static unsigned long hugetlb_get_unmappe
21699 largest_hole = 0;
21700 mm->free_area_cache = base;
21701 }
21702-try_again:
21703+
21704 /* make sure it can fit in the remaining address space */
21705 if (mm->free_area_cache < len)
21706 goto fail;
21707
21708 /* either no address requested or can't fit in requested address hole */
21709- addr = (mm->free_area_cache - len) & huge_page_mask(h);
21710+ addr = (mm->free_area_cache - len);
21711 do {
21712+ addr &= huge_page_mask(h);
21713+ vma = find_vma(mm, addr);
21714 /*
21715 * Lookup failure means no vma is above this address,
21716 * i.e. return with success:
21717- */
21718- if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
21719- return addr;
21720-
21721- /*
21722 * new region fits between prev_vma->vm_end and
21723 * vma->vm_start, use it:
21724 */
21725- if (addr + len <= vma->vm_start &&
21726- (!prev_vma || (addr >= prev_vma->vm_end))) {
21727+ if (check_heap_stack_gap(vma, addr, len)) {
21728 /* remember the address as a hint for next time */
21729- mm->cached_hole_size = largest_hole;
21730- return (mm->free_area_cache = addr);
21731- } else {
21732- /* pull free_area_cache down to the first hole */
21733- if (mm->free_area_cache == vma->vm_end) {
21734- mm->free_area_cache = vma->vm_start;
21735- mm->cached_hole_size = largest_hole;
21736- }
21737+ mm->cached_hole_size = largest_hole;
21738+ return (mm->free_area_cache = addr);
21739+ }
21740+ /* pull free_area_cache down to the first hole */
21741+ if (mm->free_area_cache == vma->vm_end) {
21742+ mm->free_area_cache = vma->vm_start;
21743+ mm->cached_hole_size = largest_hole;
21744 }
21745
21746 /* remember the largest hole we saw so far */
21747 if (addr + largest_hole < vma->vm_start)
21748- largest_hole = vma->vm_start - addr;
21749+ largest_hole = vma->vm_start - addr;
21750
21751 /* try just below the current vma->vm_start */
21752- addr = (vma->vm_start - len) & huge_page_mask(h);
21753- } while (len <= vma->vm_start);
21754+ addr = skip_heap_stack_gap(vma, len);
21755+ } while (!IS_ERR_VALUE(addr));
21756
21757 fail:
21758 /*
21759- * if hint left us with no space for the requested
21760- * mapping then try again:
21761- */
21762- if (first_time) {
21763- mm->free_area_cache = base;
21764- largest_hole = 0;
21765- first_time = 0;
21766- goto try_again;
21767- }
21768- /*
21769 * A failed mmap() very likely causes application failure,
21770 * so fall back to the bottom-up function here. This scenario
21771 * can happen with large stack limits and large mmap()
21772 * allocations.
21773 */
21774- mm->free_area_cache = TASK_UNMAPPED_BASE;
21775+
21776+#ifdef CONFIG_PAX_SEGMEXEC
21777+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
21778+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
21779+ else
21780+#endif
21781+
21782+ mm->mmap_base = TASK_UNMAPPED_BASE;
21783+
21784+#ifdef CONFIG_PAX_RANDMMAP
21785+ if (mm->pax_flags & MF_PAX_RANDMMAP)
21786+ mm->mmap_base += mm->delta_mmap;
21787+#endif
21788+
21789+ mm->free_area_cache = mm->mmap_base;
21790 mm->cached_hole_size = ~0UL;
21791 addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
21792 len, pgoff, flags);
21793@@ -386,6 +392,7 @@ fail:
21794 /*
21795 * Restore the topdown base:
21796 */
21797+ mm->mmap_base = base;
21798 mm->free_area_cache = base;
21799 mm->cached_hole_size = ~0UL;
21800
21801@@ -399,10 +406,19 @@ hugetlb_get_unmapped_area(struct file *f
21802 struct hstate *h = hstate_file(file);
21803 struct mm_struct *mm = current->mm;
21804 struct vm_area_struct *vma;
21805+ unsigned long pax_task_size = TASK_SIZE;
21806
21807 if (len & ~huge_page_mask(h))
21808 return -EINVAL;
21809- if (len > TASK_SIZE)
21810+
21811+#ifdef CONFIG_PAX_SEGMEXEC
21812+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
21813+ pax_task_size = SEGMEXEC_TASK_SIZE;
21814+#endif
21815+
21816+ pax_task_size -= PAGE_SIZE;
21817+
21818+ if (len > pax_task_size)
21819 return -ENOMEM;
21820
21821 if (flags & MAP_FIXED) {
21822@@ -414,8 +430,7 @@ hugetlb_get_unmapped_area(struct file *f
21823 if (addr) {
21824 addr = ALIGN(addr, huge_page_size(h));
21825 vma = find_vma(mm, addr);
21826- if (TASK_SIZE - len >= addr &&
21827- (!vma || addr + len <= vma->vm_start))
21828+ if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
21829 return addr;
21830 }
21831 if (mm->get_unmapped_area == arch_get_unmapped_area)
21832diff -urNp linux-2.6.39.1/arch/x86/mm/init_32.c linux-2.6.39.1/arch/x86/mm/init_32.c
21833--- linux-2.6.39.1/arch/x86/mm/init_32.c 2011-05-19 00:06:34.000000000 -0400
21834+++ linux-2.6.39.1/arch/x86/mm/init_32.c 2011-05-22 19:36:30.000000000 -0400
21835@@ -74,36 +74,6 @@ static __init void *alloc_low_page(void)
21836 }
21837
21838 /*
21839- * Creates a middle page table and puts a pointer to it in the
21840- * given global directory entry. This only returns the gd entry
21841- * in non-PAE compilation mode, since the middle layer is folded.
21842- */
21843-static pmd_t * __init one_md_table_init(pgd_t *pgd)
21844-{
21845- pud_t *pud;
21846- pmd_t *pmd_table;
21847-
21848-#ifdef CONFIG_X86_PAE
21849- if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
21850- if (after_bootmem)
21851- pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
21852- else
21853- pmd_table = (pmd_t *)alloc_low_page();
21854- paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
21855- set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
21856- pud = pud_offset(pgd, 0);
21857- BUG_ON(pmd_table != pmd_offset(pud, 0));
21858-
21859- return pmd_table;
21860- }
21861-#endif
21862- pud = pud_offset(pgd, 0);
21863- pmd_table = pmd_offset(pud, 0);
21864-
21865- return pmd_table;
21866-}
21867-
21868-/*
21869 * Create a page table and place a pointer to it in a middle page
21870 * directory entry:
21871 */
21872@@ -123,13 +93,28 @@ static pte_t * __init one_page_table_ini
21873 page_table = (pte_t *)alloc_low_page();
21874
21875 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
21876+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21877+ set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
21878+#else
21879 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
21880+#endif
21881 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
21882 }
21883
21884 return pte_offset_kernel(pmd, 0);
21885 }
21886
21887+static pmd_t * __init one_md_table_init(pgd_t *pgd)
21888+{
21889+ pud_t *pud;
21890+ pmd_t *pmd_table;
21891+
21892+ pud = pud_offset(pgd, 0);
21893+ pmd_table = pmd_offset(pud, 0);
21894+
21895+ return pmd_table;
21896+}
21897+
21898 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
21899 {
21900 int pgd_idx = pgd_index(vaddr);
21901@@ -203,6 +188,7 @@ page_table_range_init(unsigned long star
21902 int pgd_idx, pmd_idx;
21903 unsigned long vaddr;
21904 pgd_t *pgd;
21905+ pud_t *pud;
21906 pmd_t *pmd;
21907 pte_t *pte = NULL;
21908
21909@@ -212,8 +198,13 @@ page_table_range_init(unsigned long star
21910 pgd = pgd_base + pgd_idx;
21911
21912 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
21913- pmd = one_md_table_init(pgd);
21914- pmd = pmd + pmd_index(vaddr);
21915+ pud = pud_offset(pgd, vaddr);
21916+ pmd = pmd_offset(pud, vaddr);
21917+
21918+#ifdef CONFIG_X86_PAE
21919+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
21920+#endif
21921+
21922 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
21923 pmd++, pmd_idx++) {
21924 pte = page_table_kmap_check(one_page_table_init(pmd),
21925@@ -225,11 +216,20 @@ page_table_range_init(unsigned long star
21926 }
21927 }
21928
21929-static inline int is_kernel_text(unsigned long addr)
21930+static inline int is_kernel_text(unsigned long start, unsigned long end)
21931 {
21932- if (addr >= (unsigned long)_text && addr <= (unsigned long)__init_end)
21933- return 1;
21934- return 0;
21935+ if ((start > ktla_ktva((unsigned long)_etext) ||
21936+ end <= ktla_ktva((unsigned long)_stext)) &&
21937+ (start > ktla_ktva((unsigned long)_einittext) ||
21938+ end <= ktla_ktva((unsigned long)_sinittext)) &&
21939+
21940+#ifdef CONFIG_ACPI_SLEEP
21941+ (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
21942+#endif
21943+
21944+ (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
21945+ return 0;
21946+ return 1;
21947 }
21948
21949 /*
21950@@ -246,9 +246,10 @@ kernel_physical_mapping_init(unsigned lo
21951 unsigned long last_map_addr = end;
21952 unsigned long start_pfn, end_pfn;
21953 pgd_t *pgd_base = swapper_pg_dir;
21954- int pgd_idx, pmd_idx, pte_ofs;
21955+ unsigned int pgd_idx, pmd_idx, pte_ofs;
21956 unsigned long pfn;
21957 pgd_t *pgd;
21958+ pud_t *pud;
21959 pmd_t *pmd;
21960 pte_t *pte;
21961 unsigned pages_2m, pages_4k;
21962@@ -281,8 +282,13 @@ repeat:
21963 pfn = start_pfn;
21964 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
21965 pgd = pgd_base + pgd_idx;
21966- for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
21967- pmd = one_md_table_init(pgd);
21968+ for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
21969+ pud = pud_offset(pgd, 0);
21970+ pmd = pmd_offset(pud, 0);
21971+
21972+#ifdef CONFIG_X86_PAE
21973+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
21974+#endif
21975
21976 if (pfn >= end_pfn)
21977 continue;
21978@@ -294,14 +300,13 @@ repeat:
21979 #endif
21980 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
21981 pmd++, pmd_idx++) {
21982- unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
21983+ unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
21984
21985 /*
21986 * Map with big pages if possible, otherwise
21987 * create normal page tables:
21988 */
21989 if (use_pse) {
21990- unsigned int addr2;
21991 pgprot_t prot = PAGE_KERNEL_LARGE;
21992 /*
21993 * first pass will use the same initial
21994@@ -311,11 +316,7 @@ repeat:
21995 __pgprot(PTE_IDENT_ATTR |
21996 _PAGE_PSE);
21997
21998- addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
21999- PAGE_OFFSET + PAGE_SIZE-1;
22000-
22001- if (is_kernel_text(addr) ||
22002- is_kernel_text(addr2))
22003+ if (is_kernel_text(address, address + PMD_SIZE))
22004 prot = PAGE_KERNEL_LARGE_EXEC;
22005
22006 pages_2m++;
22007@@ -332,7 +333,7 @@ repeat:
22008 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
22009 pte += pte_ofs;
22010 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
22011- pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
22012+ pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
22013 pgprot_t prot = PAGE_KERNEL;
22014 /*
22015 * first pass will use the same initial
22016@@ -340,7 +341,7 @@ repeat:
22017 */
22018 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
22019
22020- if (is_kernel_text(addr))
22021+ if (is_kernel_text(address, address + PAGE_SIZE))
22022 prot = PAGE_KERNEL_EXEC;
22023
22024 pages_4k++;
22025@@ -472,7 +473,7 @@ void __init native_pagetable_setup_start
22026
22027 pud = pud_offset(pgd, va);
22028 pmd = pmd_offset(pud, va);
22029- if (!pmd_present(*pmd))
22030+ if (!pmd_present(*pmd) || pmd_huge(*pmd))
22031 break;
22032
22033 pte = pte_offset_kernel(pmd, va);
22034@@ -524,12 +525,10 @@ void __init early_ioremap_page_table_ran
22035
22036 static void __init pagetable_init(void)
22037 {
22038- pgd_t *pgd_base = swapper_pg_dir;
22039-
22040- permanent_kmaps_init(pgd_base);
22041+ permanent_kmaps_init(swapper_pg_dir);
22042 }
22043
22044-pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22045+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22046 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22047
22048 /* user-defined highmem size */
22049@@ -754,6 +753,12 @@ void __init mem_init(void)
22050
22051 pci_iommu_alloc();
22052
22053+#ifdef CONFIG_PAX_PER_CPU_PGD
22054+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22055+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22056+ KERNEL_PGD_PTRS);
22057+#endif
22058+
22059 #ifdef CONFIG_FLATMEM
22060 BUG_ON(!mem_map);
22061 #endif
22062@@ -771,7 +776,7 @@ void __init mem_init(void)
22063 set_highmem_pages_init();
22064
22065 codesize = (unsigned long) &_etext - (unsigned long) &_text;
22066- datasize = (unsigned long) &_edata - (unsigned long) &_etext;
22067+ datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
22068 initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
22069
22070 printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
22071@@ -812,10 +817,10 @@ void __init mem_init(void)
22072 ((unsigned long)&__init_end -
22073 (unsigned long)&__init_begin) >> 10,
22074
22075- (unsigned long)&_etext, (unsigned long)&_edata,
22076- ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
22077+ (unsigned long)&_sdata, (unsigned long)&_edata,
22078+ ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
22079
22080- (unsigned long)&_text, (unsigned long)&_etext,
22081+ ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
22082 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
22083
22084 /*
22085@@ -893,6 +898,7 @@ void set_kernel_text_rw(void)
22086 if (!kernel_set_to_readonly)
22087 return;
22088
22089+ start = ktla_ktva(start);
22090 pr_debug("Set kernel text: %lx - %lx for read write\n",
22091 start, start+size);
22092
22093@@ -907,6 +913,7 @@ void set_kernel_text_ro(void)
22094 if (!kernel_set_to_readonly)
22095 return;
22096
22097+ start = ktla_ktva(start);
22098 pr_debug("Set kernel text: %lx - %lx for read only\n",
22099 start, start+size);
22100
22101@@ -935,6 +942,7 @@ void mark_rodata_ro(void)
22102 unsigned long start = PFN_ALIGN(_text);
22103 unsigned long size = PFN_ALIGN(_etext) - start;
22104
22105+ start = ktla_ktva(start);
22106 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
22107 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
22108 size >> 10);
22109diff -urNp linux-2.6.39.1/arch/x86/mm/init_64.c linux-2.6.39.1/arch/x86/mm/init_64.c
22110--- linux-2.6.39.1/arch/x86/mm/init_64.c 2011-05-19 00:06:34.000000000 -0400
22111+++ linux-2.6.39.1/arch/x86/mm/init_64.c 2011-05-22 19:36:30.000000000 -0400
22112@@ -74,7 +74,7 @@ early_param("gbpages", parse_direct_gbpa
22113 * around without checking the pgd every time.
22114 */
22115
22116-pteval_t __supported_pte_mask __read_mostly = ~_PAGE_IOMAP;
22117+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_IOMAP);
22118 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22119
22120 int force_personality32;
22121@@ -107,12 +107,22 @@ void sync_global_pgds(unsigned long star
22122
22123 for (address = start; address <= end; address += PGDIR_SIZE) {
22124 const pgd_t *pgd_ref = pgd_offset_k(address);
22125+
22126+#ifdef CONFIG_PAX_PER_CPU_PGD
22127+ unsigned long cpu;
22128+#else
22129 struct page *page;
22130+#endif
22131
22132 if (pgd_none(*pgd_ref))
22133 continue;
22134
22135 spin_lock(&pgd_lock);
22136+
22137+#ifdef CONFIG_PAX_PER_CPU_PGD
22138+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22139+ pgd_t *pgd = pgd_offset_cpu(cpu, address);
22140+#else
22141 list_for_each_entry(page, &pgd_list, lru) {
22142 pgd_t *pgd;
22143 spinlock_t *pgt_lock;
22144@@ -121,6 +131,7 @@ void sync_global_pgds(unsigned long star
22145 /* the pgt_lock only for Xen */
22146 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
22147 spin_lock(pgt_lock);
22148+#endif
22149
22150 if (pgd_none(*pgd))
22151 set_pgd(pgd, *pgd_ref);
22152@@ -128,7 +139,10 @@ void sync_global_pgds(unsigned long star
22153 BUG_ON(pgd_page_vaddr(*pgd)
22154 != pgd_page_vaddr(*pgd_ref));
22155
22156+#ifndef CONFIG_PAX_PER_CPU_PGD
22157 spin_unlock(pgt_lock);
22158+#endif
22159+
22160 }
22161 spin_unlock(&pgd_lock);
22162 }
22163@@ -202,7 +216,9 @@ void set_pte_vaddr_pud(pud_t *pud_page,
22164 pmd = fill_pmd(pud, vaddr);
22165 pte = fill_pte(pmd, vaddr);
22166
22167+ pax_open_kernel();
22168 set_pte(pte, new_pte);
22169+ pax_close_kernel();
22170
22171 /*
22172 * It's enough to flush this one mapping.
22173@@ -261,14 +277,12 @@ static void __init __init_extra_mapping(
22174 pgd = pgd_offset_k((unsigned long)__va(phys));
22175 if (pgd_none(*pgd)) {
22176 pud = (pud_t *) spp_getpage();
22177- set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
22178- _PAGE_USER));
22179+ set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
22180 }
22181 pud = pud_offset(pgd, (unsigned long)__va(phys));
22182 if (pud_none(*pud)) {
22183 pmd = (pmd_t *) spp_getpage();
22184- set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
22185- _PAGE_USER));
22186+ set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
22187 }
22188 pmd = pmd_offset(pud, phys);
22189 BUG_ON(!pmd_none(*pmd));
22190@@ -698,6 +712,12 @@ void __init mem_init(void)
22191
22192 pci_iommu_alloc();
22193
22194+#ifdef CONFIG_PAX_PER_CPU_PGD
22195+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22196+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22197+ KERNEL_PGD_PTRS);
22198+#endif
22199+
22200 /* clear_bss() already clear the empty_zero_page */
22201
22202 reservedpages = 0;
22203@@ -858,8 +878,8 @@ int kern_addr_valid(unsigned long addr)
22204 static struct vm_area_struct gate_vma = {
22205 .vm_start = VSYSCALL_START,
22206 .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
22207- .vm_page_prot = PAGE_READONLY_EXEC,
22208- .vm_flags = VM_READ | VM_EXEC
22209+ .vm_page_prot = PAGE_READONLY,
22210+ .vm_flags = VM_READ
22211 };
22212
22213 struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
22214@@ -893,7 +913,7 @@ int in_gate_area_no_mm(unsigned long add
22215
22216 const char *arch_vma_name(struct vm_area_struct *vma)
22217 {
22218- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
22219+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
22220 return "[vdso]";
22221 if (vma == &gate_vma)
22222 return "[vsyscall]";
22223diff -urNp linux-2.6.39.1/arch/x86/mm/init.c linux-2.6.39.1/arch/x86/mm/init.c
22224--- linux-2.6.39.1/arch/x86/mm/init.c 2011-05-19 00:06:34.000000000 -0400
22225+++ linux-2.6.39.1/arch/x86/mm/init.c 2011-05-23 19:01:08.000000000 -0400
22226@@ -33,7 +33,7 @@ int direct_gbpages
22227 static void __init find_early_table_space(unsigned long end, int use_pse,
22228 int use_gbpages)
22229 {
22230- unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
22231+ unsigned long puds, pmds, ptes, tables, start = 0x100000, good_end = end;
22232 phys_addr_t base;
22233
22234 puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
22235@@ -315,12 +315,25 @@ unsigned long __init_refok init_memory_m
22236 */
22237 int devmem_is_allowed(unsigned long pagenr)
22238 {
22239- if (pagenr <= 256)
22240+#ifndef CONFIG_GRKERNSEC_KMEM
22241+ if (!pagenr)
22242+ return 1;
22243+#ifdef CONFIG_VM86
22244+ if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
22245+ return 1;
22246+#endif
22247+#else
22248+ if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
22249+ return 0;
22250+#endif
22251+
22252+ if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
22253 return 1;
22254 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
22255 return 0;
22256 if (!page_is_ram(pagenr))
22257 return 1;
22258+
22259 return 0;
22260 }
22261
22262@@ -375,6 +388,86 @@ void free_init_pages(char *what, unsigne
22263
22264 void free_initmem(void)
22265 {
22266+
22267+#ifdef CONFIG_PAX_KERNEXEC
22268+#ifdef CONFIG_X86_32
22269+ /* PaX: limit KERNEL_CS to actual size */
22270+ unsigned long addr, limit;
22271+ struct desc_struct d;
22272+ int cpu;
22273+
22274+ limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
22275+ limit = (limit - 1UL) >> PAGE_SHIFT;
22276+
22277+ memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
22278+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
22279+ pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
22280+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
22281+ }
22282+
22283+ /* PaX: make KERNEL_CS read-only */
22284+ addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
22285+ if (!paravirt_enabled())
22286+ set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
22287+/*
22288+ for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
22289+ pgd = pgd_offset_k(addr);
22290+ pud = pud_offset(pgd, addr);
22291+ pmd = pmd_offset(pud, addr);
22292+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22293+ }
22294+*/
22295+#ifdef CONFIG_X86_PAE
22296+ set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
22297+/*
22298+ for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
22299+ pgd = pgd_offset_k(addr);
22300+ pud = pud_offset(pgd, addr);
22301+ pmd = pmd_offset(pud, addr);
22302+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22303+ }
22304+*/
22305+#endif
22306+
22307+#ifdef CONFIG_MODULES
22308+ set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
22309+#endif
22310+
22311+#else
22312+ pgd_t *pgd;
22313+ pud_t *pud;
22314+ pmd_t *pmd;
22315+ unsigned long addr, end;
22316+
22317+ /* PaX: make kernel code/rodata read-only, rest non-executable */
22318+ for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
22319+ pgd = pgd_offset_k(addr);
22320+ pud = pud_offset(pgd, addr);
22321+ pmd = pmd_offset(pud, addr);
22322+ if (!pmd_present(*pmd))
22323+ continue;
22324+ if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
22325+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22326+ else
22327+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22328+ }
22329+
22330+ addr = (unsigned long)__va(__pa(__START_KERNEL_map));
22331+ end = addr + KERNEL_IMAGE_SIZE;
22332+ for (; addr < end; addr += PMD_SIZE) {
22333+ pgd = pgd_offset_k(addr);
22334+ pud = pud_offset(pgd, addr);
22335+ pmd = pmd_offset(pud, addr);
22336+ if (!pmd_present(*pmd))
22337+ continue;
22338+ if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
22339+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22340+ }
22341+#endif
22342+
22343+ flush_tlb_all();
22344+#endif
22345+
22346 free_init_pages("unused kernel memory",
22347 (unsigned long)(&__init_begin),
22348 (unsigned long)(&__init_end));
22349diff -urNp linux-2.6.39.1/arch/x86/mm/iomap_32.c linux-2.6.39.1/arch/x86/mm/iomap_32.c
22350--- linux-2.6.39.1/arch/x86/mm/iomap_32.c 2011-05-19 00:06:34.000000000 -0400
22351+++ linux-2.6.39.1/arch/x86/mm/iomap_32.c 2011-05-22 19:36:30.000000000 -0400
22352@@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long
22353 type = kmap_atomic_idx_push();
22354 idx = type + KM_TYPE_NR * smp_processor_id();
22355 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
22356+
22357+ pax_open_kernel();
22358 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
22359+ pax_close_kernel();
22360+
22361 arch_flush_lazy_mmu_mode();
22362
22363 return (void *)vaddr;
22364diff -urNp linux-2.6.39.1/arch/x86/mm/ioremap.c linux-2.6.39.1/arch/x86/mm/ioremap.c
22365--- linux-2.6.39.1/arch/x86/mm/ioremap.c 2011-05-19 00:06:34.000000000 -0400
22366+++ linux-2.6.39.1/arch/x86/mm/ioremap.c 2011-05-22 19:36:30.000000000 -0400
22367@@ -104,7 +104,7 @@ static void __iomem *__ioremap_caller(re
22368 for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) {
22369 int is_ram = page_is_ram(pfn);
22370
22371- if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
22372+ if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
22373 return NULL;
22374 WARN_ON_ONCE(is_ram);
22375 }
22376@@ -344,7 +344,7 @@ static int __init early_ioremap_debug_se
22377 early_param("early_ioremap_debug", early_ioremap_debug_setup);
22378
22379 static __initdata int after_paging_init;
22380-static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
22381+static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
22382
22383 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
22384 {
22385@@ -381,8 +381,7 @@ void __init early_ioremap_init(void)
22386 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
22387
22388 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
22389- memset(bm_pte, 0, sizeof(bm_pte));
22390- pmd_populate_kernel(&init_mm, pmd, bm_pte);
22391+ pmd_populate_user(&init_mm, pmd, bm_pte);
22392
22393 /*
22394 * The boot-ioremap range spans multiple pmds, for which
22395diff -urNp linux-2.6.39.1/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.39.1/arch/x86/mm/kmemcheck/kmemcheck.c
22396--- linux-2.6.39.1/arch/x86/mm/kmemcheck/kmemcheck.c 2011-05-19 00:06:34.000000000 -0400
22397+++ linux-2.6.39.1/arch/x86/mm/kmemcheck/kmemcheck.c 2011-05-22 19:36:30.000000000 -0400
22398@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
22399 * memory (e.g. tracked pages)? For now, we need this to avoid
22400 * invoking kmemcheck for PnP BIOS calls.
22401 */
22402- if (regs->flags & X86_VM_MASK)
22403+ if (v8086_mode(regs))
22404 return false;
22405- if (regs->cs != __KERNEL_CS)
22406+ if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
22407 return false;
22408
22409 pte = kmemcheck_pte_lookup(address);
22410diff -urNp linux-2.6.39.1/arch/x86/mm/mmap.c linux-2.6.39.1/arch/x86/mm/mmap.c
22411--- linux-2.6.39.1/arch/x86/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
22412+++ linux-2.6.39.1/arch/x86/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
22413@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
22414 * Leave an at least ~128 MB hole with possible stack randomization.
22415 */
22416 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
22417-#define MAX_GAP (TASK_SIZE/6*5)
22418+#define MAX_GAP (pax_task_size/6*5)
22419
22420 /*
22421 * True on X86_32 or when emulating IA32 on X86_64
22422@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
22423 return rnd << PAGE_SHIFT;
22424 }
22425
22426-static unsigned long mmap_base(void)
22427+static unsigned long mmap_base(struct mm_struct *mm)
22428 {
22429 unsigned long gap = rlimit(RLIMIT_STACK);
22430+ unsigned long pax_task_size = TASK_SIZE;
22431+
22432+#ifdef CONFIG_PAX_SEGMEXEC
22433+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22434+ pax_task_size = SEGMEXEC_TASK_SIZE;
22435+#endif
22436
22437 if (gap < MIN_GAP)
22438 gap = MIN_GAP;
22439 else if (gap > MAX_GAP)
22440 gap = MAX_GAP;
22441
22442- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
22443+ return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
22444 }
22445
22446 /*
22447 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
22448 * does, but not when emulating X86_32
22449 */
22450-static unsigned long mmap_legacy_base(void)
22451+static unsigned long mmap_legacy_base(struct mm_struct *mm)
22452 {
22453- if (mmap_is_ia32())
22454+ if (mmap_is_ia32()) {
22455+
22456+#ifdef CONFIG_PAX_SEGMEXEC
22457+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22458+ return SEGMEXEC_TASK_UNMAPPED_BASE;
22459+ else
22460+#endif
22461+
22462 return TASK_UNMAPPED_BASE;
22463- else
22464+ } else
22465 return TASK_UNMAPPED_BASE + mmap_rnd();
22466 }
22467
22468@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
22469 void arch_pick_mmap_layout(struct mm_struct *mm)
22470 {
22471 if (mmap_is_legacy()) {
22472- mm->mmap_base = mmap_legacy_base();
22473+ mm->mmap_base = mmap_legacy_base(mm);
22474+
22475+#ifdef CONFIG_PAX_RANDMMAP
22476+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22477+ mm->mmap_base += mm->delta_mmap;
22478+#endif
22479+
22480 mm->get_unmapped_area = arch_get_unmapped_area;
22481 mm->unmap_area = arch_unmap_area;
22482 } else {
22483- mm->mmap_base = mmap_base();
22484+ mm->mmap_base = mmap_base(mm);
22485+
22486+#ifdef CONFIG_PAX_RANDMMAP
22487+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22488+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
22489+#endif
22490+
22491 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
22492 mm->unmap_area = arch_unmap_area_topdown;
22493 }
22494diff -urNp linux-2.6.39.1/arch/x86/mm/mmio-mod.c linux-2.6.39.1/arch/x86/mm/mmio-mod.c
22495--- linux-2.6.39.1/arch/x86/mm/mmio-mod.c 2011-05-19 00:06:34.000000000 -0400
22496+++ linux-2.6.39.1/arch/x86/mm/mmio-mod.c 2011-05-22 19:36:30.000000000 -0400
22497@@ -235,7 +235,7 @@ static void post(struct kmmio_probe *p,
22498 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
22499 void __iomem *addr)
22500 {
22501- static atomic_t next_id;
22502+ static atomic_unchecked_t next_id;
22503 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
22504 /* These are page-unaligned. */
22505 struct mmiotrace_map map = {
22506@@ -259,7 +259,7 @@ static void ioremap_trace_core(resource_
22507 .private = trace
22508 },
22509 .phys = offset,
22510- .id = atomic_inc_return(&next_id)
22511+ .id = atomic_inc_return_unchecked(&next_id)
22512 };
22513 map.map_id = trace->id;
22514
22515diff -urNp linux-2.6.39.1/arch/x86/mm/numa_32.c linux-2.6.39.1/arch/x86/mm/numa_32.c
22516--- linux-2.6.39.1/arch/x86/mm/numa_32.c 2011-05-19 00:06:34.000000000 -0400
22517+++ linux-2.6.39.1/arch/x86/mm/numa_32.c 2011-05-22 19:36:30.000000000 -0400
22518@@ -99,7 +99,6 @@ unsigned long node_memmap_size_bytes(int
22519 }
22520 #endif
22521
22522-extern unsigned long find_max_low_pfn(void);
22523 extern unsigned long highend_pfn, highstart_pfn;
22524
22525 #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
22526diff -urNp linux-2.6.39.1/arch/x86/mm/pageattr.c linux-2.6.39.1/arch/x86/mm/pageattr.c
22527--- linux-2.6.39.1/arch/x86/mm/pageattr.c 2011-05-19 00:06:34.000000000 -0400
22528+++ linux-2.6.39.1/arch/x86/mm/pageattr.c 2011-05-22 19:36:30.000000000 -0400
22529@@ -261,7 +261,7 @@ static inline pgprot_t static_protection
22530 */
22531 #ifdef CONFIG_PCI_BIOS
22532 if (pcibios_enabled && within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
22533- pgprot_val(forbidden) |= _PAGE_NX;
22534+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
22535 #endif
22536
22537 /*
22538@@ -269,9 +269,10 @@ static inline pgprot_t static_protection
22539 * Does not cover __inittext since that is gone later on. On
22540 * 64bit we do not enforce !NX on the low mapping
22541 */
22542- if (within(address, (unsigned long)_text, (unsigned long)_etext))
22543- pgprot_val(forbidden) |= _PAGE_NX;
22544+ if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
22545+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
22546
22547+#ifdef CONFIG_DEBUG_RODATA
22548 /*
22549 * The .rodata section needs to be read-only. Using the pfn
22550 * catches all aliases.
22551@@ -279,6 +280,7 @@ static inline pgprot_t static_protection
22552 if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
22553 __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
22554 pgprot_val(forbidden) |= _PAGE_RW;
22555+#endif
22556
22557 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
22558 /*
22559@@ -317,6 +319,13 @@ static inline pgprot_t static_protection
22560 }
22561 #endif
22562
22563+#ifdef CONFIG_PAX_KERNEXEC
22564+ if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
22565+ pgprot_val(forbidden) |= _PAGE_RW;
22566+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
22567+ }
22568+#endif
22569+
22570 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
22571
22572 return prot;
22573@@ -369,23 +378,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
22574 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
22575 {
22576 /* change init_mm */
22577+ pax_open_kernel();
22578 set_pte_atomic(kpte, pte);
22579+
22580 #ifdef CONFIG_X86_32
22581 if (!SHARED_KERNEL_PMD) {
22582+
22583+#ifdef CONFIG_PAX_PER_CPU_PGD
22584+ unsigned long cpu;
22585+#else
22586 struct page *page;
22587+#endif
22588
22589+#ifdef CONFIG_PAX_PER_CPU_PGD
22590+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22591+ pgd_t *pgd = get_cpu_pgd(cpu);
22592+#else
22593 list_for_each_entry(page, &pgd_list, lru) {
22594- pgd_t *pgd;
22595+ pgd_t *pgd = (pgd_t *)page_address(page);
22596+#endif
22597+
22598 pud_t *pud;
22599 pmd_t *pmd;
22600
22601- pgd = (pgd_t *)page_address(page) + pgd_index(address);
22602+ pgd += pgd_index(address);
22603 pud = pud_offset(pgd, address);
22604 pmd = pmd_offset(pud, address);
22605 set_pte_atomic((pte_t *)pmd, pte);
22606 }
22607 }
22608 #endif
22609+ pax_close_kernel();
22610 }
22611
22612 static int
22613diff -urNp linux-2.6.39.1/arch/x86/mm/pageattr-test.c linux-2.6.39.1/arch/x86/mm/pageattr-test.c
22614--- linux-2.6.39.1/arch/x86/mm/pageattr-test.c 2011-05-19 00:06:34.000000000 -0400
22615+++ linux-2.6.39.1/arch/x86/mm/pageattr-test.c 2011-05-22 19:36:30.000000000 -0400
22616@@ -36,7 +36,7 @@ enum {
22617
22618 static int pte_testbit(pte_t pte)
22619 {
22620- return pte_flags(pte) & _PAGE_UNUSED1;
22621+ return pte_flags(pte) & _PAGE_CPA_TEST;
22622 }
22623
22624 struct split_state {
22625diff -urNp linux-2.6.39.1/arch/x86/mm/pat.c linux-2.6.39.1/arch/x86/mm/pat.c
22626--- linux-2.6.39.1/arch/x86/mm/pat.c 2011-05-19 00:06:34.000000000 -0400
22627+++ linux-2.6.39.1/arch/x86/mm/pat.c 2011-05-22 19:36:30.000000000 -0400
22628@@ -361,7 +361,7 @@ int free_memtype(u64 start, u64 end)
22629
22630 if (!entry) {
22631 printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
22632- current->comm, current->pid, start, end);
22633+ current->comm, task_pid_nr(current), start, end);
22634 return -EINVAL;
22635 }
22636
22637@@ -492,8 +492,8 @@ static inline int range_is_allowed(unsig
22638 while (cursor < to) {
22639 if (!devmem_is_allowed(pfn)) {
22640 printk(KERN_INFO
22641- "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
22642- current->comm, from, to);
22643+ "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
22644+ current->comm, from, to, cursor);
22645 return 0;
22646 }
22647 cursor += PAGE_SIZE;
22648@@ -557,7 +557,7 @@ int kernel_map_sync_memtype(u64 base, un
22649 printk(KERN_INFO
22650 "%s:%d ioremap_change_attr failed %s "
22651 "for %Lx-%Lx\n",
22652- current->comm, current->pid,
22653+ current->comm, task_pid_nr(current),
22654 cattr_name(flags),
22655 base, (unsigned long long)(base + size));
22656 return -EINVAL;
22657@@ -593,7 +593,7 @@ static int reserve_pfn_range(u64 paddr,
22658 if (want_flags != flags) {
22659 printk(KERN_WARNING
22660 "%s:%d map pfn RAM range req %s for %Lx-%Lx, got %s\n",
22661- current->comm, current->pid,
22662+ current->comm, task_pid_nr(current),
22663 cattr_name(want_flags),
22664 (unsigned long long)paddr,
22665 (unsigned long long)(paddr + size),
22666@@ -615,7 +615,7 @@ static int reserve_pfn_range(u64 paddr,
22667 free_memtype(paddr, paddr + size);
22668 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
22669 " for %Lx-%Lx, got %s\n",
22670- current->comm, current->pid,
22671+ current->comm, task_pid_nr(current),
22672 cattr_name(want_flags),
22673 (unsigned long long)paddr,
22674 (unsigned long long)(paddr + size),
22675diff -urNp linux-2.6.39.1/arch/x86/mm/pgtable_32.c linux-2.6.39.1/arch/x86/mm/pgtable_32.c
22676--- linux-2.6.39.1/arch/x86/mm/pgtable_32.c 2011-05-19 00:06:34.000000000 -0400
22677+++ linux-2.6.39.1/arch/x86/mm/pgtable_32.c 2011-05-22 19:36:30.000000000 -0400
22678@@ -48,10 +48,13 @@ void set_pte_vaddr(unsigned long vaddr,
22679 return;
22680 }
22681 pte = pte_offset_kernel(pmd, vaddr);
22682+
22683+ pax_open_kernel();
22684 if (pte_val(pteval))
22685 set_pte_at(&init_mm, vaddr, pte, pteval);
22686 else
22687 pte_clear(&init_mm, vaddr, pte);
22688+ pax_close_kernel();
22689
22690 /*
22691 * It's enough to flush this one mapping.
22692diff -urNp linux-2.6.39.1/arch/x86/mm/pgtable.c linux-2.6.39.1/arch/x86/mm/pgtable.c
22693--- linux-2.6.39.1/arch/x86/mm/pgtable.c 2011-05-19 00:06:34.000000000 -0400
22694+++ linux-2.6.39.1/arch/x86/mm/pgtable.c 2011-05-22 19:36:30.000000000 -0400
22695@@ -84,10 +84,52 @@ static inline void pgd_list_del(pgd_t *p
22696 list_del(&page->lru);
22697 }
22698
22699-#define UNSHARED_PTRS_PER_PGD \
22700- (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
22701+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22702+pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
22703
22704+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
22705+{
22706+ while (count--)
22707+ *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
22708+}
22709+#endif
22710+
22711+#ifdef CONFIG_PAX_PER_CPU_PGD
22712+void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
22713+{
22714+ while (count--)
22715+
22716+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22717+ *dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
22718+#else
22719+ *dst++ = *src++;
22720+#endif
22721
22722+}
22723+#endif
22724+
22725+#ifdef CONFIG_X86_64
22726+#define pxd_t pud_t
22727+#define pyd_t pgd_t
22728+#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
22729+#define pxd_free(mm, pud) pud_free((mm), (pud))
22730+#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
22731+#define pyd_offset(mm ,address) pgd_offset((mm), (address))
22732+#define PYD_SIZE PGDIR_SIZE
22733+#else
22734+#define pxd_t pmd_t
22735+#define pyd_t pud_t
22736+#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
22737+#define pxd_free(mm, pud) pmd_free((mm), (pud))
22738+#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
22739+#define pyd_offset(mm ,address) pud_offset((mm), (address))
22740+#define PYD_SIZE PUD_SIZE
22741+#endif
22742+
22743+#ifdef CONFIG_PAX_PER_CPU_PGD
22744+static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {}
22745+static inline void pgd_dtor(pgd_t *pgd) {}
22746+#else
22747 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
22748 {
22749 BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm));
22750@@ -128,6 +170,7 @@ static void pgd_dtor(pgd_t *pgd)
22751 pgd_list_del(pgd);
22752 spin_unlock(&pgd_lock);
22753 }
22754+#endif
22755
22756 /*
22757 * List of all pgd's needed for non-PAE so it can invalidate entries
22758@@ -140,7 +183,7 @@ static void pgd_dtor(pgd_t *pgd)
22759 * -- wli
22760 */
22761
22762-#ifdef CONFIG_X86_PAE
22763+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
22764 /*
22765 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
22766 * updating the top-level pagetable entries to guarantee the
22767@@ -152,7 +195,7 @@ static void pgd_dtor(pgd_t *pgd)
22768 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
22769 * and initialize the kernel pmds here.
22770 */
22771-#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
22772+#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
22773
22774 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
22775 {
22776@@ -170,36 +213,38 @@ void pud_populate(struct mm_struct *mm,
22777 */
22778 flush_tlb_mm(mm);
22779 }
22780+#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
22781+#define PREALLOCATED_PXDS USER_PGD_PTRS
22782 #else /* !CONFIG_X86_PAE */
22783
22784 /* No need to prepopulate any pagetable entries in non-PAE modes. */
22785-#define PREALLOCATED_PMDS 0
22786+#define PREALLOCATED_PXDS 0
22787
22788 #endif /* CONFIG_X86_PAE */
22789
22790-static void free_pmds(pmd_t *pmds[])
22791+static void free_pxds(pxd_t *pxds[])
22792 {
22793 int i;
22794
22795- for(i = 0; i < PREALLOCATED_PMDS; i++)
22796- if (pmds[i])
22797- free_page((unsigned long)pmds[i]);
22798+ for(i = 0; i < PREALLOCATED_PXDS; i++)
22799+ if (pxds[i])
22800+ free_page((unsigned long)pxds[i]);
22801 }
22802
22803-static int preallocate_pmds(pmd_t *pmds[])
22804+static int preallocate_pxds(pxd_t *pxds[])
22805 {
22806 int i;
22807 bool failed = false;
22808
22809- for(i = 0; i < PREALLOCATED_PMDS; i++) {
22810- pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
22811- if (pmd == NULL)
22812+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
22813+ pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
22814+ if (pxd == NULL)
22815 failed = true;
22816- pmds[i] = pmd;
22817+ pxds[i] = pxd;
22818 }
22819
22820 if (failed) {
22821- free_pmds(pmds);
22822+ free_pxds(pxds);
22823 return -ENOMEM;
22824 }
22825
22826@@ -212,51 +257,55 @@ static int preallocate_pmds(pmd_t *pmds[
22827 * preallocate which never got a corresponding vma will need to be
22828 * freed manually.
22829 */
22830-static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
22831+static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
22832 {
22833 int i;
22834
22835- for(i = 0; i < PREALLOCATED_PMDS; i++) {
22836+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
22837 pgd_t pgd = pgdp[i];
22838
22839 if (pgd_val(pgd) != 0) {
22840- pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
22841+ pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
22842
22843- pgdp[i] = native_make_pgd(0);
22844+ set_pgd(pgdp + i, native_make_pgd(0));
22845
22846- paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
22847- pmd_free(mm, pmd);
22848+ paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
22849+ pxd_free(mm, pxd);
22850 }
22851 }
22852 }
22853
22854-static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
22855+static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
22856 {
22857- pud_t *pud;
22858+ pyd_t *pyd;
22859 unsigned long addr;
22860 int i;
22861
22862- if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
22863+ if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
22864 return;
22865
22866- pud = pud_offset(pgd, 0);
22867+#ifdef CONFIG_X86_64
22868+ pyd = pyd_offset(mm, 0L);
22869+#else
22870+ pyd = pyd_offset(pgd, 0L);
22871+#endif
22872
22873- for (addr = i = 0; i < PREALLOCATED_PMDS;
22874- i++, pud++, addr += PUD_SIZE) {
22875- pmd_t *pmd = pmds[i];
22876+ for (addr = i = 0; i < PREALLOCATED_PXDS;
22877+ i++, pyd++, addr += PYD_SIZE) {
22878+ pxd_t *pxd = pxds[i];
22879
22880 if (i >= KERNEL_PGD_BOUNDARY)
22881- memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
22882- sizeof(pmd_t) * PTRS_PER_PMD);
22883+ memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
22884+ sizeof(pxd_t) * PTRS_PER_PMD);
22885
22886- pud_populate(mm, pud, pmd);
22887+ pyd_populate(mm, pyd, pxd);
22888 }
22889 }
22890
22891 pgd_t *pgd_alloc(struct mm_struct *mm)
22892 {
22893 pgd_t *pgd;
22894- pmd_t *pmds[PREALLOCATED_PMDS];
22895+ pxd_t *pxds[PREALLOCATED_PXDS];
22896
22897 pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
22898
22899@@ -265,11 +314,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
22900
22901 mm->pgd = pgd;
22902
22903- if (preallocate_pmds(pmds) != 0)
22904+ if (preallocate_pxds(pxds) != 0)
22905 goto out_free_pgd;
22906
22907 if (paravirt_pgd_alloc(mm) != 0)
22908- goto out_free_pmds;
22909+ goto out_free_pxds;
22910
22911 /*
22912 * Make sure that pre-populating the pmds is atomic with
22913@@ -279,14 +328,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
22914 spin_lock(&pgd_lock);
22915
22916 pgd_ctor(mm, pgd);
22917- pgd_prepopulate_pmd(mm, pgd, pmds);
22918+ pgd_prepopulate_pxd(mm, pgd, pxds);
22919
22920 spin_unlock(&pgd_lock);
22921
22922 return pgd;
22923
22924-out_free_pmds:
22925- free_pmds(pmds);
22926+out_free_pxds:
22927+ free_pxds(pxds);
22928 out_free_pgd:
22929 free_page((unsigned long)pgd);
22930 out:
22931@@ -295,7 +344,7 @@ out:
22932
22933 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
22934 {
22935- pgd_mop_up_pmds(mm, pgd);
22936+ pgd_mop_up_pxds(mm, pgd);
22937 pgd_dtor(pgd);
22938 paravirt_pgd_free(mm, pgd);
22939 free_page((unsigned long)pgd);
22940diff -urNp linux-2.6.39.1/arch/x86/mm/setup_nx.c linux-2.6.39.1/arch/x86/mm/setup_nx.c
22941--- linux-2.6.39.1/arch/x86/mm/setup_nx.c 2011-05-19 00:06:34.000000000 -0400
22942+++ linux-2.6.39.1/arch/x86/mm/setup_nx.c 2011-05-22 19:36:30.000000000 -0400
22943@@ -5,8 +5,10 @@
22944 #include <asm/pgtable.h>
22945 #include <asm/proto.h>
22946
22947+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
22948 static int disable_nx __cpuinitdata;
22949
22950+#ifndef CONFIG_PAX_PAGEEXEC
22951 /*
22952 * noexec = on|off
22953 *
22954@@ -28,12 +30,17 @@ static int __init noexec_setup(char *str
22955 return 0;
22956 }
22957 early_param("noexec", noexec_setup);
22958+#endif
22959+
22960+#endif
22961
22962 void __cpuinit x86_configure_nx(void)
22963 {
22964+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
22965 if (cpu_has_nx && !disable_nx)
22966 __supported_pte_mask |= _PAGE_NX;
22967 else
22968+#endif
22969 __supported_pte_mask &= ~_PAGE_NX;
22970 }
22971
22972diff -urNp linux-2.6.39.1/arch/x86/mm/tlb.c linux-2.6.39.1/arch/x86/mm/tlb.c
22973--- linux-2.6.39.1/arch/x86/mm/tlb.c 2011-05-19 00:06:34.000000000 -0400
22974+++ linux-2.6.39.1/arch/x86/mm/tlb.c 2011-05-22 19:36:30.000000000 -0400
22975@@ -65,7 +65,11 @@ void leave_mm(int cpu)
22976 BUG();
22977 cpumask_clear_cpu(cpu,
22978 mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
22979+
22980+#ifndef CONFIG_PAX_PER_CPU_PGD
22981 load_cr3(swapper_pg_dir);
22982+#endif
22983+
22984 }
22985 EXPORT_SYMBOL_GPL(leave_mm);
22986
22987diff -urNp linux-2.6.39.1/arch/x86/oprofile/backtrace.c linux-2.6.39.1/arch/x86/oprofile/backtrace.c
22988--- linux-2.6.39.1/arch/x86/oprofile/backtrace.c 2011-05-19 00:06:34.000000000 -0400
22989+++ linux-2.6.39.1/arch/x86/oprofile/backtrace.c 2011-05-22 19:36:30.000000000 -0400
22990@@ -57,7 +57,7 @@ dump_user_backtrace_32(struct stack_fram
22991 struct stack_frame_ia32 *fp;
22992
22993 /* Also check accessibility of one struct frame_head beyond */
22994- if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
22995+ if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
22996 return NULL;
22997 if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
22998 return NULL;
22999@@ -123,7 +123,7 @@ x86_backtrace(struct pt_regs * const reg
23000 {
23001 struct stack_frame *head = (struct stack_frame *)frame_pointer(regs);
23002
23003- if (!user_mode_vm(regs)) {
23004+ if (!user_mode(regs)) {
23005 unsigned long stack = kernel_stack_pointer(regs);
23006 if (depth)
23007 dump_trace(NULL, regs, (unsigned long *)stack, 0,
23008diff -urNp linux-2.6.39.1/arch/x86/pci/ce4100.c linux-2.6.39.1/arch/x86/pci/ce4100.c
23009--- linux-2.6.39.1/arch/x86/pci/ce4100.c 2011-05-19 00:06:34.000000000 -0400
23010+++ linux-2.6.39.1/arch/x86/pci/ce4100.c 2011-05-22 19:36:30.000000000 -0400
23011@@ -302,7 +302,7 @@ static int ce4100_conf_write(unsigned in
23012 return pci_direct_conf1.write(seg, bus, devfn, reg, len, value);
23013 }
23014
23015-struct pci_raw_ops ce4100_pci_conf = {
23016+const struct pci_raw_ops ce4100_pci_conf = {
23017 .read = ce4100_conf_read,
23018 .write = ce4100_conf_write,
23019 };
23020diff -urNp linux-2.6.39.1/arch/x86/pci/common.c linux-2.6.39.1/arch/x86/pci/common.c
23021--- linux-2.6.39.1/arch/x86/pci/common.c 2011-05-19 00:06:34.000000000 -0400
23022+++ linux-2.6.39.1/arch/x86/pci/common.c 2011-05-22 19:36:30.000000000 -0400
23023@@ -33,8 +33,8 @@ int noioapicreroute = 1;
23024 int pcibios_last_bus = -1;
23025 unsigned long pirq_table_addr;
23026 struct pci_bus *pci_root_bus;
23027-struct pci_raw_ops *raw_pci_ops;
23028-struct pci_raw_ops *raw_pci_ext_ops;
23029+const struct pci_raw_ops *raw_pci_ops;
23030+const struct pci_raw_ops *raw_pci_ext_ops;
23031
23032 int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
23033 int reg, int len, u32 *val)
23034diff -urNp linux-2.6.39.1/arch/x86/pci/direct.c linux-2.6.39.1/arch/x86/pci/direct.c
23035--- linux-2.6.39.1/arch/x86/pci/direct.c 2011-05-19 00:06:34.000000000 -0400
23036+++ linux-2.6.39.1/arch/x86/pci/direct.c 2011-05-22 19:36:30.000000000 -0400
23037@@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int
23038
23039 #undef PCI_CONF1_ADDRESS
23040
23041-struct pci_raw_ops pci_direct_conf1 = {
23042+const struct pci_raw_ops pci_direct_conf1 = {
23043 .read = pci_conf1_read,
23044 .write = pci_conf1_write,
23045 };
23046@@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int
23047
23048 #undef PCI_CONF2_ADDRESS
23049
23050-struct pci_raw_ops pci_direct_conf2 = {
23051+const struct pci_raw_ops pci_direct_conf2 = {
23052 .read = pci_conf2_read,
23053 .write = pci_conf2_write,
23054 };
23055@@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
23056 * This should be close to trivial, but it isn't, because there are buggy
23057 * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
23058 */
23059-static int __init pci_sanity_check(struct pci_raw_ops *o)
23060+static int __init pci_sanity_check(const struct pci_raw_ops *o)
23061 {
23062 u32 x = 0;
23063 int year, devfn;
23064diff -urNp linux-2.6.39.1/arch/x86/pci/fixup.c linux-2.6.39.1/arch/x86/pci/fixup.c
23065--- linux-2.6.39.1/arch/x86/pci/fixup.c 2011-05-19 00:06:34.000000000 -0400
23066+++ linux-2.6.39.1/arch/x86/pci/fixup.c 2011-05-22 19:36:30.000000000 -0400
23067@@ -435,7 +435,7 @@ static const struct dmi_system_id __devi
23068 DMI_MATCH(DMI_PRODUCT_VERSION, "PSA40U"),
23069 },
23070 },
23071- { }
23072+ {}
23073 };
23074
23075 static void __devinit pci_pre_fixup_toshiba_ohci1394(struct pci_dev *dev)
23076diff -urNp linux-2.6.39.1/arch/x86/pci/mmconfig_32.c linux-2.6.39.1/arch/x86/pci/mmconfig_32.c
23077--- linux-2.6.39.1/arch/x86/pci/mmconfig_32.c 2011-05-19 00:06:34.000000000 -0400
23078+++ linux-2.6.39.1/arch/x86/pci/mmconfig_32.c 2011-05-22 19:36:30.000000000 -0400
23079@@ -117,7 +117,7 @@ static int pci_mmcfg_write(unsigned int
23080 return 0;
23081 }
23082
23083-static struct pci_raw_ops pci_mmcfg = {
23084+static const struct pci_raw_ops pci_mmcfg = {
23085 .read = pci_mmcfg_read,
23086 .write = pci_mmcfg_write,
23087 };
23088diff -urNp linux-2.6.39.1/arch/x86/pci/mmconfig_64.c linux-2.6.39.1/arch/x86/pci/mmconfig_64.c
23089--- linux-2.6.39.1/arch/x86/pci/mmconfig_64.c 2011-05-19 00:06:34.000000000 -0400
23090+++ linux-2.6.39.1/arch/x86/pci/mmconfig_64.c 2011-05-22 19:36:30.000000000 -0400
23091@@ -81,7 +81,7 @@ static int pci_mmcfg_write(unsigned int
23092 return 0;
23093 }
23094
23095-static struct pci_raw_ops pci_mmcfg = {
23096+static const struct pci_raw_ops pci_mmcfg = {
23097 .read = pci_mmcfg_read,
23098 .write = pci_mmcfg_write,
23099 };
23100diff -urNp linux-2.6.39.1/arch/x86/pci/mrst.c linux-2.6.39.1/arch/x86/pci/mrst.c
23101--- linux-2.6.39.1/arch/x86/pci/mrst.c 2011-05-19 00:06:34.000000000 -0400
23102+++ linux-2.6.39.1/arch/x86/pci/mrst.c 2011-05-22 19:36:30.000000000 -0400
23103@@ -218,7 +218,7 @@ static int mrst_pci_irq_enable(struct pc
23104 return 0;
23105 }
23106
23107-struct pci_ops pci_mrst_ops = {
23108+const struct pci_ops pci_mrst_ops = {
23109 .read = pci_read,
23110 .write = pci_write,
23111 };
23112diff -urNp linux-2.6.39.1/arch/x86/pci/numaq_32.c linux-2.6.39.1/arch/x86/pci/numaq_32.c
23113--- linux-2.6.39.1/arch/x86/pci/numaq_32.c 2011-05-19 00:06:34.000000000 -0400
23114+++ linux-2.6.39.1/arch/x86/pci/numaq_32.c 2011-05-22 19:36:30.000000000 -0400
23115@@ -108,7 +108,7 @@ static int pci_conf1_mq_write(unsigned i
23116
23117 #undef PCI_CONF1_MQ_ADDRESS
23118
23119-static struct pci_raw_ops pci_direct_conf1_mq = {
23120+static const struct pci_raw_ops pci_direct_conf1_mq = {
23121 .read = pci_conf1_mq_read,
23122 .write = pci_conf1_mq_write
23123 };
23124diff -urNp linux-2.6.39.1/arch/x86/pci/olpc.c linux-2.6.39.1/arch/x86/pci/olpc.c
23125--- linux-2.6.39.1/arch/x86/pci/olpc.c 2011-05-19 00:06:34.000000000 -0400
23126+++ linux-2.6.39.1/arch/x86/pci/olpc.c 2011-05-22 19:36:30.000000000 -0400
23127@@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
23128 return 0;
23129 }
23130
23131-static struct pci_raw_ops pci_olpc_conf = {
23132+static const struct pci_raw_ops pci_olpc_conf = {
23133 .read = pci_olpc_read,
23134 .write = pci_olpc_write,
23135 };
23136diff -urNp linux-2.6.39.1/arch/x86/pci/pcbios.c linux-2.6.39.1/arch/x86/pci/pcbios.c
23137--- linux-2.6.39.1/arch/x86/pci/pcbios.c 2011-05-19 00:06:34.000000000 -0400
23138+++ linux-2.6.39.1/arch/x86/pci/pcbios.c 2011-05-22 19:36:30.000000000 -0400
23139@@ -79,50 +79,93 @@ union bios32 {
23140 static struct {
23141 unsigned long address;
23142 unsigned short segment;
23143-} bios32_indirect = { 0, __KERNEL_CS };
23144+} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
23145
23146 /*
23147 * Returns the entry point for the given service, NULL on error
23148 */
23149
23150-static unsigned long bios32_service(unsigned long service)
23151+static unsigned long __devinit bios32_service(unsigned long service)
23152 {
23153 unsigned char return_code; /* %al */
23154 unsigned long address; /* %ebx */
23155 unsigned long length; /* %ecx */
23156 unsigned long entry; /* %edx */
23157 unsigned long flags;
23158+ struct desc_struct d, *gdt;
23159
23160 local_irq_save(flags);
23161- __asm__("lcall *(%%edi); cld"
23162+
23163+ gdt = get_cpu_gdt_table(smp_processor_id());
23164+
23165+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
23166+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23167+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
23168+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23169+
23170+ __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
23171 : "=a" (return_code),
23172 "=b" (address),
23173 "=c" (length),
23174 "=d" (entry)
23175 : "0" (service),
23176 "1" (0),
23177- "D" (&bios32_indirect));
23178+ "D" (&bios32_indirect),
23179+ "r"(__PCIBIOS_DS)
23180+ : "memory");
23181+
23182+ pax_open_kernel();
23183+ gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
23184+ gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
23185+ gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
23186+ gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
23187+ pax_close_kernel();
23188+
23189 local_irq_restore(flags);
23190
23191 switch (return_code) {
23192- case 0:
23193- return address + entry;
23194- case 0x80: /* Not present */
23195- printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23196- return 0;
23197- default: /* Shouldn't happen */
23198- printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23199- service, return_code);
23200+ case 0: {
23201+ int cpu;
23202+ unsigned char flags;
23203+
23204+ printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
23205+ if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
23206+ printk(KERN_WARNING "bios32_service: not valid\n");
23207 return 0;
23208+ }
23209+ address = address + PAGE_OFFSET;
23210+ length += 16UL; /* some BIOSs underreport this... */
23211+ flags = 4;
23212+ if (length >= 64*1024*1024) {
23213+ length >>= PAGE_SHIFT;
23214+ flags |= 8;
23215+ }
23216+
23217+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
23218+ gdt = get_cpu_gdt_table(cpu);
23219+ pack_descriptor(&d, address, length, 0x9b, flags);
23220+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23221+ pack_descriptor(&d, address, length, 0x93, flags);
23222+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23223+ }
23224+ return entry;
23225+ }
23226+ case 0x80: /* Not present */
23227+ printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23228+ return 0;
23229+ default: /* Shouldn't happen */
23230+ printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23231+ service, return_code);
23232+ return 0;
23233 }
23234 }
23235
23236 static struct {
23237 unsigned long address;
23238 unsigned short segment;
23239-} pci_indirect = { 0, __KERNEL_CS };
23240+} pci_indirect __read_only = { 0, __PCIBIOS_CS };
23241
23242-static int pci_bios_present;
23243+static int pci_bios_present __read_only;
23244
23245 static int __devinit check_pcibios(void)
23246 {
23247@@ -131,11 +174,13 @@ static int __devinit check_pcibios(void)
23248 unsigned long flags, pcibios_entry;
23249
23250 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
23251- pci_indirect.address = pcibios_entry + PAGE_OFFSET;
23252+ pci_indirect.address = pcibios_entry;
23253
23254 local_irq_save(flags);
23255- __asm__(
23256- "lcall *(%%edi); cld\n\t"
23257+ __asm__("movw %w6, %%ds\n\t"
23258+ "lcall *%%ss:(%%edi); cld\n\t"
23259+ "push %%ss\n\t"
23260+ "pop %%ds\n\t"
23261 "jc 1f\n\t"
23262 "xor %%ah, %%ah\n"
23263 "1:"
23264@@ -144,7 +189,8 @@ static int __devinit check_pcibios(void)
23265 "=b" (ebx),
23266 "=c" (ecx)
23267 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
23268- "D" (&pci_indirect)
23269+ "D" (&pci_indirect),
23270+ "r" (__PCIBIOS_DS)
23271 : "memory");
23272 local_irq_restore(flags);
23273
23274@@ -188,7 +234,10 @@ static int pci_bios_read(unsigned int se
23275
23276 switch (len) {
23277 case 1:
23278- __asm__("lcall *(%%esi); cld\n\t"
23279+ __asm__("movw %w6, %%ds\n\t"
23280+ "lcall *%%ss:(%%esi); cld\n\t"
23281+ "push %%ss\n\t"
23282+ "pop %%ds\n\t"
23283 "jc 1f\n\t"
23284 "xor %%ah, %%ah\n"
23285 "1:"
23286@@ -197,7 +246,8 @@ static int pci_bios_read(unsigned int se
23287 : "1" (PCIBIOS_READ_CONFIG_BYTE),
23288 "b" (bx),
23289 "D" ((long)reg),
23290- "S" (&pci_indirect));
23291+ "S" (&pci_indirect),
23292+ "r" (__PCIBIOS_DS));
23293 /*
23294 * Zero-extend the result beyond 8 bits, do not trust the
23295 * BIOS having done it:
23296@@ -205,7 +255,10 @@ static int pci_bios_read(unsigned int se
23297 *value &= 0xff;
23298 break;
23299 case 2:
23300- __asm__("lcall *(%%esi); cld\n\t"
23301+ __asm__("movw %w6, %%ds\n\t"
23302+ "lcall *%%ss:(%%esi); cld\n\t"
23303+ "push %%ss\n\t"
23304+ "pop %%ds\n\t"
23305 "jc 1f\n\t"
23306 "xor %%ah, %%ah\n"
23307 "1:"
23308@@ -214,7 +267,8 @@ static int pci_bios_read(unsigned int se
23309 : "1" (PCIBIOS_READ_CONFIG_WORD),
23310 "b" (bx),
23311 "D" ((long)reg),
23312- "S" (&pci_indirect));
23313+ "S" (&pci_indirect),
23314+ "r" (__PCIBIOS_DS));
23315 /*
23316 * Zero-extend the result beyond 16 bits, do not trust the
23317 * BIOS having done it:
23318@@ -222,7 +276,10 @@ static int pci_bios_read(unsigned int se
23319 *value &= 0xffff;
23320 break;
23321 case 4:
23322- __asm__("lcall *(%%esi); cld\n\t"
23323+ __asm__("movw %w6, %%ds\n\t"
23324+ "lcall *%%ss:(%%esi); cld\n\t"
23325+ "push %%ss\n\t"
23326+ "pop %%ds\n\t"
23327 "jc 1f\n\t"
23328 "xor %%ah, %%ah\n"
23329 "1:"
23330@@ -231,7 +288,8 @@ static int pci_bios_read(unsigned int se
23331 : "1" (PCIBIOS_READ_CONFIG_DWORD),
23332 "b" (bx),
23333 "D" ((long)reg),
23334- "S" (&pci_indirect));
23335+ "S" (&pci_indirect),
23336+ "r" (__PCIBIOS_DS));
23337 break;
23338 }
23339
23340@@ -254,7 +312,10 @@ static int pci_bios_write(unsigned int s
23341
23342 switch (len) {
23343 case 1:
23344- __asm__("lcall *(%%esi); cld\n\t"
23345+ __asm__("movw %w6, %%ds\n\t"
23346+ "lcall *%%ss:(%%esi); cld\n\t"
23347+ "push %%ss\n\t"
23348+ "pop %%ds\n\t"
23349 "jc 1f\n\t"
23350 "xor %%ah, %%ah\n"
23351 "1:"
23352@@ -263,10 +324,14 @@ static int pci_bios_write(unsigned int s
23353 "c" (value),
23354 "b" (bx),
23355 "D" ((long)reg),
23356- "S" (&pci_indirect));
23357+ "S" (&pci_indirect),
23358+ "r" (__PCIBIOS_DS));
23359 break;
23360 case 2:
23361- __asm__("lcall *(%%esi); cld\n\t"
23362+ __asm__("movw %w6, %%ds\n\t"
23363+ "lcall *%%ss:(%%esi); cld\n\t"
23364+ "push %%ss\n\t"
23365+ "pop %%ds\n\t"
23366 "jc 1f\n\t"
23367 "xor %%ah, %%ah\n"
23368 "1:"
23369@@ -275,10 +340,14 @@ static int pci_bios_write(unsigned int s
23370 "c" (value),
23371 "b" (bx),
23372 "D" ((long)reg),
23373- "S" (&pci_indirect));
23374+ "S" (&pci_indirect),
23375+ "r" (__PCIBIOS_DS));
23376 break;
23377 case 4:
23378- __asm__("lcall *(%%esi); cld\n\t"
23379+ __asm__("movw %w6, %%ds\n\t"
23380+ "lcall *%%ss:(%%esi); cld\n\t"
23381+ "push %%ss\n\t"
23382+ "pop %%ds\n\t"
23383 "jc 1f\n\t"
23384 "xor %%ah, %%ah\n"
23385 "1:"
23386@@ -287,7 +356,8 @@ static int pci_bios_write(unsigned int s
23387 "c" (value),
23388 "b" (bx),
23389 "D" ((long)reg),
23390- "S" (&pci_indirect));
23391+ "S" (&pci_indirect),
23392+ "r" (__PCIBIOS_DS));
23393 break;
23394 }
23395
23396@@ -301,7 +371,7 @@ static int pci_bios_write(unsigned int s
23397 * Function table for BIOS32 access
23398 */
23399
23400-static struct pci_raw_ops pci_bios_access = {
23401+static const struct pci_raw_ops pci_bios_access = {
23402 .read = pci_bios_read,
23403 .write = pci_bios_write
23404 };
23405@@ -310,7 +380,7 @@ static struct pci_raw_ops pci_bios_acces
23406 * Try to find PCI BIOS.
23407 */
23408
23409-static struct pci_raw_ops * __devinit pci_find_bios(void)
23410+static const struct pci_raw_ops * __devinit pci_find_bios(void)
23411 {
23412 union bios32 *check;
23413 unsigned char sum;
23414@@ -392,10 +462,13 @@ struct irq_routing_table * pcibios_get_i
23415
23416 DBG("PCI: Fetching IRQ routing table... ");
23417 __asm__("push %%es\n\t"
23418+ "movw %w8, %%ds\n\t"
23419 "push %%ds\n\t"
23420 "pop %%es\n\t"
23421- "lcall *(%%esi); cld\n\t"
23422+ "lcall *%%ss:(%%esi); cld\n\t"
23423 "pop %%es\n\t"
23424+ "push %%ss\n\t"
23425+ "pop %%ds\n"
23426 "jc 1f\n\t"
23427 "xor %%ah, %%ah\n"
23428 "1:"
23429@@ -406,7 +479,8 @@ struct irq_routing_table * pcibios_get_i
23430 "1" (0),
23431 "D" ((long) &opt),
23432 "S" (&pci_indirect),
23433- "m" (opt)
23434+ "m" (opt),
23435+ "r" (__PCIBIOS_DS)
23436 : "memory");
23437 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
23438 if (ret & 0xff00)
23439@@ -430,7 +504,10 @@ int pcibios_set_irq_routing(struct pci_d
23440 {
23441 int ret;
23442
23443- __asm__("lcall *(%%esi); cld\n\t"
23444+ __asm__("movw %w5, %%ds\n\t"
23445+ "lcall *%%ss:(%%esi); cld\n\t"
23446+ "push %%ss\n\t"
23447+ "pop %%ds\n"
23448 "jc 1f\n\t"
23449 "xor %%ah, %%ah\n"
23450 "1:"
23451@@ -438,7 +515,8 @@ int pcibios_set_irq_routing(struct pci_d
23452 : "0" (PCIBIOS_SET_PCI_HW_INT),
23453 "b" ((dev->bus->number << 8) | dev->devfn),
23454 "c" ((irq << 8) | (pin + 10)),
23455- "S" (&pci_indirect));
23456+ "S" (&pci_indirect),
23457+ "r" (__PCIBIOS_DS));
23458 return !(ret & 0xff00);
23459 }
23460 EXPORT_SYMBOL(pcibios_set_irq_routing);
23461diff -urNp linux-2.6.39.1/arch/x86/pci/xen.c linux-2.6.39.1/arch/x86/pci/xen.c
23462--- linux-2.6.39.1/arch/x86/pci/xen.c 2011-05-19 00:06:34.000000000 -0400
23463+++ linux-2.6.39.1/arch/x86/pci/xen.c 2011-05-22 19:36:30.000000000 -0400
23464@@ -62,7 +62,7 @@ static int acpi_register_gsi_xen_hvm(str
23465 #include <linux/msi.h>
23466 #include <asm/msidef.h>
23467
23468-struct xen_pci_frontend_ops *xen_pci_frontend;
23469+const struct xen_pci_frontend_ops *xen_pci_frontend;
23470 EXPORT_SYMBOL_GPL(xen_pci_frontend);
23471
23472 #define XEN_PIRQ_MSI_DATA (MSI_DATA_TRIGGER_EDGE | \
23473diff -urNp linux-2.6.39.1/arch/x86/platform/efi/efi_32.c linux-2.6.39.1/arch/x86/platform/efi/efi_32.c
23474--- linux-2.6.39.1/arch/x86/platform/efi/efi_32.c 2011-05-19 00:06:34.000000000 -0400
23475+++ linux-2.6.39.1/arch/x86/platform/efi/efi_32.c 2011-05-22 19:36:30.000000000 -0400
23476@@ -38,70 +38,37 @@
23477 */
23478
23479 static unsigned long efi_rt_eflags;
23480-static pgd_t efi_bak_pg_dir_pointer[2];
23481+static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
23482
23483-void efi_call_phys_prelog(void)
23484+void __init efi_call_phys_prelog(void)
23485 {
23486- unsigned long cr4;
23487- unsigned long temp;
23488 struct desc_ptr gdt_descr;
23489
23490 local_irq_save(efi_rt_eflags);
23491
23492- /*
23493- * If I don't have PAE, I should just duplicate two entries in page
23494- * directory. If I have PAE, I just need to duplicate one entry in
23495- * page directory.
23496- */
23497- cr4 = read_cr4_safe();
23498-
23499- if (cr4 & X86_CR4_PAE) {
23500- efi_bak_pg_dir_pointer[0].pgd =
23501- swapper_pg_dir[pgd_index(0)].pgd;
23502- swapper_pg_dir[0].pgd =
23503- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
23504- } else {
23505- efi_bak_pg_dir_pointer[0].pgd =
23506- swapper_pg_dir[pgd_index(0)].pgd;
23507- efi_bak_pg_dir_pointer[1].pgd =
23508- swapper_pg_dir[pgd_index(0x400000)].pgd;
23509- swapper_pg_dir[pgd_index(0)].pgd =
23510- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
23511- temp = PAGE_OFFSET + 0x400000;
23512- swapper_pg_dir[pgd_index(0x400000)].pgd =
23513- swapper_pg_dir[pgd_index(temp)].pgd;
23514- }
23515+ clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
23516+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
23517+ min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
23518
23519 /*
23520 * After the lock is released, the original page table is restored.
23521 */
23522 __flush_tlb_all();
23523
23524- gdt_descr.address = __pa(get_cpu_gdt_table(0));
23525+ gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0));
23526 gdt_descr.size = GDT_SIZE - 1;
23527 load_gdt(&gdt_descr);
23528 }
23529
23530-void efi_call_phys_epilog(void)
23531+void __init efi_call_phys_epilog(void)
23532 {
23533- unsigned long cr4;
23534 struct desc_ptr gdt_descr;
23535
23536- gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
23537+ gdt_descr.address = get_cpu_gdt_table(0);
23538 gdt_descr.size = GDT_SIZE - 1;
23539 load_gdt(&gdt_descr);
23540
23541- cr4 = read_cr4_safe();
23542-
23543- if (cr4 & X86_CR4_PAE) {
23544- swapper_pg_dir[pgd_index(0)].pgd =
23545- efi_bak_pg_dir_pointer[0].pgd;
23546- } else {
23547- swapper_pg_dir[pgd_index(0)].pgd =
23548- efi_bak_pg_dir_pointer[0].pgd;
23549- swapper_pg_dir[pgd_index(0x400000)].pgd =
23550- efi_bak_pg_dir_pointer[1].pgd;
23551- }
23552+ clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
23553
23554 /*
23555 * After the lock is released, the original page table is restored.
23556diff -urNp linux-2.6.39.1/arch/x86/platform/efi/efi_stub_32.S linux-2.6.39.1/arch/x86/platform/efi/efi_stub_32.S
23557--- linux-2.6.39.1/arch/x86/platform/efi/efi_stub_32.S 2011-05-19 00:06:34.000000000 -0400
23558+++ linux-2.6.39.1/arch/x86/platform/efi/efi_stub_32.S 2011-05-22 19:36:30.000000000 -0400
23559@@ -6,6 +6,7 @@
23560 */
23561
23562 #include <linux/linkage.h>
23563+#include <linux/init.h>
23564 #include <asm/page_types.h>
23565
23566 /*
23567@@ -20,7 +21,7 @@
23568 * service functions will comply with gcc calling convention, too.
23569 */
23570
23571-.text
23572+__INIT
23573 ENTRY(efi_call_phys)
23574 /*
23575 * 0. The function can only be called in Linux kernel. So CS has been
23576@@ -36,9 +37,7 @@ ENTRY(efi_call_phys)
23577 * The mapping of lower virtual memory has been created in prelog and
23578 * epilog.
23579 */
23580- movl $1f, %edx
23581- subl $__PAGE_OFFSET, %edx
23582- jmp *%edx
23583+ jmp 1f-__PAGE_OFFSET
23584 1:
23585
23586 /*
23587@@ -47,14 +46,8 @@ ENTRY(efi_call_phys)
23588 * parameter 2, ..., param n. To make things easy, we save the return
23589 * address of efi_call_phys in a global variable.
23590 */
23591- popl %edx
23592- movl %edx, saved_return_addr
23593- /* get the function pointer into ECX*/
23594- popl %ecx
23595- movl %ecx, efi_rt_function_ptr
23596- movl $2f, %edx
23597- subl $__PAGE_OFFSET, %edx
23598- pushl %edx
23599+ popl (saved_return_addr)
23600+ popl (efi_rt_function_ptr)
23601
23602 /*
23603 * 3. Clear PG bit in %CR0.
23604@@ -73,9 +66,8 @@ ENTRY(efi_call_phys)
23605 /*
23606 * 5. Call the physical function.
23607 */
23608- jmp *%ecx
23609+ call *(efi_rt_function_ptr-__PAGE_OFFSET)
23610
23611-2:
23612 /*
23613 * 6. After EFI runtime service returns, control will return to
23614 * following instruction. We'd better readjust stack pointer first.
23615@@ -88,35 +80,28 @@ ENTRY(efi_call_phys)
23616 movl %cr0, %edx
23617 orl $0x80000000, %edx
23618 movl %edx, %cr0
23619- jmp 1f
23620-1:
23621+
23622 /*
23623 * 8. Now restore the virtual mode from flat mode by
23624 * adding EIP with PAGE_OFFSET.
23625 */
23626- movl $1f, %edx
23627- jmp *%edx
23628+ jmp 1f+__PAGE_OFFSET
23629 1:
23630
23631 /*
23632 * 9. Balance the stack. And because EAX contain the return value,
23633 * we'd better not clobber it.
23634 */
23635- leal efi_rt_function_ptr, %edx
23636- movl (%edx), %ecx
23637- pushl %ecx
23638+ pushl (efi_rt_function_ptr)
23639
23640 /*
23641- * 10. Push the saved return address onto the stack and return.
23642+ * 10. Return to the saved return address.
23643 */
23644- leal saved_return_addr, %edx
23645- movl (%edx), %ecx
23646- pushl %ecx
23647- ret
23648+ jmpl *(saved_return_addr)
23649 ENDPROC(efi_call_phys)
23650 .previous
23651
23652-.data
23653+__INITDATA
23654 saved_return_addr:
23655 .long 0
23656 efi_rt_function_ptr:
23657diff -urNp linux-2.6.39.1/arch/x86/platform/olpc/olpc_dt.c linux-2.6.39.1/arch/x86/platform/olpc/olpc_dt.c
23658--- linux-2.6.39.1/arch/x86/platform/olpc/olpc_dt.c 2011-05-19 00:06:34.000000000 -0400
23659+++ linux-2.6.39.1/arch/x86/platform/olpc/olpc_dt.c 2011-05-22 19:36:30.000000000 -0400
23660@@ -154,7 +154,7 @@ void * __init prom_early_alloc(unsigned
23661 return res;
23662 }
23663
23664-static struct of_pdt_ops prom_olpc_ops __initdata = {
23665+static const struct of_pdt_ops prom_olpc_ops = {
23666 .nextprop = olpc_dt_nextprop,
23667 .getproplen = olpc_dt_getproplen,
23668 .getproperty = olpc_dt_getproperty,
23669diff -urNp linux-2.6.39.1/arch/x86/platform/uv/tlb_uv.c linux-2.6.39.1/arch/x86/platform/uv/tlb_uv.c
23670--- linux-2.6.39.1/arch/x86/platform/uv/tlb_uv.c 2011-05-19 00:06:34.000000000 -0400
23671+++ linux-2.6.39.1/arch/x86/platform/uv/tlb_uv.c 2011-05-22 19:36:30.000000000 -0400
23672@@ -342,6 +342,8 @@ static void uv_reset_with_ipi(struct bau
23673 cpumask_t mask;
23674 struct reset_args reset_args;
23675
23676+ pax_track_stack();
23677+
23678 reset_args.sender = sender;
23679
23680 cpus_clear(mask);
23681diff -urNp linux-2.6.39.1/arch/x86/power/cpu.c linux-2.6.39.1/arch/x86/power/cpu.c
23682--- linux-2.6.39.1/arch/x86/power/cpu.c 2011-05-19 00:06:34.000000000 -0400
23683+++ linux-2.6.39.1/arch/x86/power/cpu.c 2011-05-22 19:36:30.000000000 -0400
23684@@ -130,7 +130,7 @@ static void do_fpu_end(void)
23685 static void fix_processor_context(void)
23686 {
23687 int cpu = smp_processor_id();
23688- struct tss_struct *t = &per_cpu(init_tss, cpu);
23689+ struct tss_struct *t = init_tss + cpu;
23690
23691 set_tss_desc(cpu, t); /*
23692 * This just modifies memory; should not be
23693@@ -140,7 +140,9 @@ static void fix_processor_context(void)
23694 */
23695
23696 #ifdef CONFIG_X86_64
23697+ pax_open_kernel();
23698 get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
23699+ pax_close_kernel();
23700
23701 syscall_init(); /* This sets MSR_*STAR and related */
23702 #endif
23703diff -urNp linux-2.6.39.1/arch/x86/vdso/Makefile linux-2.6.39.1/arch/x86/vdso/Makefile
23704--- linux-2.6.39.1/arch/x86/vdso/Makefile 2011-05-19 00:06:34.000000000 -0400
23705+++ linux-2.6.39.1/arch/x86/vdso/Makefile 2011-05-22 19:36:30.000000000 -0400
23706@@ -123,7 +123,7 @@ quiet_cmd_vdso = VDSO $@
23707 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
23708 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
23709
23710-VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
23711+VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
23712 GCOV_PROFILE := n
23713
23714 #
23715diff -urNp linux-2.6.39.1/arch/x86/vdso/vclock_gettime.c linux-2.6.39.1/arch/x86/vdso/vclock_gettime.c
23716--- linux-2.6.39.1/arch/x86/vdso/vclock_gettime.c 2011-05-19 00:06:34.000000000 -0400
23717+++ linux-2.6.39.1/arch/x86/vdso/vclock_gettime.c 2011-05-22 19:36:30.000000000 -0400
23718@@ -22,24 +22,48 @@
23719 #include <asm/hpet.h>
23720 #include <asm/unistd.h>
23721 #include <asm/io.h>
23722+#include <asm/fixmap.h>
23723 #include "vextern.h"
23724
23725 #define gtod vdso_vsyscall_gtod_data
23726
23727+notrace noinline long __vdso_fallback_time(long *t)
23728+{
23729+ long secs;
23730+ asm volatile("syscall"
23731+ : "=a" (secs)
23732+ : "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
23733+ return secs;
23734+}
23735+
23736 notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
23737 {
23738 long ret;
23739 asm("syscall" : "=a" (ret) :
23740- "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
23741+ "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
23742 return ret;
23743 }
23744
23745+notrace static inline cycle_t __vdso_vread_hpet(void)
23746+{
23747+ return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
23748+}
23749+
23750+notrace static inline cycle_t __vdso_vread_tsc(void)
23751+{
23752+ cycle_t ret = (cycle_t)vget_cycles();
23753+
23754+ return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
23755+}
23756+
23757 notrace static inline long vgetns(void)
23758 {
23759 long v;
23760- cycles_t (*vread)(void);
23761- vread = gtod->clock.vread;
23762- v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
23763+ if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
23764+ v = __vdso_vread_tsc();
23765+ else
23766+ v = __vdso_vread_hpet();
23767+ v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
23768 return (v * gtod->clock.mult) >> gtod->clock.shift;
23769 }
23770
23771@@ -113,7 +137,9 @@ notrace static noinline int do_monotonic
23772
23773 notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
23774 {
23775- if (likely(gtod->sysctl_enabled))
23776+ if (likely(gtod->sysctl_enabled &&
23777+ ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
23778+ (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
23779 switch (clock) {
23780 case CLOCK_REALTIME:
23781 if (likely(gtod->clock.vread))
23782@@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid
23783 int clock_gettime(clockid_t, struct timespec *)
23784 __attribute__((weak, alias("__vdso_clock_gettime")));
23785
23786-notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
23787+notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
23788 {
23789 long ret;
23790- if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
23791+ asm("syscall" : "=a" (ret) :
23792+ "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
23793+ return ret;
23794+}
23795+
23796+notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
23797+{
23798+ if (likely(gtod->sysctl_enabled &&
23799+ ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
23800+ (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
23801+ {
23802 if (likely(tv != NULL)) {
23803 BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
23804 offsetof(struct timespec, tv_nsec) ||
23805@@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct t
23806 }
23807 return 0;
23808 }
23809- asm("syscall" : "=a" (ret) :
23810- "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
23811- return ret;
23812+ return __vdso_fallback_gettimeofday(tv, tz);
23813 }
23814 int gettimeofday(struct timeval *, struct timezone *)
23815 __attribute__((weak, alias("__vdso_gettimeofday")));
23816diff -urNp linux-2.6.39.1/arch/x86/vdso/vdso32-setup.c linux-2.6.39.1/arch/x86/vdso/vdso32-setup.c
23817--- linux-2.6.39.1/arch/x86/vdso/vdso32-setup.c 2011-05-19 00:06:34.000000000 -0400
23818+++ linux-2.6.39.1/arch/x86/vdso/vdso32-setup.c 2011-05-22 19:36:30.000000000 -0400
23819@@ -25,6 +25,7 @@
23820 #include <asm/tlbflush.h>
23821 #include <asm/vdso.h>
23822 #include <asm/proto.h>
23823+#include <asm/mman.h>
23824
23825 enum {
23826 VDSO_DISABLED = 0,
23827@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
23828 void enable_sep_cpu(void)
23829 {
23830 int cpu = get_cpu();
23831- struct tss_struct *tss = &per_cpu(init_tss, cpu);
23832+ struct tss_struct *tss = init_tss + cpu;
23833
23834 if (!boot_cpu_has(X86_FEATURE_SEP)) {
23835 put_cpu();
23836@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
23837 gate_vma.vm_start = FIXADDR_USER_START;
23838 gate_vma.vm_end = FIXADDR_USER_END;
23839 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
23840- gate_vma.vm_page_prot = __P101;
23841+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
23842 /*
23843 * Make sure the vDSO gets into every core dump.
23844 * Dumping its contents makes post-mortem fully interpretable later
23845@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
23846 if (compat)
23847 addr = VDSO_HIGH_BASE;
23848 else {
23849- addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
23850+ addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
23851 if (IS_ERR_VALUE(addr)) {
23852 ret = addr;
23853 goto up_fail;
23854 }
23855 }
23856
23857- current->mm->context.vdso = (void *)addr;
23858+ current->mm->context.vdso = addr;
23859
23860 if (compat_uses_vma || !compat) {
23861 /*
23862@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
23863 }
23864
23865 current_thread_info()->sysenter_return =
23866- VDSO32_SYMBOL(addr, SYSENTER_RETURN);
23867+ (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
23868
23869 up_fail:
23870 if (ret)
23871- current->mm->context.vdso = NULL;
23872+ current->mm->context.vdso = 0;
23873
23874 up_write(&mm->mmap_sem);
23875
23876@@ -412,8 +413,14 @@ __initcall(ia32_binfmt_init);
23877
23878 const char *arch_vma_name(struct vm_area_struct *vma)
23879 {
23880- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
23881+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
23882 return "[vdso]";
23883+
23884+#ifdef CONFIG_PAX_SEGMEXEC
23885+ if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
23886+ return "[vdso]";
23887+#endif
23888+
23889 return NULL;
23890 }
23891
23892@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
23893 * Check to see if the corresponding task was created in compat vdso
23894 * mode.
23895 */
23896- if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
23897+ if (mm && mm->context.vdso == VDSO_HIGH_BASE)
23898 return &gate_vma;
23899 return NULL;
23900 }
23901diff -urNp linux-2.6.39.1/arch/x86/vdso/vdso.lds.S linux-2.6.39.1/arch/x86/vdso/vdso.lds.S
23902--- linux-2.6.39.1/arch/x86/vdso/vdso.lds.S 2011-05-19 00:06:34.000000000 -0400
23903+++ linux-2.6.39.1/arch/x86/vdso/vdso.lds.S 2011-06-06 17:34:26.000000000 -0400
23904@@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
23905 #define VEXTERN(x) VDSO64_ ## x = vdso_ ## x;
23906 #include "vextern.h"
23907 #undef VEXTERN
23908+
23909+#define VEXTERN(x) VDSO64_ ## x = __vdso_ ## x;
23910+VEXTERN(fallback_gettimeofday)
23911+VEXTERN(fallback_time)
23912+VEXTERN(getcpu)
23913+#undef VEXTERN
23914diff -urNp linux-2.6.39.1/arch/x86/vdso/vextern.h linux-2.6.39.1/arch/x86/vdso/vextern.h
23915--- linux-2.6.39.1/arch/x86/vdso/vextern.h 2011-05-19 00:06:34.000000000 -0400
23916+++ linux-2.6.39.1/arch/x86/vdso/vextern.h 2011-05-22 19:36:30.000000000 -0400
23917@@ -11,6 +11,5 @@
23918 put into vextern.h and be referenced as a pointer with vdso prefix.
23919 The main kernel later fills in the values. */
23920
23921-VEXTERN(jiffies)
23922 VEXTERN(vgetcpu_mode)
23923 VEXTERN(vsyscall_gtod_data)
23924diff -urNp linux-2.6.39.1/arch/x86/vdso/vma.c linux-2.6.39.1/arch/x86/vdso/vma.c
23925--- linux-2.6.39.1/arch/x86/vdso/vma.c 2011-05-19 00:06:34.000000000 -0400
23926+++ linux-2.6.39.1/arch/x86/vdso/vma.c 2011-05-22 19:36:30.000000000 -0400
23927@@ -58,7 +58,7 @@ static int __init init_vdso_vars(void)
23928 if (!vbase)
23929 goto oom;
23930
23931- if (memcmp(vbase, "\177ELF", 4)) {
23932+ if (memcmp(vbase, ELFMAG, SELFMAG)) {
23933 printk("VDSO: I'm broken; not ELF\n");
23934 vdso_enabled = 0;
23935 }
23936@@ -118,7 +118,7 @@ int arch_setup_additional_pages(struct l
23937 goto up_fail;
23938 }
23939
23940- current->mm->context.vdso = (void *)addr;
23941+ current->mm->context.vdso = addr;
23942
23943 ret = install_special_mapping(mm, addr, vdso_size,
23944 VM_READ|VM_EXEC|
23945@@ -126,7 +126,7 @@ int arch_setup_additional_pages(struct l
23946 VM_ALWAYSDUMP,
23947 vdso_pages);
23948 if (ret) {
23949- current->mm->context.vdso = NULL;
23950+ current->mm->context.vdso = 0;
23951 goto up_fail;
23952 }
23953
23954@@ -134,10 +134,3 @@ up_fail:
23955 up_write(&mm->mmap_sem);
23956 return ret;
23957 }
23958-
23959-static __init int vdso_setup(char *s)
23960-{
23961- vdso_enabled = simple_strtoul(s, NULL, 0);
23962- return 0;
23963-}
23964-__setup("vdso=", vdso_setup);
23965diff -urNp linux-2.6.39.1/arch/x86/xen/enlighten.c linux-2.6.39.1/arch/x86/xen/enlighten.c
23966--- linux-2.6.39.1/arch/x86/xen/enlighten.c 2011-05-19 00:06:34.000000000 -0400
23967+++ linux-2.6.39.1/arch/x86/xen/enlighten.c 2011-05-22 19:36:30.000000000 -0400
23968@@ -85,8 +85,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
23969
23970 struct shared_info xen_dummy_shared_info;
23971
23972-void *xen_initial_gdt;
23973-
23974 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
23975 __read_mostly int xen_have_vector_callback;
23976 EXPORT_SYMBOL_GPL(xen_have_vector_callback);
23977@@ -1010,7 +1008,7 @@ static const struct pv_apic_ops xen_apic
23978 #endif
23979 };
23980
23981-static void xen_reboot(int reason)
23982+static __noreturn void xen_reboot(int reason)
23983 {
23984 struct sched_shutdown r = { .reason = reason };
23985
23986@@ -1018,17 +1016,17 @@ static void xen_reboot(int reason)
23987 BUG();
23988 }
23989
23990-static void xen_restart(char *msg)
23991+static __noreturn void xen_restart(char *msg)
23992 {
23993 xen_reboot(SHUTDOWN_reboot);
23994 }
23995
23996-static void xen_emergency_restart(void)
23997+static __noreturn void xen_emergency_restart(void)
23998 {
23999 xen_reboot(SHUTDOWN_reboot);
24000 }
24001
24002-static void xen_machine_halt(void)
24003+static __noreturn void xen_machine_halt(void)
24004 {
24005 xen_reboot(SHUTDOWN_poweroff);
24006 }
24007@@ -1127,7 +1125,17 @@ asmlinkage void __init xen_start_kernel(
24008 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
24009
24010 /* Work out if we support NX */
24011- x86_configure_nx();
24012+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
24013+ if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
24014+ (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
24015+ unsigned l, h;
24016+
24017+ __supported_pte_mask |= _PAGE_NX;
24018+ rdmsr(MSR_EFER, l, h);
24019+ l |= EFER_NX;
24020+ wrmsr(MSR_EFER, l, h);
24021+ }
24022+#endif
24023
24024 xen_setup_features();
24025
24026@@ -1158,13 +1166,6 @@ asmlinkage void __init xen_start_kernel(
24027
24028 machine_ops = xen_machine_ops;
24029
24030- /*
24031- * The only reliable way to retain the initial address of the
24032- * percpu gdt_page is to remember it here, so we can go and
24033- * mark it RW later, when the initial percpu area is freed.
24034- */
24035- xen_initial_gdt = &per_cpu(gdt_page, 0);
24036-
24037 xen_smp_init();
24038
24039 #ifdef CONFIG_ACPI_NUMA
24040diff -urNp linux-2.6.39.1/arch/x86/xen/mmu.c linux-2.6.39.1/arch/x86/xen/mmu.c
24041--- linux-2.6.39.1/arch/x86/xen/mmu.c 2011-06-03 00:04:13.000000000 -0400
24042+++ linux-2.6.39.1/arch/x86/xen/mmu.c 2011-06-03 00:32:05.000000000 -0400
24043@@ -1791,6 +1791,8 @@ __init pgd_t *xen_setup_kernel_pagetable
24044 convert_pfn_mfn(init_level4_pgt);
24045 convert_pfn_mfn(level3_ident_pgt);
24046 convert_pfn_mfn(level3_kernel_pgt);
24047+ convert_pfn_mfn(level3_vmalloc_pgt);
24048+ convert_pfn_mfn(level3_vmemmap_pgt);
24049
24050 l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
24051 l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
24052@@ -1809,7 +1811,10 @@ __init pgd_t *xen_setup_kernel_pagetable
24053 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
24054 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
24055 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
24056+ set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
24057+ set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
24058 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
24059+ set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
24060 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
24061 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
24062
24063diff -urNp linux-2.6.39.1/arch/x86/xen/pci-swiotlb-xen.c linux-2.6.39.1/arch/x86/xen/pci-swiotlb-xen.c
24064--- linux-2.6.39.1/arch/x86/xen/pci-swiotlb-xen.c 2011-05-19 00:06:34.000000000 -0400
24065+++ linux-2.6.39.1/arch/x86/xen/pci-swiotlb-xen.c 2011-05-22 19:36:30.000000000 -0400
24066@@ -10,7 +10,7 @@
24067
24068 int xen_swiotlb __read_mostly;
24069
24070-static struct dma_map_ops xen_swiotlb_dma_ops = {
24071+static const struct dma_map_ops xen_swiotlb_dma_ops = {
24072 .mapping_error = xen_swiotlb_dma_mapping_error,
24073 .alloc_coherent = xen_swiotlb_alloc_coherent,
24074 .free_coherent = xen_swiotlb_free_coherent,
24075diff -urNp linux-2.6.39.1/arch/x86/xen/smp.c linux-2.6.39.1/arch/x86/xen/smp.c
24076--- linux-2.6.39.1/arch/x86/xen/smp.c 2011-05-19 00:06:34.000000000 -0400
24077+++ linux-2.6.39.1/arch/x86/xen/smp.c 2011-05-22 19:36:30.000000000 -0400
24078@@ -194,11 +194,6 @@ static void __init xen_smp_prepare_boot_
24079 {
24080 BUG_ON(smp_processor_id() != 0);
24081 native_smp_prepare_boot_cpu();
24082-
24083- /* We've switched to the "real" per-cpu gdt, so make sure the
24084- old memory can be recycled */
24085- make_lowmem_page_readwrite(xen_initial_gdt);
24086-
24087 xen_filter_cpu_maps();
24088 xen_setup_vcpu_info_placement();
24089 }
24090@@ -259,12 +254,12 @@ cpu_initialize_context(unsigned int cpu,
24091 gdt = get_cpu_gdt_table(cpu);
24092
24093 ctxt->flags = VGCF_IN_KERNEL;
24094- ctxt->user_regs.ds = __USER_DS;
24095- ctxt->user_regs.es = __USER_DS;
24096+ ctxt->user_regs.ds = __KERNEL_DS;
24097+ ctxt->user_regs.es = __KERNEL_DS;
24098 ctxt->user_regs.ss = __KERNEL_DS;
24099 #ifdef CONFIG_X86_32
24100 ctxt->user_regs.fs = __KERNEL_PERCPU;
24101- ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
24102+ savesegment(gs, ctxt->user_regs.gs);
24103 #else
24104 ctxt->gs_base_kernel = per_cpu_offset(cpu);
24105 #endif
24106@@ -315,13 +310,12 @@ static int __cpuinit xen_cpu_up(unsigned
24107 int rc;
24108
24109 per_cpu(current_task, cpu) = idle;
24110+ per_cpu(current_tinfo, cpu) = &idle->tinfo;
24111 #ifdef CONFIG_X86_32
24112 irq_ctx_init(cpu);
24113 #else
24114 clear_tsk_thread_flag(idle, TIF_FORK);
24115- per_cpu(kernel_stack, cpu) =
24116- (unsigned long)task_stack_page(idle) -
24117- KERNEL_STACK_OFFSET + THREAD_SIZE;
24118+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
24119 #endif
24120 xen_setup_runstate_info(cpu);
24121 xen_setup_timer(cpu);
24122diff -urNp linux-2.6.39.1/arch/x86/xen/xen-asm_32.S linux-2.6.39.1/arch/x86/xen/xen-asm_32.S
24123--- linux-2.6.39.1/arch/x86/xen/xen-asm_32.S 2011-05-19 00:06:34.000000000 -0400
24124+++ linux-2.6.39.1/arch/x86/xen/xen-asm_32.S 2011-05-22 19:36:30.000000000 -0400
24125@@ -83,14 +83,14 @@ ENTRY(xen_iret)
24126 ESP_OFFSET=4 # bytes pushed onto stack
24127
24128 /*
24129- * Store vcpu_info pointer for easy access. Do it this way to
24130- * avoid having to reload %fs
24131+ * Store vcpu_info pointer for easy access.
24132 */
24133 #ifdef CONFIG_SMP
24134- GET_THREAD_INFO(%eax)
24135- movl TI_cpu(%eax), %eax
24136- movl __per_cpu_offset(,%eax,4), %eax
24137- mov xen_vcpu(%eax), %eax
24138+ push %fs
24139+ mov $(__KERNEL_PERCPU), %eax
24140+ mov %eax, %fs
24141+ mov PER_CPU_VAR(xen_vcpu), %eax
24142+ pop %fs
24143 #else
24144 movl xen_vcpu, %eax
24145 #endif
24146diff -urNp linux-2.6.39.1/arch/x86/xen/xen-head.S linux-2.6.39.1/arch/x86/xen/xen-head.S
24147--- linux-2.6.39.1/arch/x86/xen/xen-head.S 2011-05-19 00:06:34.000000000 -0400
24148+++ linux-2.6.39.1/arch/x86/xen/xen-head.S 2011-05-22 19:36:30.000000000 -0400
24149@@ -19,6 +19,17 @@ ENTRY(startup_xen)
24150 #ifdef CONFIG_X86_32
24151 mov %esi,xen_start_info
24152 mov $init_thread_union+THREAD_SIZE,%esp
24153+#ifdef CONFIG_SMP
24154+ movl $cpu_gdt_table,%edi
24155+ movl $__per_cpu_load,%eax
24156+ movw %ax,__KERNEL_PERCPU + 2(%edi)
24157+ rorl $16,%eax
24158+ movb %al,__KERNEL_PERCPU + 4(%edi)
24159+ movb %ah,__KERNEL_PERCPU + 7(%edi)
24160+ movl $__per_cpu_end - 1,%eax
24161+ subl $__per_cpu_start,%eax
24162+ movw %ax,__KERNEL_PERCPU + 0(%edi)
24163+#endif
24164 #else
24165 mov %rsi,xen_start_info
24166 mov $init_thread_union+THREAD_SIZE,%rsp
24167diff -urNp linux-2.6.39.1/arch/x86/xen/xen-ops.h linux-2.6.39.1/arch/x86/xen/xen-ops.h
24168--- linux-2.6.39.1/arch/x86/xen/xen-ops.h 2011-05-19 00:06:34.000000000 -0400
24169+++ linux-2.6.39.1/arch/x86/xen/xen-ops.h 2011-05-22 19:36:30.000000000 -0400
24170@@ -10,8 +10,6 @@
24171 extern const char xen_hypervisor_callback[];
24172 extern const char xen_failsafe_callback[];
24173
24174-extern void *xen_initial_gdt;
24175-
24176 struct trap_info;
24177 void xen_copy_trap_info(struct trap_info *traps);
24178
24179diff -urNp linux-2.6.39.1/block/blk-iopoll.c linux-2.6.39.1/block/blk-iopoll.c
24180--- linux-2.6.39.1/block/blk-iopoll.c 2011-05-19 00:06:34.000000000 -0400
24181+++ linux-2.6.39.1/block/blk-iopoll.c 2011-05-22 19:36:30.000000000 -0400
24182@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
24183 }
24184 EXPORT_SYMBOL(blk_iopoll_complete);
24185
24186-static void blk_iopoll_softirq(struct softirq_action *h)
24187+static void blk_iopoll_softirq(void)
24188 {
24189 struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
24190 int rearm = 0, budget = blk_iopoll_budget;
24191diff -urNp linux-2.6.39.1/block/blk-map.c linux-2.6.39.1/block/blk-map.c
24192--- linux-2.6.39.1/block/blk-map.c 2011-05-19 00:06:34.000000000 -0400
24193+++ linux-2.6.39.1/block/blk-map.c 2011-05-22 19:36:30.000000000 -0400
24194@@ -301,7 +301,7 @@ int blk_rq_map_kern(struct request_queue
24195 if (!len || !kbuf)
24196 return -EINVAL;
24197
24198- do_copy = !blk_rq_aligned(q, addr, len) || object_is_on_stack(kbuf);
24199+ do_copy = !blk_rq_aligned(q, addr, len) || object_starts_on_stack(kbuf);
24200 if (do_copy)
24201 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
24202 else
24203diff -urNp linux-2.6.39.1/block/blk-softirq.c linux-2.6.39.1/block/blk-softirq.c
24204--- linux-2.6.39.1/block/blk-softirq.c 2011-05-19 00:06:34.000000000 -0400
24205+++ linux-2.6.39.1/block/blk-softirq.c 2011-05-22 19:36:30.000000000 -0400
24206@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head,
24207 * Softirq action handler - move entries to local list and loop over them
24208 * while passing them to the queue registered handler.
24209 */
24210-static void blk_done_softirq(struct softirq_action *h)
24211+static void blk_done_softirq(void)
24212 {
24213 struct list_head *cpu_list, local_list;
24214
24215diff -urNp linux-2.6.39.1/block/bsg.c linux-2.6.39.1/block/bsg.c
24216--- linux-2.6.39.1/block/bsg.c 2011-05-19 00:06:34.000000000 -0400
24217+++ linux-2.6.39.1/block/bsg.c 2011-05-22 19:36:30.000000000 -0400
24218@@ -176,16 +176,24 @@ static int blk_fill_sgv4_hdr_rq(struct r
24219 struct sg_io_v4 *hdr, struct bsg_device *bd,
24220 fmode_t has_write_perm)
24221 {
24222+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24223+ unsigned char *cmdptr;
24224+
24225 if (hdr->request_len > BLK_MAX_CDB) {
24226 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
24227 if (!rq->cmd)
24228 return -ENOMEM;
24229- }
24230+ cmdptr = rq->cmd;
24231+ } else
24232+ cmdptr = tmpcmd;
24233
24234- if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
24235+ if (copy_from_user(cmdptr, (void *)(unsigned long)hdr->request,
24236 hdr->request_len))
24237 return -EFAULT;
24238
24239+ if (cmdptr != rq->cmd)
24240+ memcpy(rq->cmd, cmdptr, hdr->request_len);
24241+
24242 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
24243 if (blk_verify_command(rq->cmd, has_write_perm))
24244 return -EPERM;
24245diff -urNp linux-2.6.39.1/block/scsi_ioctl.c linux-2.6.39.1/block/scsi_ioctl.c
24246--- linux-2.6.39.1/block/scsi_ioctl.c 2011-05-19 00:06:34.000000000 -0400
24247+++ linux-2.6.39.1/block/scsi_ioctl.c 2011-05-22 19:36:30.000000000 -0400
24248@@ -222,8 +222,20 @@ EXPORT_SYMBOL(blk_verify_command);
24249 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
24250 struct sg_io_hdr *hdr, fmode_t mode)
24251 {
24252- if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
24253+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24254+ unsigned char *cmdptr;
24255+
24256+ if (rq->cmd != rq->__cmd)
24257+ cmdptr = rq->cmd;
24258+ else
24259+ cmdptr = tmpcmd;
24260+
24261+ if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
24262 return -EFAULT;
24263+
24264+ if (cmdptr != rq->cmd)
24265+ memcpy(rq->cmd, cmdptr, hdr->cmd_len);
24266+
24267 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
24268 return -EPERM;
24269
24270@@ -432,6 +444,8 @@ int sg_scsi_ioctl(struct request_queue *
24271 int err;
24272 unsigned int in_len, out_len, bytes, opcode, cmdlen;
24273 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
24274+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24275+ unsigned char *cmdptr;
24276
24277 if (!sic)
24278 return -EINVAL;
24279@@ -465,9 +479,18 @@ int sg_scsi_ioctl(struct request_queue *
24280 */
24281 err = -EFAULT;
24282 rq->cmd_len = cmdlen;
24283- if (copy_from_user(rq->cmd, sic->data, cmdlen))
24284+
24285+ if (rq->cmd != rq->__cmd)
24286+ cmdptr = rq->cmd;
24287+ else
24288+ cmdptr = tmpcmd;
24289+
24290+ if (copy_from_user(cmdptr, sic->data, cmdlen))
24291 goto error;
24292
24293+ if (rq->cmd != cmdptr)
24294+ memcpy(rq->cmd, cmdptr, cmdlen);
24295+
24296 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
24297 goto error;
24298
24299diff -urNp linux-2.6.39.1/crypto/serpent.c linux-2.6.39.1/crypto/serpent.c
24300--- linux-2.6.39.1/crypto/serpent.c 2011-05-19 00:06:34.000000000 -0400
24301+++ linux-2.6.39.1/crypto/serpent.c 2011-05-22 19:36:30.000000000 -0400
24302@@ -224,6 +224,8 @@ static int serpent_setkey(struct crypto_
24303 u32 r0,r1,r2,r3,r4;
24304 int i;
24305
24306+ pax_track_stack();
24307+
24308 /* Copy key, add padding */
24309
24310 for (i = 0; i < keylen; ++i)
24311diff -urNp linux-2.6.39.1/Documentation/dontdiff linux-2.6.39.1/Documentation/dontdiff
24312--- linux-2.6.39.1/Documentation/dontdiff 2011-05-19 00:06:34.000000000 -0400
24313+++ linux-2.6.39.1/Documentation/dontdiff 2011-05-22 19:36:30.000000000 -0400
24314@@ -1,13 +1,16 @@
24315 *.a
24316 *.aux
24317 *.bin
24318+*.cis
24319 *.cpio
24320 *.csp
24321+*.dbg
24322 *.dsp
24323 *.dvi
24324 *.elf
24325 *.eps
24326 *.fw
24327+*.gcno
24328 *.gen.S
24329 *.gif
24330 *.grep
24331@@ -38,8 +41,10 @@
24332 *.tab.h
24333 *.tex
24334 *.ver
24335+*.vim
24336 *.xml
24337 *_MODULES
24338+*_reg_safe.h
24339 *_vga16.c
24340 *~
24341 *.9
24342@@ -49,11 +54,16 @@
24343 53c700_d.h
24344 CVS
24345 ChangeSet
24346+GPATH
24347+GRTAGS
24348+GSYMS
24349+GTAGS
24350 Image
24351 Kerntypes
24352 Module.markers
24353 Module.symvers
24354 PENDING
24355+PERF*
24356 SCCS
24357 System.map*
24358 TAGS
24359@@ -80,8 +90,11 @@ btfixupprep
24360 build
24361 bvmlinux
24362 bzImage*
24363+capability_names.h
24364 capflags.c
24365 classlist.h*
24366+clut_vga16.c
24367+common-cmds.h
24368 comp*.log
24369 compile.h*
24370 conf
24371@@ -106,16 +119,19 @@ fore200e_mkfirm
24372 fore200e_pca_fw.c*
24373 gconf
24374 gen-devlist
24375+gen-kdb_cmds.c
24376 gen_crc32table
24377 gen_init_cpio
24378 generated
24379 genheaders
24380 genksyms
24381 *_gray256.c
24382+hash
24383 ihex2fw
24384 ikconfig.h*
24385 inat-tables.c
24386 initramfs_data.cpio
24387+initramfs_data.cpio.bz2
24388 initramfs_data.cpio.gz
24389 initramfs_list
24390 int16.c
24391@@ -125,7 +141,6 @@ int32.c
24392 int4.c
24393 int8.c
24394 kallsyms
24395-kconfig
24396 keywords.c
24397 ksym.c*
24398 ksym.h*
24399@@ -149,7 +164,9 @@ mkboot
24400 mkbugboot
24401 mkcpustr
24402 mkdep
24403+mkpiggy
24404 mkprep
24405+mkregtable
24406 mktables
24407 mktree
24408 modpost
24409@@ -165,6 +182,7 @@ parse.h
24410 patches*
24411 pca200e.bin
24412 pca200e_ecd.bin2
24413+perf-archive
24414 piggy.gz
24415 piggyback
24416 piggy.S
24417@@ -180,7 +198,9 @@ r600_reg_safe.h
24418 raid6altivec*.c
24419 raid6int*.c
24420 raid6tables.c
24421+regdb.c
24422 relocs
24423+rlim_names.h
24424 rn50_reg_safe.h
24425 rs600_reg_safe.h
24426 rv515_reg_safe.h
24427@@ -189,6 +209,7 @@ setup
24428 setup.bin
24429 setup.elf
24430 sImage
24431+slabinfo
24432 sm_tbl*
24433 split-include
24434 syscalltab.h
24435@@ -213,13 +234,17 @@ version.h*
24436 vmlinux
24437 vmlinux-*
24438 vmlinux.aout
24439+vmlinux.bin.all
24440+vmlinux.bin.bz2
24441 vmlinux.lds
24442+vmlinux.relocs
24443 voffset.h
24444 vsyscall.lds
24445 vsyscall_32.lds
24446 wanxlfw.inc
24447 uImage
24448 unifdef
24449+utsrelease.h
24450 wakeup.bin
24451 wakeup.elf
24452 wakeup.lds
24453diff -urNp linux-2.6.39.1/Documentation/filesystems/configfs/configfs_example_macros.c linux-2.6.39.1/Documentation/filesystems/configfs/configfs_example_macros.c
24454--- linux-2.6.39.1/Documentation/filesystems/configfs/configfs_example_macros.c 2011-05-19 00:06:34.000000000 -0400
24455+++ linux-2.6.39.1/Documentation/filesystems/configfs/configfs_example_macros.c 2011-05-22 19:36:30.000000000 -0400
24456@@ -368,7 +368,7 @@ static struct configfs_item_operations g
24457 * Note that, since no extra work is required on ->drop_item(),
24458 * no ->drop_item() is provided.
24459 */
24460-static struct configfs_group_operations group_children_group_ops = {
24461+static const struct configfs_group_operations group_children_group_ops = {
24462 .make_group = group_children_make_group,
24463 };
24464
24465diff -urNp linux-2.6.39.1/Documentation/filesystems/sysfs.txt linux-2.6.39.1/Documentation/filesystems/sysfs.txt
24466--- linux-2.6.39.1/Documentation/filesystems/sysfs.txt 2011-05-19 00:06:34.000000000 -0400
24467+++ linux-2.6.39.1/Documentation/filesystems/sysfs.txt 2011-05-22 19:36:30.000000000 -0400
24468@@ -125,8 +125,8 @@ set of sysfs operations for forwarding r
24469 show and store methods of the attribute owners.
24470
24471 struct sysfs_ops {
24472- ssize_t (*show)(struct kobject *, struct attribute *, char *);
24473- ssize_t (*store)(struct kobject *, struct attribute *, const char *, size_t);
24474+ ssize_t (* const show)(struct kobject *, struct attribute *, char *);
24475+ ssize_t (* const store)(struct kobject *, struct attribute *, const char *, size_t);
24476 };
24477
24478 [ Subsystems should have already defined a struct kobj_type as a
24479diff -urNp linux-2.6.39.1/Documentation/kernel-parameters.txt linux-2.6.39.1/Documentation/kernel-parameters.txt
24480--- linux-2.6.39.1/Documentation/kernel-parameters.txt 2011-05-19 00:06:34.000000000 -0400
24481+++ linux-2.6.39.1/Documentation/kernel-parameters.txt 2011-05-22 19:36:30.000000000 -0400
24482@@ -1879,6 +1879,13 @@ bytes respectively. Such letter suffixes
24483 the specified number of seconds. This is to be used if
24484 your oopses keep scrolling off the screen.
24485
24486+ pax_nouderef [X86] disables UDEREF. Most likely needed under certain
24487+ virtualization environments that don't cope well with the
24488+ expand down segment used by UDEREF on X86-32 or the frequent
24489+ page table updates on X86-64.
24490+
24491+ pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
24492+
24493 pcbit= [HW,ISDN]
24494
24495 pcd. [PARIDE]
24496diff -urNp linux-2.6.39.1/drivers/acpi/acpi_ipmi.c linux-2.6.39.1/drivers/acpi/acpi_ipmi.c
24497--- linux-2.6.39.1/drivers/acpi/acpi_ipmi.c 2011-05-19 00:06:34.000000000 -0400
24498+++ linux-2.6.39.1/drivers/acpi/acpi_ipmi.c 2011-05-22 19:36:30.000000000 -0400
24499@@ -70,7 +70,7 @@ struct acpi_ipmi_device {
24500 struct ipmi_driver_data {
24501 struct list_head ipmi_devices;
24502 struct ipmi_smi_watcher bmc_events;
24503- struct ipmi_user_hndl ipmi_hndlrs;
24504+ const struct ipmi_user_hndl ipmi_hndlrs;
24505 struct mutex ipmi_lock;
24506 };
24507
24508diff -urNp linux-2.6.39.1/drivers/acpi/apei/cper.c linux-2.6.39.1/drivers/acpi/apei/cper.c
24509--- linux-2.6.39.1/drivers/acpi/apei/cper.c 2011-05-19 00:06:34.000000000 -0400
24510+++ linux-2.6.39.1/drivers/acpi/apei/cper.c 2011-05-22 19:36:30.000000000 -0400
24511@@ -38,12 +38,12 @@
24512 */
24513 u64 cper_next_record_id(void)
24514 {
24515- static atomic64_t seq;
24516+ static atomic64_unchecked_t seq;
24517
24518- if (!atomic64_read(&seq))
24519- atomic64_set(&seq, ((u64)get_seconds()) << 32);
24520+ if (!atomic64_read_unchecked(&seq))
24521+ atomic64_set_unchecked(&seq, ((u64)get_seconds()) << 32);
24522
24523- return atomic64_inc_return(&seq);
24524+ return atomic64_inc_return_unchecked(&seq);
24525 }
24526 EXPORT_SYMBOL_GPL(cper_next_record_id);
24527
24528diff -urNp linux-2.6.39.1/drivers/acpi/battery.c linux-2.6.39.1/drivers/acpi/battery.c
24529--- linux-2.6.39.1/drivers/acpi/battery.c 2011-05-19 00:06:34.000000000 -0400
24530+++ linux-2.6.39.1/drivers/acpi/battery.c 2011-05-22 19:36:30.000000000 -0400
24531@@ -864,7 +864,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
24532 }
24533
24534 static struct battery_file {
24535- struct file_operations ops;
24536+ const struct file_operations ops;
24537 mode_t mode;
24538 const char *name;
24539 } acpi_battery_file[] = {
24540diff -urNp linux-2.6.39.1/drivers/acpi/dock.c linux-2.6.39.1/drivers/acpi/dock.c
24541--- linux-2.6.39.1/drivers/acpi/dock.c 2011-05-19 00:06:34.000000000 -0400
24542+++ linux-2.6.39.1/drivers/acpi/dock.c 2011-05-22 19:36:30.000000000 -0400
24543@@ -77,7 +77,7 @@ struct dock_dependent_device {
24544 struct list_head list;
24545 struct list_head hotplug_list;
24546 acpi_handle handle;
24547- struct acpi_dock_ops *ops;
24548+ const struct acpi_dock_ops *ops;
24549 void *context;
24550 };
24551
24552@@ -589,7 +589,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifi
24553 * the dock driver after _DCK is executed.
24554 */
24555 int
24556-register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
24557+register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
24558 void *context)
24559 {
24560 struct dock_dependent_device *dd;
24561diff -urNp linux-2.6.39.1/drivers/acpi/ec_sys.c linux-2.6.39.1/drivers/acpi/ec_sys.c
24562--- linux-2.6.39.1/drivers/acpi/ec_sys.c 2011-05-19 00:06:34.000000000 -0400
24563+++ linux-2.6.39.1/drivers/acpi/ec_sys.c 2011-05-22 19:36:30.000000000 -0400
24564@@ -92,7 +92,7 @@ static ssize_t acpi_ec_write_io(struct f
24565 return count;
24566 }
24567
24568-static struct file_operations acpi_ec_io_ops = {
24569+static const struct file_operations acpi_ec_io_ops = {
24570 .owner = THIS_MODULE,
24571 .open = acpi_ec_open_io,
24572 .read = acpi_ec_read_io,
24573diff -urNp linux-2.6.39.1/drivers/acpi/fan.c linux-2.6.39.1/drivers/acpi/fan.c
24574--- linux-2.6.39.1/drivers/acpi/fan.c 2011-05-19 00:06:34.000000000 -0400
24575+++ linux-2.6.39.1/drivers/acpi/fan.c 2011-05-22 19:36:30.000000000 -0400
24576@@ -110,7 +110,7 @@ fan_set_cur_state(struct thermal_cooling
24577 return result;
24578 }
24579
24580-static struct thermal_cooling_device_ops fan_cooling_ops = {
24581+static const struct thermal_cooling_device_ops fan_cooling_ops = {
24582 .get_max_state = fan_get_max_state,
24583 .get_cur_state = fan_get_cur_state,
24584 .set_cur_state = fan_set_cur_state,
24585diff -urNp linux-2.6.39.1/drivers/acpi/power_meter.c linux-2.6.39.1/drivers/acpi/power_meter.c
24586--- linux-2.6.39.1/drivers/acpi/power_meter.c 2011-05-19 00:06:34.000000000 -0400
24587+++ linux-2.6.39.1/drivers/acpi/power_meter.c 2011-05-22 19:36:30.000000000 -0400
24588@@ -316,8 +316,6 @@ static ssize_t set_trip(struct device *d
24589 return res;
24590
24591 temp /= 1000;
24592- if (temp < 0)
24593- return -EINVAL;
24594
24595 mutex_lock(&resource->lock);
24596 resource->trip[attr->index - 7] = temp;
24597diff -urNp linux-2.6.39.1/drivers/acpi/proc.c linux-2.6.39.1/drivers/acpi/proc.c
24598--- linux-2.6.39.1/drivers/acpi/proc.c 2011-05-19 00:06:34.000000000 -0400
24599+++ linux-2.6.39.1/drivers/acpi/proc.c 2011-05-22 19:36:30.000000000 -0400
24600@@ -342,19 +342,13 @@ acpi_system_write_wakeup_device(struct f
24601 size_t count, loff_t * ppos)
24602 {
24603 struct list_head *node, *next;
24604- char strbuf[5];
24605- char str[5] = "";
24606- unsigned int len = count;
24607-
24608- if (len > 4)
24609- len = 4;
24610- if (len < 0)
24611- return -EFAULT;
24612+ char strbuf[5] = {0};
24613
24614- if (copy_from_user(strbuf, buffer, len))
24615+ if (count > 4)
24616+ count = 4;
24617+ if (copy_from_user(strbuf, buffer, count))
24618 return -EFAULT;
24619- strbuf[len] = '\0';
24620- sscanf(strbuf, "%s", str);
24621+ strbuf[count] = '\0';
24622
24623 mutex_lock(&acpi_device_lock);
24624 list_for_each_safe(node, next, &acpi_wakeup_device_list) {
24625@@ -363,7 +357,7 @@ acpi_system_write_wakeup_device(struct f
24626 if (!dev->wakeup.flags.valid)
24627 continue;
24628
24629- if (!strncmp(dev->pnp.bus_id, str, 4)) {
24630+ if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
24631 if (device_can_wakeup(&dev->dev)) {
24632 bool enable = !device_may_wakeup(&dev->dev);
24633 device_set_wakeup_enable(&dev->dev, enable);
24634diff -urNp linux-2.6.39.1/drivers/acpi/processor_driver.c linux-2.6.39.1/drivers/acpi/processor_driver.c
24635--- linux-2.6.39.1/drivers/acpi/processor_driver.c 2011-05-19 00:06:34.000000000 -0400
24636+++ linux-2.6.39.1/drivers/acpi/processor_driver.c 2011-05-22 19:36:30.000000000 -0400
24637@@ -473,7 +473,7 @@ static int __cpuinit acpi_processor_add(
24638 return 0;
24639 #endif
24640
24641- BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
24642+ BUG_ON(pr->id >= nr_cpu_ids);
24643
24644 /*
24645 * Buggy BIOS check
24646diff -urNp linux-2.6.39.1/drivers/acpi/processor_idle.c linux-2.6.39.1/drivers/acpi/processor_idle.c
24647--- linux-2.6.39.1/drivers/acpi/processor_idle.c 2011-05-19 00:06:34.000000000 -0400
24648+++ linux-2.6.39.1/drivers/acpi/processor_idle.c 2011-05-22 19:36:30.000000000 -0400
24649@@ -121,7 +121,7 @@ static struct dmi_system_id __cpuinitdat
24650 DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
24651 DMI_MATCH(DMI_PRODUCT_NAME,"L8400B series Notebook PC")},
24652 (void *)1},
24653- {},
24654+ {}
24655 };
24656
24657
24658diff -urNp linux-2.6.39.1/drivers/acpi/processor_thermal.c linux-2.6.39.1/drivers/acpi/processor_thermal.c
24659--- linux-2.6.39.1/drivers/acpi/processor_thermal.c 2011-05-19 00:06:34.000000000 -0400
24660+++ linux-2.6.39.1/drivers/acpi/processor_thermal.c 2011-05-22 19:36:30.000000000 -0400
24661@@ -244,7 +244,7 @@ processor_set_cur_state(struct thermal_c
24662 return result;
24663 }
24664
24665-struct thermal_cooling_device_ops processor_cooling_ops = {
24666+const struct thermal_cooling_device_ops processor_cooling_ops = {
24667 .get_max_state = processor_get_max_state,
24668 .get_cur_state = processor_get_cur_state,
24669 .set_cur_state = processor_set_cur_state,
24670diff -urNp linux-2.6.39.1/drivers/acpi/sysfs.c linux-2.6.39.1/drivers/acpi/sysfs.c
24671--- linux-2.6.39.1/drivers/acpi/sysfs.c 2011-05-19 00:06:34.000000000 -0400
24672+++ linux-2.6.39.1/drivers/acpi/sysfs.c 2011-05-22 19:36:30.000000000 -0400
24673@@ -149,12 +149,12 @@ static int param_get_debug_level(char *b
24674 return result;
24675 }
24676
24677-static struct kernel_param_ops param_ops_debug_layer = {
24678+static const struct kernel_param_ops param_ops_debug_layer = {
24679 .set = param_set_uint,
24680 .get = param_get_debug_layer,
24681 };
24682
24683-static struct kernel_param_ops param_ops_debug_level = {
24684+static const struct kernel_param_ops param_ops_debug_level = {
24685 .set = param_set_uint,
24686 .get = param_get_debug_level,
24687 };
24688diff -urNp linux-2.6.39.1/drivers/acpi/thermal.c linux-2.6.39.1/drivers/acpi/thermal.c
24689--- linux-2.6.39.1/drivers/acpi/thermal.c 2011-05-19 00:06:34.000000000 -0400
24690+++ linux-2.6.39.1/drivers/acpi/thermal.c 2011-05-22 19:36:30.000000000 -0400
24691@@ -812,7 +812,7 @@ acpi_thermal_unbind_cooling_device(struc
24692 thermal_zone_unbind_cooling_device);
24693 }
24694
24695-static struct thermal_zone_device_ops acpi_thermal_zone_ops = {
24696+static const struct thermal_zone_device_ops acpi_thermal_zone_ops = {
24697 .bind = acpi_thermal_bind_cooling_device,
24698 .unbind = acpi_thermal_unbind_cooling_device,
24699 .get_temp = thermal_get_temp,
24700diff -urNp linux-2.6.39.1/drivers/acpi/video.c linux-2.6.39.1/drivers/acpi/video.c
24701--- linux-2.6.39.1/drivers/acpi/video.c 2011-05-19 00:06:34.000000000 -0400
24702+++ linux-2.6.39.1/drivers/acpi/video.c 2011-05-22 19:36:30.000000000 -0400
24703@@ -308,7 +308,7 @@ video_set_cur_state(struct thermal_cooli
24704 return acpi_video_device_lcd_set_level(video, level);
24705 }
24706
24707-static struct thermal_cooling_device_ops video_cooling_ops = {
24708+static const struct thermal_cooling_device_ops video_cooling_ops = {
24709 .get_max_state = video_get_max_state,
24710 .get_cur_state = video_get_cur_state,
24711 .set_cur_state = video_set_cur_state,
24712diff -urNp linux-2.6.39.1/drivers/ata/acard-ahci.c linux-2.6.39.1/drivers/ata/acard-ahci.c
24713--- linux-2.6.39.1/drivers/ata/acard-ahci.c 2011-05-19 00:06:34.000000000 -0400
24714+++ linux-2.6.39.1/drivers/ata/acard-ahci.c 2011-05-22 19:36:30.000000000 -0400
24715@@ -87,7 +87,7 @@ static struct scsi_host_template acard_a
24716 AHCI_SHT("acard-ahci"),
24717 };
24718
24719-static struct ata_port_operations acard_ops = {
24720+static const struct ata_port_operations acard_ops = {
24721 .inherits = &ahci_ops,
24722 .qc_prep = acard_ahci_qc_prep,
24723 .qc_fill_rtf = acard_ahci_qc_fill_rtf,
24724diff -urNp linux-2.6.39.1/drivers/ata/ahci.c linux-2.6.39.1/drivers/ata/ahci.c
24725--- linux-2.6.39.1/drivers/ata/ahci.c 2011-05-19 00:06:34.000000000 -0400
24726+++ linux-2.6.39.1/drivers/ata/ahci.c 2011-05-22 19:36:30.000000000 -0400
24727@@ -94,17 +94,17 @@ static struct scsi_host_template ahci_sh
24728 AHCI_SHT("ahci"),
24729 };
24730
24731-static struct ata_port_operations ahci_vt8251_ops = {
24732+static const struct ata_port_operations ahci_vt8251_ops = {
24733 .inherits = &ahci_ops,
24734 .hardreset = ahci_vt8251_hardreset,
24735 };
24736
24737-static struct ata_port_operations ahci_p5wdh_ops = {
24738+static const struct ata_port_operations ahci_p5wdh_ops = {
24739 .inherits = &ahci_ops,
24740 .hardreset = ahci_p5wdh_hardreset,
24741 };
24742
24743-static struct ata_port_operations ahci_sb600_ops = {
24744+static const struct ata_port_operations ahci_sb600_ops = {
24745 .inherits = &ahci_ops,
24746 .softreset = ahci_sb600_softreset,
24747 .pmp_softreset = ahci_sb600_softreset,
24748diff -urNp linux-2.6.39.1/drivers/ata/ahci.h linux-2.6.39.1/drivers/ata/ahci.h
24749--- linux-2.6.39.1/drivers/ata/ahci.h 2011-05-19 00:06:34.000000000 -0400
24750+++ linux-2.6.39.1/drivers/ata/ahci.h 2011-05-22 19:36:30.000000000 -0400
24751@@ -311,7 +311,7 @@ extern struct device_attribute *ahci_sde
24752 .shost_attrs = ahci_shost_attrs, \
24753 .sdev_attrs = ahci_sdev_attrs
24754
24755-extern struct ata_port_operations ahci_ops;
24756+extern const struct ata_port_operations ahci_ops;
24757
24758 void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
24759 u32 opts);
24760diff -urNp linux-2.6.39.1/drivers/ata/ata_generic.c linux-2.6.39.1/drivers/ata/ata_generic.c
24761--- linux-2.6.39.1/drivers/ata/ata_generic.c 2011-05-19 00:06:34.000000000 -0400
24762+++ linux-2.6.39.1/drivers/ata/ata_generic.c 2011-05-22 19:36:30.000000000 -0400
24763@@ -101,7 +101,7 @@ static struct scsi_host_template generic
24764 ATA_BMDMA_SHT(DRV_NAME),
24765 };
24766
24767-static struct ata_port_operations generic_port_ops = {
24768+static const struct ata_port_operations generic_port_ops = {
24769 .inherits = &ata_bmdma_port_ops,
24770 .cable_detect = ata_cable_unknown,
24771 .set_mode = generic_set_mode,
24772diff -urNp linux-2.6.39.1/drivers/ata/ata_piix.c linux-2.6.39.1/drivers/ata/ata_piix.c
24773--- linux-2.6.39.1/drivers/ata/ata_piix.c 2011-05-19 00:06:34.000000000 -0400
24774+++ linux-2.6.39.1/drivers/ata/ata_piix.c 2011-05-22 19:36:30.000000000 -0400
24775@@ -335,12 +335,12 @@ static struct scsi_host_template piix_sh
24776 ATA_BMDMA_SHT(DRV_NAME),
24777 };
24778
24779-static struct ata_port_operations piix_sata_ops = {
24780+static const struct ata_port_operations piix_sata_ops = {
24781 .inherits = &ata_bmdma32_port_ops,
24782 .sff_irq_check = piix_irq_check,
24783 };
24784
24785-static struct ata_port_operations piix_pata_ops = {
24786+static const struct ata_port_operations piix_pata_ops = {
24787 .inherits = &piix_sata_ops,
24788 .cable_detect = ata_cable_40wire,
24789 .set_piomode = piix_set_piomode,
24790@@ -348,12 +348,12 @@ static struct ata_port_operations piix_p
24791 .prereset = piix_pata_prereset,
24792 };
24793
24794-static struct ata_port_operations piix_vmw_ops = {
24795+static const struct ata_port_operations piix_vmw_ops = {
24796 .inherits = &piix_pata_ops,
24797 .bmdma_status = piix_vmw_bmdma_status,
24798 };
24799
24800-static struct ata_port_operations ich_pata_ops = {
24801+static const struct ata_port_operations ich_pata_ops = {
24802 .inherits = &piix_pata_ops,
24803 .cable_detect = ich_pata_cable_detect,
24804 .set_dmamode = ich_set_dmamode,
24805@@ -369,7 +369,7 @@ static struct scsi_host_template piix_si
24806 .shost_attrs = piix_sidpr_shost_attrs,
24807 };
24808
24809-static struct ata_port_operations piix_sidpr_sata_ops = {
24810+static const struct ata_port_operations piix_sidpr_sata_ops = {
24811 .inherits = &piix_sata_ops,
24812 .hardreset = sata_std_hardreset,
24813 .scr_read = piix_sidpr_scr_read,
24814diff -urNp linux-2.6.39.1/drivers/ata/libahci.c linux-2.6.39.1/drivers/ata/libahci.c
24815--- linux-2.6.39.1/drivers/ata/libahci.c 2011-05-19 00:06:34.000000000 -0400
24816+++ linux-2.6.39.1/drivers/ata/libahci.c 2011-05-22 19:36:30.000000000 -0400
24817@@ -141,7 +141,7 @@ struct device_attribute *ahci_sdev_attrs
24818 };
24819 EXPORT_SYMBOL_GPL(ahci_sdev_attrs);
24820
24821-struct ata_port_operations ahci_ops = {
24822+const struct ata_port_operations ahci_ops = {
24823 .inherits = &sata_pmp_port_ops,
24824
24825 .qc_defer = ahci_pmp_qc_defer,
24826diff -urNp linux-2.6.39.1/drivers/ata/libata-acpi.c linux-2.6.39.1/drivers/ata/libata-acpi.c
24827--- linux-2.6.39.1/drivers/ata/libata-acpi.c 2011-05-19 00:06:34.000000000 -0400
24828+++ linux-2.6.39.1/drivers/ata/libata-acpi.c 2011-05-22 19:36:30.000000000 -0400
24829@@ -218,12 +218,12 @@ static void ata_acpi_dev_uevent(acpi_han
24830 ata_acpi_uevent(dev->link->ap, dev, event);
24831 }
24832
24833-static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
24834+static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
24835 .handler = ata_acpi_dev_notify_dock,
24836 .uevent = ata_acpi_dev_uevent,
24837 };
24838
24839-static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
24840+static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
24841 .handler = ata_acpi_ap_notify_dock,
24842 .uevent = ata_acpi_ap_uevent,
24843 };
24844diff -urNp linux-2.6.39.1/drivers/ata/libata-core.c linux-2.6.39.1/drivers/ata/libata-core.c
24845--- linux-2.6.39.1/drivers/ata/libata-core.c 2011-05-19 00:06:34.000000000 -0400
24846+++ linux-2.6.39.1/drivers/ata/libata-core.c 2011-05-22 19:36:30.000000000 -0400
24847@@ -4747,7 +4747,7 @@ void ata_qc_free(struct ata_queued_cmd *
24848 struct ata_port *ap;
24849 unsigned int tag;
24850
24851- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24852+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24853 ap = qc->ap;
24854
24855 qc->flags = 0;
24856@@ -4763,7 +4763,7 @@ void __ata_qc_complete(struct ata_queued
24857 struct ata_port *ap;
24858 struct ata_link *link;
24859
24860- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24861+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24862 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
24863 ap = qc->ap;
24864 link = qc->dev->link;
24865@@ -5756,7 +5756,7 @@ static void ata_host_stop(struct device
24866 * LOCKING:
24867 * None.
24868 */
24869-static void ata_finalize_port_ops(struct ata_port_operations *ops)
24870+static void ata_finalize_port_ops(const struct ata_port_operations *ops)
24871 {
24872 static DEFINE_SPINLOCK(lock);
24873 const struct ata_port_operations *cur;
24874@@ -5768,6 +5768,7 @@ static void ata_finalize_port_ops(struct
24875 return;
24876
24877 spin_lock(&lock);
24878+ pax_open_kernel();
24879
24880 for (cur = ops->inherits; cur; cur = cur->inherits) {
24881 void **inherit = (void **)cur;
24882@@ -5781,8 +5782,9 @@ static void ata_finalize_port_ops(struct
24883 if (IS_ERR(*pp))
24884 *pp = NULL;
24885
24886- ops->inherits = NULL;
24887+ ((struct ata_port_operations *)ops)->inherits = NULL;
24888
24889+ pax_close_kernel();
24890 spin_unlock(&lock);
24891 }
24892
24893@@ -5879,7 +5881,7 @@ int ata_host_start(struct ata_host *host
24894 */
24895 /* KILLME - the only user left is ipr */
24896 void ata_host_init(struct ata_host *host, struct device *dev,
24897- unsigned long flags, struct ata_port_operations *ops)
24898+ unsigned long flags, const struct ata_port_operations *ops)
24899 {
24900 spin_lock_init(&host->lock);
24901 mutex_init(&host->eh_mutex);
24902@@ -6583,7 +6585,7 @@ static void ata_dummy_error_handler(stru
24903 /* truly dummy */
24904 }
24905
24906-struct ata_port_operations ata_dummy_port_ops = {
24907+const struct ata_port_operations ata_dummy_port_ops = {
24908 .qc_prep = ata_noop_qc_prep,
24909 .qc_issue = ata_dummy_qc_issue,
24910 .error_handler = ata_dummy_error_handler,
24911diff -urNp linux-2.6.39.1/drivers/ata/libata-eh.c linux-2.6.39.1/drivers/ata/libata-eh.c
24912--- linux-2.6.39.1/drivers/ata/libata-eh.c 2011-05-19 00:06:34.000000000 -0400
24913+++ linux-2.6.39.1/drivers/ata/libata-eh.c 2011-05-22 19:36:30.000000000 -0400
24914@@ -2518,6 +2518,8 @@ void ata_eh_report(struct ata_port *ap)
24915 {
24916 struct ata_link *link;
24917
24918+ pax_track_stack();
24919+
24920 ata_for_each_link(link, ap, HOST_FIRST)
24921 ata_eh_link_report(link);
24922 }
24923@@ -3922,7 +3924,7 @@ void ata_do_eh(struct ata_port *ap, ata_
24924 */
24925 void ata_std_error_handler(struct ata_port *ap)
24926 {
24927- struct ata_port_operations *ops = ap->ops;
24928+ const struct ata_port_operations *ops = ap->ops;
24929 ata_reset_fn_t hardreset = ops->hardreset;
24930
24931 /* ignore built-in hardreset if SCR access is not available */
24932diff -urNp linux-2.6.39.1/drivers/ata/libata-pmp.c linux-2.6.39.1/drivers/ata/libata-pmp.c
24933--- linux-2.6.39.1/drivers/ata/libata-pmp.c 2011-05-19 00:06:34.000000000 -0400
24934+++ linux-2.6.39.1/drivers/ata/libata-pmp.c 2011-05-22 19:36:30.000000000 -0400
24935@@ -912,7 +912,7 @@ static int sata_pmp_handle_link_fail(str
24936 */
24937 static int sata_pmp_eh_recover(struct ata_port *ap)
24938 {
24939- struct ata_port_operations *ops = ap->ops;
24940+ const struct ata_port_operations *ops = ap->ops;
24941 int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
24942 struct ata_link *pmp_link = &ap->link;
24943 struct ata_device *pmp_dev = pmp_link->device;
24944diff -urNp linux-2.6.39.1/drivers/ata/pata_acpi.c linux-2.6.39.1/drivers/ata/pata_acpi.c
24945--- linux-2.6.39.1/drivers/ata/pata_acpi.c 2011-05-19 00:06:34.000000000 -0400
24946+++ linux-2.6.39.1/drivers/ata/pata_acpi.c 2011-05-22 19:36:30.000000000 -0400
24947@@ -216,7 +216,7 @@ static struct scsi_host_template pacpi_s
24948 ATA_BMDMA_SHT(DRV_NAME),
24949 };
24950
24951-static struct ata_port_operations pacpi_ops = {
24952+static const struct ata_port_operations pacpi_ops = {
24953 .inherits = &ata_bmdma_port_ops,
24954 .qc_issue = pacpi_qc_issue,
24955 .cable_detect = pacpi_cable_detect,
24956diff -urNp linux-2.6.39.1/drivers/ata/pata_ali.c linux-2.6.39.1/drivers/ata/pata_ali.c
24957--- linux-2.6.39.1/drivers/ata/pata_ali.c 2011-05-19 00:06:34.000000000 -0400
24958+++ linux-2.6.39.1/drivers/ata/pata_ali.c 2011-05-22 19:36:30.000000000 -0400
24959@@ -363,7 +363,7 @@ static struct scsi_host_template ali_sht
24960 * Port operations for PIO only ALi
24961 */
24962
24963-static struct ata_port_operations ali_early_port_ops = {
24964+static const struct ata_port_operations ali_early_port_ops = {
24965 .inherits = &ata_sff_port_ops,
24966 .cable_detect = ata_cable_40wire,
24967 .set_piomode = ali_set_piomode,
24968@@ -380,7 +380,7 @@ static const struct ata_port_operations
24969 * Port operations for DMA capable ALi without cable
24970 * detect
24971 */
24972-static struct ata_port_operations ali_20_port_ops = {
24973+static const struct ata_port_operations ali_20_port_ops = {
24974 .inherits = &ali_dma_base_ops,
24975 .cable_detect = ata_cable_40wire,
24976 .mode_filter = ali_20_filter,
24977@@ -391,7 +391,7 @@ static struct ata_port_operations ali_20
24978 /*
24979 * Port operations for DMA capable ALi with cable detect
24980 */
24981-static struct ata_port_operations ali_c2_port_ops = {
24982+static const struct ata_port_operations ali_c2_port_ops = {
24983 .inherits = &ali_dma_base_ops,
24984 .check_atapi_dma = ali_check_atapi_dma,
24985 .cable_detect = ali_c2_cable_detect,
24986@@ -402,7 +402,7 @@ static struct ata_port_operations ali_c2
24987 /*
24988 * Port operations for DMA capable ALi with cable detect
24989 */
24990-static struct ata_port_operations ali_c4_port_ops = {
24991+static const struct ata_port_operations ali_c4_port_ops = {
24992 .inherits = &ali_dma_base_ops,
24993 .check_atapi_dma = ali_check_atapi_dma,
24994 .cable_detect = ali_c2_cable_detect,
24995@@ -412,7 +412,7 @@ static struct ata_port_operations ali_c4
24996 /*
24997 * Port operations for DMA capable ALi with cable detect and LBA48
24998 */
24999-static struct ata_port_operations ali_c5_port_ops = {
25000+static const struct ata_port_operations ali_c5_port_ops = {
25001 .inherits = &ali_dma_base_ops,
25002 .check_atapi_dma = ali_check_atapi_dma,
25003 .dev_config = ali_warn_atapi_dma,
25004diff -urNp linux-2.6.39.1/drivers/ata/pata_amd.c linux-2.6.39.1/drivers/ata/pata_amd.c
25005--- linux-2.6.39.1/drivers/ata/pata_amd.c 2011-05-19 00:06:34.000000000 -0400
25006+++ linux-2.6.39.1/drivers/ata/pata_amd.c 2011-05-22 19:36:31.000000000 -0400
25007@@ -397,28 +397,28 @@ static const struct ata_port_operations
25008 .prereset = amd_pre_reset,
25009 };
25010
25011-static struct ata_port_operations amd33_port_ops = {
25012+static const struct ata_port_operations amd33_port_ops = {
25013 .inherits = &amd_base_port_ops,
25014 .cable_detect = ata_cable_40wire,
25015 .set_piomode = amd33_set_piomode,
25016 .set_dmamode = amd33_set_dmamode,
25017 };
25018
25019-static struct ata_port_operations amd66_port_ops = {
25020+static const struct ata_port_operations amd66_port_ops = {
25021 .inherits = &amd_base_port_ops,
25022 .cable_detect = ata_cable_unknown,
25023 .set_piomode = amd66_set_piomode,
25024 .set_dmamode = amd66_set_dmamode,
25025 };
25026
25027-static struct ata_port_operations amd100_port_ops = {
25028+static const struct ata_port_operations amd100_port_ops = {
25029 .inherits = &amd_base_port_ops,
25030 .cable_detect = ata_cable_unknown,
25031 .set_piomode = amd100_set_piomode,
25032 .set_dmamode = amd100_set_dmamode,
25033 };
25034
25035-static struct ata_port_operations amd133_port_ops = {
25036+static const struct ata_port_operations amd133_port_ops = {
25037 .inherits = &amd_base_port_ops,
25038 .cable_detect = amd_cable_detect,
25039 .set_piomode = amd133_set_piomode,
25040@@ -433,13 +433,13 @@ static const struct ata_port_operations
25041 .host_stop = nv_host_stop,
25042 };
25043
25044-static struct ata_port_operations nv100_port_ops = {
25045+static const struct ata_port_operations nv100_port_ops = {
25046 .inherits = &nv_base_port_ops,
25047 .set_piomode = nv100_set_piomode,
25048 .set_dmamode = nv100_set_dmamode,
25049 };
25050
25051-static struct ata_port_operations nv133_port_ops = {
25052+static const struct ata_port_operations nv133_port_ops = {
25053 .inherits = &nv_base_port_ops,
25054 .set_piomode = nv133_set_piomode,
25055 .set_dmamode = nv133_set_dmamode,
25056diff -urNp linux-2.6.39.1/drivers/ata/pata_arasan_cf.c linux-2.6.39.1/drivers/ata/pata_arasan_cf.c
25057--- linux-2.6.39.1/drivers/ata/pata_arasan_cf.c 2011-05-19 00:06:34.000000000 -0400
25058+++ linux-2.6.39.1/drivers/ata/pata_arasan_cf.c 2011-05-22 19:36:31.000000000 -0400
25059@@ -862,7 +862,9 @@ static int __devinit arasan_cf_probe(str
25060 /* Handle platform specific quirks */
25061 if (pdata->quirk) {
25062 if (pdata->quirk & CF_BROKEN_PIO) {
25063- ap->ops->set_piomode = NULL;
25064+ pax_open_kernel();
25065+ *(void**)&ap->ops->set_piomode = NULL;
25066+ pax_close_kernel();
25067 ap->pio_mask = 0;
25068 }
25069 if (pdata->quirk & CF_BROKEN_MWDMA)
25070diff -urNp linux-2.6.39.1/drivers/ata/pata_artop.c linux-2.6.39.1/drivers/ata/pata_artop.c
25071--- linux-2.6.39.1/drivers/ata/pata_artop.c 2011-05-19 00:06:34.000000000 -0400
25072+++ linux-2.6.39.1/drivers/ata/pata_artop.c 2011-05-22 19:36:31.000000000 -0400
25073@@ -312,7 +312,7 @@ static struct scsi_host_template artop_s
25074 ATA_BMDMA_SHT(DRV_NAME),
25075 };
25076
25077-static struct ata_port_operations artop6210_ops = {
25078+static const struct ata_port_operations artop6210_ops = {
25079 .inherits = &ata_bmdma_port_ops,
25080 .cable_detect = ata_cable_40wire,
25081 .set_piomode = artop6210_set_piomode,
25082@@ -321,7 +321,7 @@ static struct ata_port_operations artop6
25083 .qc_defer = artop6210_qc_defer,
25084 };
25085
25086-static struct ata_port_operations artop6260_ops = {
25087+static const struct ata_port_operations artop6260_ops = {
25088 .inherits = &ata_bmdma_port_ops,
25089 .cable_detect = artop6260_cable_detect,
25090 .set_piomode = artop6260_set_piomode,
25091diff -urNp linux-2.6.39.1/drivers/ata/pata_at32.c linux-2.6.39.1/drivers/ata/pata_at32.c
25092--- linux-2.6.39.1/drivers/ata/pata_at32.c 2011-05-19 00:06:34.000000000 -0400
25093+++ linux-2.6.39.1/drivers/ata/pata_at32.c 2011-05-22 19:36:31.000000000 -0400
25094@@ -173,7 +173,7 @@ static struct scsi_host_template at32_sh
25095 ATA_PIO_SHT(DRV_NAME),
25096 };
25097
25098-static struct ata_port_operations at32_port_ops = {
25099+static const struct ata_port_operations at32_port_ops = {
25100 .inherits = &ata_sff_port_ops,
25101 .cable_detect = ata_cable_40wire,
25102 .set_piomode = pata_at32_set_piomode,
25103diff -urNp linux-2.6.39.1/drivers/ata/pata_at91.c linux-2.6.39.1/drivers/ata/pata_at91.c
25104--- linux-2.6.39.1/drivers/ata/pata_at91.c 2011-05-19 00:06:34.000000000 -0400
25105+++ linux-2.6.39.1/drivers/ata/pata_at91.c 2011-05-22 19:36:31.000000000 -0400
25106@@ -212,7 +212,7 @@ static struct scsi_host_template pata_at
25107 ATA_PIO_SHT(DRV_NAME),
25108 };
25109
25110-static struct ata_port_operations pata_at91_port_ops = {
25111+static const struct ata_port_operations pata_at91_port_ops = {
25112 .inherits = &ata_sff_port_ops,
25113
25114 .sff_data_xfer = pata_at91_data_xfer_noirq,
25115diff -urNp linux-2.6.39.1/drivers/ata/pata_atiixp.c linux-2.6.39.1/drivers/ata/pata_atiixp.c
25116--- linux-2.6.39.1/drivers/ata/pata_atiixp.c 2011-05-19 00:06:34.000000000 -0400
25117+++ linux-2.6.39.1/drivers/ata/pata_atiixp.c 2011-05-22 19:36:31.000000000 -0400
25118@@ -214,7 +214,7 @@ static struct scsi_host_template atiixp_
25119 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25120 };
25121
25122-static struct ata_port_operations atiixp_port_ops = {
25123+static const struct ata_port_operations atiixp_port_ops = {
25124 .inherits = &ata_bmdma_port_ops,
25125
25126 .qc_prep = ata_bmdma_dumb_qc_prep,
25127diff -urNp linux-2.6.39.1/drivers/ata/pata_atp867x.c linux-2.6.39.1/drivers/ata/pata_atp867x.c
25128--- linux-2.6.39.1/drivers/ata/pata_atp867x.c 2011-05-19 00:06:34.000000000 -0400
25129+++ linux-2.6.39.1/drivers/ata/pata_atp867x.c 2011-05-22 19:36:31.000000000 -0400
25130@@ -275,7 +275,7 @@ static struct scsi_host_template atp867x
25131 ATA_BMDMA_SHT(DRV_NAME),
25132 };
25133
25134-static struct ata_port_operations atp867x_ops = {
25135+static const struct ata_port_operations atp867x_ops = {
25136 .inherits = &ata_bmdma_port_ops,
25137 .cable_detect = atp867x_cable_detect,
25138 .set_piomode = atp867x_set_piomode,
25139diff -urNp linux-2.6.39.1/drivers/ata/pata_bf54x.c linux-2.6.39.1/drivers/ata/pata_bf54x.c
25140--- linux-2.6.39.1/drivers/ata/pata_bf54x.c 2011-05-19 00:06:34.000000000 -0400
25141+++ linux-2.6.39.1/drivers/ata/pata_bf54x.c 2011-05-22 19:36:31.000000000 -0400
25142@@ -1420,7 +1420,7 @@ static struct scsi_host_template bfin_sh
25143 .dma_boundary = ATA_DMA_BOUNDARY,
25144 };
25145
25146-static struct ata_port_operations bfin_pata_ops = {
25147+static const struct ata_port_operations bfin_pata_ops = {
25148 .inherits = &ata_bmdma_port_ops,
25149
25150 .set_piomode = bfin_set_piomode,
25151diff -urNp linux-2.6.39.1/drivers/ata/pata_cmd640.c linux-2.6.39.1/drivers/ata/pata_cmd640.c
25152--- linux-2.6.39.1/drivers/ata/pata_cmd640.c 2011-05-19 00:06:34.000000000 -0400
25153+++ linux-2.6.39.1/drivers/ata/pata_cmd640.c 2011-05-22 19:36:31.000000000 -0400
25154@@ -176,7 +176,7 @@ static struct scsi_host_template cmd640_
25155 ATA_PIO_SHT(DRV_NAME),
25156 };
25157
25158-static struct ata_port_operations cmd640_port_ops = {
25159+static const struct ata_port_operations cmd640_port_ops = {
25160 .inherits = &ata_sff_port_ops,
25161 /* In theory xfer_noirq is not needed once we kill the prefetcher */
25162 .sff_data_xfer = ata_sff_data_xfer_noirq,
25163diff -urNp linux-2.6.39.1/drivers/ata/pata_cmd64x.c linux-2.6.39.1/drivers/ata/pata_cmd64x.c
25164--- linux-2.6.39.1/drivers/ata/pata_cmd64x.c 2011-06-03 00:04:13.000000000 -0400
25165+++ linux-2.6.39.1/drivers/ata/pata_cmd64x.c 2011-06-03 00:32:05.000000000 -0400
25166@@ -271,18 +271,18 @@ static const struct ata_port_operations
25167 .set_dmamode = cmd64x_set_dmamode,
25168 };
25169
25170-static struct ata_port_operations cmd64x_port_ops = {
25171+static const struct ata_port_operations cmd64x_port_ops = {
25172 .inherits = &cmd64x_base_ops,
25173 .cable_detect = ata_cable_40wire,
25174 };
25175
25176-static struct ata_port_operations cmd646r1_port_ops = {
25177+static const struct ata_port_operations cmd646r1_port_ops = {
25178 .inherits = &cmd64x_base_ops,
25179 .bmdma_stop = cmd646r1_bmdma_stop,
25180 .cable_detect = ata_cable_40wire,
25181 };
25182
25183-static struct ata_port_operations cmd648_port_ops = {
25184+static const struct ata_port_operations cmd648_port_ops = {
25185 .inherits = &cmd64x_base_ops,
25186 .bmdma_stop = cmd648_bmdma_stop,
25187 .cable_detect = cmd648_cable_detect,
25188diff -urNp linux-2.6.39.1/drivers/ata/pata_cs5520.c linux-2.6.39.1/drivers/ata/pata_cs5520.c
25189--- linux-2.6.39.1/drivers/ata/pata_cs5520.c 2011-05-19 00:06:34.000000000 -0400
25190+++ linux-2.6.39.1/drivers/ata/pata_cs5520.c 2011-05-22 19:36:31.000000000 -0400
25191@@ -108,7 +108,7 @@ static struct scsi_host_template cs5520_
25192 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25193 };
25194
25195-static struct ata_port_operations cs5520_port_ops = {
25196+static const struct ata_port_operations cs5520_port_ops = {
25197 .inherits = &ata_bmdma_port_ops,
25198 .qc_prep = ata_bmdma_dumb_qc_prep,
25199 .cable_detect = ata_cable_40wire,
25200diff -urNp linux-2.6.39.1/drivers/ata/pata_cs5530.c linux-2.6.39.1/drivers/ata/pata_cs5530.c
25201--- linux-2.6.39.1/drivers/ata/pata_cs5530.c 2011-05-19 00:06:34.000000000 -0400
25202+++ linux-2.6.39.1/drivers/ata/pata_cs5530.c 2011-05-22 19:36:31.000000000 -0400
25203@@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
25204 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25205 };
25206
25207-static struct ata_port_operations cs5530_port_ops = {
25208+static const struct ata_port_operations cs5530_port_ops = {
25209 .inherits = &ata_bmdma_port_ops,
25210
25211 .qc_prep = ata_bmdma_dumb_qc_prep,
25212diff -urNp linux-2.6.39.1/drivers/ata/pata_cs5535.c linux-2.6.39.1/drivers/ata/pata_cs5535.c
25213--- linux-2.6.39.1/drivers/ata/pata_cs5535.c 2011-05-19 00:06:34.000000000 -0400
25214+++ linux-2.6.39.1/drivers/ata/pata_cs5535.c 2011-05-22 19:36:31.000000000 -0400
25215@@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
25216 ATA_BMDMA_SHT(DRV_NAME),
25217 };
25218
25219-static struct ata_port_operations cs5535_port_ops = {
25220+static const struct ata_port_operations cs5535_port_ops = {
25221 .inherits = &ata_bmdma_port_ops,
25222 .cable_detect = cs5535_cable_detect,
25223 .set_piomode = cs5535_set_piomode,
25224diff -urNp linux-2.6.39.1/drivers/ata/pata_cs5536.c linux-2.6.39.1/drivers/ata/pata_cs5536.c
25225--- linux-2.6.39.1/drivers/ata/pata_cs5536.c 2011-05-19 00:06:34.000000000 -0400
25226+++ linux-2.6.39.1/drivers/ata/pata_cs5536.c 2011-05-22 19:36:31.000000000 -0400
25227@@ -233,7 +233,7 @@ static struct scsi_host_template cs5536_
25228 ATA_BMDMA_SHT(DRV_NAME),
25229 };
25230
25231-static struct ata_port_operations cs5536_port_ops = {
25232+static const struct ata_port_operations cs5536_port_ops = {
25233 .inherits = &ata_bmdma32_port_ops,
25234 .cable_detect = cs5536_cable_detect,
25235 .set_piomode = cs5536_set_piomode,
25236diff -urNp linux-2.6.39.1/drivers/ata/pata_cypress.c linux-2.6.39.1/drivers/ata/pata_cypress.c
25237--- linux-2.6.39.1/drivers/ata/pata_cypress.c 2011-05-19 00:06:34.000000000 -0400
25238+++ linux-2.6.39.1/drivers/ata/pata_cypress.c 2011-05-22 19:36:31.000000000 -0400
25239@@ -115,7 +115,7 @@ static struct scsi_host_template cy82c69
25240 ATA_BMDMA_SHT(DRV_NAME),
25241 };
25242
25243-static struct ata_port_operations cy82c693_port_ops = {
25244+static const struct ata_port_operations cy82c693_port_ops = {
25245 .inherits = &ata_bmdma_port_ops,
25246 .cable_detect = ata_cable_40wire,
25247 .set_piomode = cy82c693_set_piomode,
25248diff -urNp linux-2.6.39.1/drivers/ata/pata_efar.c linux-2.6.39.1/drivers/ata/pata_efar.c
25249--- linux-2.6.39.1/drivers/ata/pata_efar.c 2011-05-19 00:06:34.000000000 -0400
25250+++ linux-2.6.39.1/drivers/ata/pata_efar.c 2011-05-22 19:36:31.000000000 -0400
25251@@ -238,7 +238,7 @@ static struct scsi_host_template efar_sh
25252 ATA_BMDMA_SHT(DRV_NAME),
25253 };
25254
25255-static struct ata_port_operations efar_ops = {
25256+static const struct ata_port_operations efar_ops = {
25257 .inherits = &ata_bmdma_port_ops,
25258 .cable_detect = efar_cable_detect,
25259 .set_piomode = efar_set_piomode,
25260diff -urNp linux-2.6.39.1/drivers/ata/pata_hpt366.c linux-2.6.39.1/drivers/ata/pata_hpt366.c
25261--- linux-2.6.39.1/drivers/ata/pata_hpt366.c 2011-05-19 00:06:34.000000000 -0400
25262+++ linux-2.6.39.1/drivers/ata/pata_hpt366.c 2011-05-22 19:36:31.000000000 -0400
25263@@ -276,7 +276,7 @@ static struct scsi_host_template hpt36x_
25264 * Configuration for HPT366/68
25265 */
25266
25267-static struct ata_port_operations hpt366_port_ops = {
25268+static const struct ata_port_operations hpt366_port_ops = {
25269 .inherits = &ata_bmdma_port_ops,
25270 .cable_detect = hpt36x_cable_detect,
25271 .mode_filter = hpt366_filter,
25272diff -urNp linux-2.6.39.1/drivers/ata/pata_hpt37x.c linux-2.6.39.1/drivers/ata/pata_hpt37x.c
25273--- linux-2.6.39.1/drivers/ata/pata_hpt37x.c 2011-05-19 00:06:34.000000000 -0400
25274+++ linux-2.6.39.1/drivers/ata/pata_hpt37x.c 2011-05-22 19:36:31.000000000 -0400
25275@@ -589,7 +589,7 @@ static struct scsi_host_template hpt37x_
25276 * Configuration for HPT370
25277 */
25278
25279-static struct ata_port_operations hpt370_port_ops = {
25280+static const struct ata_port_operations hpt370_port_ops = {
25281 .inherits = &ata_bmdma_port_ops,
25282
25283 .bmdma_stop = hpt370_bmdma_stop,
25284@@ -605,7 +605,7 @@ static struct ata_port_operations hpt370
25285 * Configuration for HPT370A. Close to 370 but less filters
25286 */
25287
25288-static struct ata_port_operations hpt370a_port_ops = {
25289+static const struct ata_port_operations hpt370a_port_ops = {
25290 .inherits = &hpt370_port_ops,
25291 .mode_filter = hpt370a_filter,
25292 };
25293@@ -615,7 +615,7 @@ static struct ata_port_operations hpt370
25294 * mode setting functionality.
25295 */
25296
25297-static struct ata_port_operations hpt302_port_ops = {
25298+static const struct ata_port_operations hpt302_port_ops = {
25299 .inherits = &ata_bmdma_port_ops,
25300
25301 .bmdma_stop = hpt37x_bmdma_stop,
25302@@ -631,7 +631,7 @@ static struct ata_port_operations hpt302
25303 * but we have a mode filter.
25304 */
25305
25306-static struct ata_port_operations hpt372_port_ops = {
25307+static const struct ata_port_operations hpt372_port_ops = {
25308 .inherits = &hpt302_port_ops,
25309 .mode_filter = hpt372_filter,
25310 };
25311@@ -641,7 +641,7 @@ static struct ata_port_operations hpt372
25312 * but we have a different cable detection procedure for function 1.
25313 */
25314
25315-static struct ata_port_operations hpt374_fn1_port_ops = {
25316+static const struct ata_port_operations hpt374_fn1_port_ops = {
25317 .inherits = &hpt372_port_ops,
25318 .cable_detect = hpt374_fn1_cable_detect,
25319 };
25320diff -urNp linux-2.6.39.1/drivers/ata/pata_hpt3x2n.c linux-2.6.39.1/drivers/ata/pata_hpt3x2n.c
25321--- linux-2.6.39.1/drivers/ata/pata_hpt3x2n.c 2011-05-19 00:06:34.000000000 -0400
25322+++ linux-2.6.39.1/drivers/ata/pata_hpt3x2n.c 2011-05-22 19:36:31.000000000 -0400
25323@@ -350,7 +350,7 @@ static struct scsi_host_template hpt3x2n
25324 * Configuration for HPT302N/371N.
25325 */
25326
25327-static struct ata_port_operations hpt3xxn_port_ops = {
25328+static const struct ata_port_operations hpt3xxn_port_ops = {
25329 .inherits = &ata_bmdma_port_ops,
25330
25331 .bmdma_stop = hpt3x2n_bmdma_stop,
25332@@ -368,7 +368,7 @@ static struct ata_port_operations hpt3xx
25333 * Configuration for HPT372N. Same as 302N/371N but we have a mode filter.
25334 */
25335
25336-static struct ata_port_operations hpt372n_port_ops = {
25337+static const struct ata_port_operations hpt372n_port_ops = {
25338 .inherits = &hpt3xxn_port_ops,
25339 .mode_filter = &hpt372n_filter,
25340 };
25341diff -urNp linux-2.6.39.1/drivers/ata/pata_hpt3x3.c linux-2.6.39.1/drivers/ata/pata_hpt3x3.c
25342--- linux-2.6.39.1/drivers/ata/pata_hpt3x3.c 2011-05-19 00:06:34.000000000 -0400
25343+++ linux-2.6.39.1/drivers/ata/pata_hpt3x3.c 2011-05-22 19:36:31.000000000 -0400
25344@@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
25345 ATA_BMDMA_SHT(DRV_NAME),
25346 };
25347
25348-static struct ata_port_operations hpt3x3_port_ops = {
25349+static const struct ata_port_operations hpt3x3_port_ops = {
25350 .inherits = &ata_bmdma_port_ops,
25351 .cable_detect = ata_cable_40wire,
25352 .set_piomode = hpt3x3_set_piomode,
25353diff -urNp linux-2.6.39.1/drivers/ata/pata_icside.c linux-2.6.39.1/drivers/ata/pata_icside.c
25354--- linux-2.6.39.1/drivers/ata/pata_icside.c 2011-05-19 00:06:34.000000000 -0400
25355+++ linux-2.6.39.1/drivers/ata/pata_icside.c 2011-05-22 19:36:31.000000000 -0400
25356@@ -320,7 +320,7 @@ static void pata_icside_postreset(struct
25357 }
25358 }
25359
25360-static struct ata_port_operations pata_icside_port_ops = {
25361+static const struct ata_port_operations pata_icside_port_ops = {
25362 .inherits = &ata_bmdma_port_ops,
25363 /* no need to build any PRD tables for DMA */
25364 .qc_prep = ata_noop_qc_prep,
25365diff -urNp linux-2.6.39.1/drivers/ata/pata_isapnp.c linux-2.6.39.1/drivers/ata/pata_isapnp.c
25366--- linux-2.6.39.1/drivers/ata/pata_isapnp.c 2011-05-19 00:06:34.000000000 -0400
25367+++ linux-2.6.39.1/drivers/ata/pata_isapnp.c 2011-05-22 19:36:31.000000000 -0400
25368@@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
25369 ATA_PIO_SHT(DRV_NAME),
25370 };
25371
25372-static struct ata_port_operations isapnp_port_ops = {
25373+static const struct ata_port_operations isapnp_port_ops = {
25374 .inherits = &ata_sff_port_ops,
25375 .cable_detect = ata_cable_40wire,
25376 };
25377
25378-static struct ata_port_operations isapnp_noalt_port_ops = {
25379+static const struct ata_port_operations isapnp_noalt_port_ops = {
25380 .inherits = &ata_sff_port_ops,
25381 .cable_detect = ata_cable_40wire,
25382 /* No altstatus so we don't want to use the lost interrupt poll */
25383diff -urNp linux-2.6.39.1/drivers/ata/pata_it8213.c linux-2.6.39.1/drivers/ata/pata_it8213.c
25384--- linux-2.6.39.1/drivers/ata/pata_it8213.c 2011-05-19 00:06:34.000000000 -0400
25385+++ linux-2.6.39.1/drivers/ata/pata_it8213.c 2011-05-22 19:36:31.000000000 -0400
25386@@ -233,7 +233,7 @@ static struct scsi_host_template it8213_
25387 };
25388
25389
25390-static struct ata_port_operations it8213_ops = {
25391+static const struct ata_port_operations it8213_ops = {
25392 .inherits = &ata_bmdma_port_ops,
25393 .cable_detect = it8213_cable_detect,
25394 .set_piomode = it8213_set_piomode,
25395diff -urNp linux-2.6.39.1/drivers/ata/pata_it821x.c linux-2.6.39.1/drivers/ata/pata_it821x.c
25396--- linux-2.6.39.1/drivers/ata/pata_it821x.c 2011-05-19 00:06:34.000000000 -0400
25397+++ linux-2.6.39.1/drivers/ata/pata_it821x.c 2011-05-22 19:36:31.000000000 -0400
25398@@ -801,7 +801,7 @@ static struct scsi_host_template it821x_
25399 ATA_BMDMA_SHT(DRV_NAME),
25400 };
25401
25402-static struct ata_port_operations it821x_smart_port_ops = {
25403+static const struct ata_port_operations it821x_smart_port_ops = {
25404 .inherits = &ata_bmdma_port_ops,
25405
25406 .check_atapi_dma= it821x_check_atapi_dma,
25407@@ -815,7 +815,7 @@ static struct ata_port_operations it821x
25408 .port_start = it821x_port_start,
25409 };
25410
25411-static struct ata_port_operations it821x_passthru_port_ops = {
25412+static const struct ata_port_operations it821x_passthru_port_ops = {
25413 .inherits = &ata_bmdma_port_ops,
25414
25415 .check_atapi_dma= it821x_check_atapi_dma,
25416@@ -831,7 +831,7 @@ static struct ata_port_operations it821x
25417 .port_start = it821x_port_start,
25418 };
25419
25420-static struct ata_port_operations it821x_rdc_port_ops = {
25421+static const struct ata_port_operations it821x_rdc_port_ops = {
25422 .inherits = &ata_bmdma_port_ops,
25423
25424 .check_atapi_dma= it821x_check_atapi_dma,
25425diff -urNp linux-2.6.39.1/drivers/ata/pata_ixp4xx_cf.c linux-2.6.39.1/drivers/ata/pata_ixp4xx_cf.c
25426--- linux-2.6.39.1/drivers/ata/pata_ixp4xx_cf.c 2011-05-19 00:06:34.000000000 -0400
25427+++ linux-2.6.39.1/drivers/ata/pata_ixp4xx_cf.c 2011-05-22 19:36:31.000000000 -0400
25428@@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
25429 ATA_PIO_SHT(DRV_NAME),
25430 };
25431
25432-static struct ata_port_operations ixp4xx_port_ops = {
25433+static const struct ata_port_operations ixp4xx_port_ops = {
25434 .inherits = &ata_sff_port_ops,
25435 .sff_data_xfer = ixp4xx_mmio_data_xfer,
25436 .cable_detect = ata_cable_40wire,
25437diff -urNp linux-2.6.39.1/drivers/ata/pata_jmicron.c linux-2.6.39.1/drivers/ata/pata_jmicron.c
25438--- linux-2.6.39.1/drivers/ata/pata_jmicron.c 2011-05-19 00:06:34.000000000 -0400
25439+++ linux-2.6.39.1/drivers/ata/pata_jmicron.c 2011-05-22 19:36:31.000000000 -0400
25440@@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
25441 ATA_BMDMA_SHT(DRV_NAME),
25442 };
25443
25444-static struct ata_port_operations jmicron_ops = {
25445+static const struct ata_port_operations jmicron_ops = {
25446 .inherits = &ata_bmdma_port_ops,
25447 .prereset = jmicron_pre_reset,
25448 };
25449diff -urNp linux-2.6.39.1/drivers/ata/pata_legacy.c linux-2.6.39.1/drivers/ata/pata_legacy.c
25450--- linux-2.6.39.1/drivers/ata/pata_legacy.c 2011-05-19 00:06:34.000000000 -0400
25451+++ linux-2.6.39.1/drivers/ata/pata_legacy.c 2011-05-22 19:36:31.000000000 -0400
25452@@ -116,7 +116,7 @@ struct legacy_probe {
25453
25454 struct legacy_controller {
25455 const char *name;
25456- struct ata_port_operations *ops;
25457+ const struct ata_port_operations *ops;
25458 unsigned int pio_mask;
25459 unsigned int flags;
25460 unsigned int pflags;
25461@@ -239,12 +239,12 @@ static const struct ata_port_operations
25462 * pio_mask as well.
25463 */
25464
25465-static struct ata_port_operations simple_port_ops = {
25466+static const struct ata_port_operations simple_port_ops = {
25467 .inherits = &legacy_base_port_ops,
25468 .sff_data_xfer = ata_sff_data_xfer_noirq,
25469 };
25470
25471-static struct ata_port_operations legacy_port_ops = {
25472+static const struct ata_port_operations legacy_port_ops = {
25473 .inherits = &legacy_base_port_ops,
25474 .sff_data_xfer = ata_sff_data_xfer_noirq,
25475 .set_mode = legacy_set_mode,
25476@@ -340,7 +340,7 @@ static unsigned int pdc_data_xfer_vlb(st
25477 return buflen;
25478 }
25479
25480-static struct ata_port_operations pdc20230_port_ops = {
25481+static const struct ata_port_operations pdc20230_port_ops = {
25482 .inherits = &legacy_base_port_ops,
25483 .set_piomode = pdc20230_set_piomode,
25484 .sff_data_xfer = pdc_data_xfer_vlb,
25485@@ -373,7 +373,7 @@ static void ht6560a_set_piomode(struct a
25486 ioread8(ap->ioaddr.status_addr);
25487 }
25488
25489-static struct ata_port_operations ht6560a_port_ops = {
25490+static const struct ata_port_operations ht6560a_port_ops = {
25491 .inherits = &legacy_base_port_ops,
25492 .set_piomode = ht6560a_set_piomode,
25493 };
25494@@ -416,7 +416,7 @@ static void ht6560b_set_piomode(struct a
25495 ioread8(ap->ioaddr.status_addr);
25496 }
25497
25498-static struct ata_port_operations ht6560b_port_ops = {
25499+static const struct ata_port_operations ht6560b_port_ops = {
25500 .inherits = &legacy_base_port_ops,
25501 .set_piomode = ht6560b_set_piomode,
25502 };
25503@@ -515,7 +515,7 @@ static void opti82c611a_set_piomode(stru
25504 }
25505
25506
25507-static struct ata_port_operations opti82c611a_port_ops = {
25508+static const struct ata_port_operations opti82c611a_port_ops = {
25509 .inherits = &legacy_base_port_ops,
25510 .set_piomode = opti82c611a_set_piomode,
25511 };
25512@@ -625,7 +625,7 @@ static unsigned int opti82c46x_qc_issue(
25513 return ata_sff_qc_issue(qc);
25514 }
25515
25516-static struct ata_port_operations opti82c46x_port_ops = {
25517+static const struct ata_port_operations opti82c46x_port_ops = {
25518 .inherits = &legacy_base_port_ops,
25519 .set_piomode = opti82c46x_set_piomode,
25520 .qc_issue = opti82c46x_qc_issue,
25521@@ -787,20 +787,20 @@ static int qdi_port(struct platform_devi
25522 return 0;
25523 }
25524
25525-static struct ata_port_operations qdi6500_port_ops = {
25526+static const struct ata_port_operations qdi6500_port_ops = {
25527 .inherits = &legacy_base_port_ops,
25528 .set_piomode = qdi6500_set_piomode,
25529 .qc_issue = qdi_qc_issue,
25530 .sff_data_xfer = vlb32_data_xfer,
25531 };
25532
25533-static struct ata_port_operations qdi6580_port_ops = {
25534+static const struct ata_port_operations qdi6580_port_ops = {
25535 .inherits = &legacy_base_port_ops,
25536 .set_piomode = qdi6580_set_piomode,
25537 .sff_data_xfer = vlb32_data_xfer,
25538 };
25539
25540-static struct ata_port_operations qdi6580dp_port_ops = {
25541+static const struct ata_port_operations qdi6580dp_port_ops = {
25542 .inherits = &legacy_base_port_ops,
25543 .set_piomode = qdi6580dp_set_piomode,
25544 .qc_issue = qdi_qc_issue,
25545@@ -872,7 +872,7 @@ static int winbond_port(struct platform_
25546 return 0;
25547 }
25548
25549-static struct ata_port_operations winbond_port_ops = {
25550+static const struct ata_port_operations winbond_port_ops = {
25551 .inherits = &legacy_base_port_ops,
25552 .set_piomode = winbond_set_piomode,
25553 .sff_data_xfer = vlb32_data_xfer,
25554@@ -995,7 +995,7 @@ static __init int legacy_init_one(struct
25555 int pio_modes = controller->pio_mask;
25556 unsigned long io = probe->port;
25557 u32 mask = (1 << probe->slot);
25558- struct ata_port_operations *ops = controller->ops;
25559+ const struct ata_port_operations *ops = controller->ops;
25560 struct legacy_data *ld = &legacy_data[probe->slot];
25561 struct ata_host *host = NULL;
25562 struct ata_port *ap;
25563diff -urNp linux-2.6.39.1/drivers/ata/pata_macio.c linux-2.6.39.1/drivers/ata/pata_macio.c
25564--- linux-2.6.39.1/drivers/ata/pata_macio.c 2011-05-19 00:06:34.000000000 -0400
25565+++ linux-2.6.39.1/drivers/ata/pata_macio.c 2011-05-22 19:36:31.000000000 -0400
25566@@ -918,9 +918,8 @@ static struct scsi_host_template pata_ma
25567 .slave_configure = pata_macio_slave_config,
25568 };
25569
25570-static struct ata_port_operations pata_macio_ops = {
25571+static const struct ata_port_operations pata_macio_ops = {
25572 .inherits = &ata_bmdma_port_ops,
25573-
25574 .freeze = pata_macio_freeze,
25575 .set_piomode = pata_macio_set_timings,
25576 .set_dmamode = pata_macio_set_timings,
25577diff -urNp linux-2.6.39.1/drivers/ata/pata_marvell.c linux-2.6.39.1/drivers/ata/pata_marvell.c
25578--- linux-2.6.39.1/drivers/ata/pata_marvell.c 2011-05-19 00:06:34.000000000 -0400
25579+++ linux-2.6.39.1/drivers/ata/pata_marvell.c 2011-05-22 19:36:31.000000000 -0400
25580@@ -100,7 +100,7 @@ static struct scsi_host_template marvell
25581 ATA_BMDMA_SHT(DRV_NAME),
25582 };
25583
25584-static struct ata_port_operations marvell_ops = {
25585+static const struct ata_port_operations marvell_ops = {
25586 .inherits = &ata_bmdma_port_ops,
25587 .cable_detect = marvell_cable_detect,
25588 .prereset = marvell_pre_reset,
25589diff -urNp linux-2.6.39.1/drivers/ata/pata_mpc52xx.c linux-2.6.39.1/drivers/ata/pata_mpc52xx.c
25590--- linux-2.6.39.1/drivers/ata/pata_mpc52xx.c 2011-05-19 00:06:34.000000000 -0400
25591+++ linux-2.6.39.1/drivers/ata/pata_mpc52xx.c 2011-05-22 19:36:31.000000000 -0400
25592@@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
25593 ATA_PIO_SHT(DRV_NAME),
25594 };
25595
25596-static struct ata_port_operations mpc52xx_ata_port_ops = {
25597+static const struct ata_port_operations mpc52xx_ata_port_ops = {
25598 .inherits = &ata_bmdma_port_ops,
25599 .sff_dev_select = mpc52xx_ata_dev_select,
25600 .set_piomode = mpc52xx_ata_set_piomode,
25601diff -urNp linux-2.6.39.1/drivers/ata/pata_mpiix.c linux-2.6.39.1/drivers/ata/pata_mpiix.c
25602--- linux-2.6.39.1/drivers/ata/pata_mpiix.c 2011-05-19 00:06:34.000000000 -0400
25603+++ linux-2.6.39.1/drivers/ata/pata_mpiix.c 2011-05-22 19:36:31.000000000 -0400
25604@@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
25605 ATA_PIO_SHT(DRV_NAME),
25606 };
25607
25608-static struct ata_port_operations mpiix_port_ops = {
25609+static const struct ata_port_operations mpiix_port_ops = {
25610 .inherits = &ata_sff_port_ops,
25611 .qc_issue = mpiix_qc_issue,
25612 .cable_detect = ata_cable_40wire,
25613diff -urNp linux-2.6.39.1/drivers/ata/pata_netcell.c linux-2.6.39.1/drivers/ata/pata_netcell.c
25614--- linux-2.6.39.1/drivers/ata/pata_netcell.c 2011-05-19 00:06:34.000000000 -0400
25615+++ linux-2.6.39.1/drivers/ata/pata_netcell.c 2011-05-22 19:36:31.000000000 -0400
25616@@ -34,7 +34,7 @@ static struct scsi_host_template netcell
25617 ATA_BMDMA_SHT(DRV_NAME),
25618 };
25619
25620-static struct ata_port_operations netcell_ops = {
25621+static const struct ata_port_operations netcell_ops = {
25622 .inherits = &ata_bmdma_port_ops,
25623 .cable_detect = ata_cable_80wire,
25624 .read_id = netcell_read_id,
25625diff -urNp linux-2.6.39.1/drivers/ata/pata_ninja32.c linux-2.6.39.1/drivers/ata/pata_ninja32.c
25626--- linux-2.6.39.1/drivers/ata/pata_ninja32.c 2011-05-19 00:06:34.000000000 -0400
25627+++ linux-2.6.39.1/drivers/ata/pata_ninja32.c 2011-05-22 19:36:31.000000000 -0400
25628@@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
25629 ATA_BMDMA_SHT(DRV_NAME),
25630 };
25631
25632-static struct ata_port_operations ninja32_port_ops = {
25633+static const struct ata_port_operations ninja32_port_ops = {
25634 .inherits = &ata_bmdma_port_ops,
25635 .sff_dev_select = ninja32_dev_select,
25636 .cable_detect = ata_cable_40wire,
25637diff -urNp linux-2.6.39.1/drivers/ata/pata_ns87410.c linux-2.6.39.1/drivers/ata/pata_ns87410.c
25638--- linux-2.6.39.1/drivers/ata/pata_ns87410.c 2011-05-19 00:06:34.000000000 -0400
25639+++ linux-2.6.39.1/drivers/ata/pata_ns87410.c 2011-05-22 19:36:31.000000000 -0400
25640@@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
25641 ATA_PIO_SHT(DRV_NAME),
25642 };
25643
25644-static struct ata_port_operations ns87410_port_ops = {
25645+static const struct ata_port_operations ns87410_port_ops = {
25646 .inherits = &ata_sff_port_ops,
25647 .qc_issue = ns87410_qc_issue,
25648 .cable_detect = ata_cable_40wire,
25649diff -urNp linux-2.6.39.1/drivers/ata/pata_ns87415.c linux-2.6.39.1/drivers/ata/pata_ns87415.c
25650--- linux-2.6.39.1/drivers/ata/pata_ns87415.c 2011-05-19 00:06:34.000000000 -0400
25651+++ linux-2.6.39.1/drivers/ata/pata_ns87415.c 2011-05-22 19:36:31.000000000 -0400
25652@@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
25653 }
25654 #endif /* 87560 SuperIO Support */
25655
25656-static struct ata_port_operations ns87415_pata_ops = {
25657+static const struct ata_port_operations ns87415_pata_ops = {
25658 .inherits = &ata_bmdma_port_ops,
25659
25660 .check_atapi_dma = ns87415_check_atapi_dma,
25661@@ -313,7 +313,7 @@ static struct ata_port_operations ns8741
25662 };
25663
25664 #if defined(CONFIG_SUPERIO)
25665-static struct ata_port_operations ns87560_pata_ops = {
25666+static const struct ata_port_operations ns87560_pata_ops = {
25667 .inherits = &ns87415_pata_ops,
25668 .sff_tf_read = ns87560_tf_read,
25669 .sff_check_status = ns87560_check_status,
25670diff -urNp linux-2.6.39.1/drivers/ata/pata_octeon_cf.c linux-2.6.39.1/drivers/ata/pata_octeon_cf.c
25671--- linux-2.6.39.1/drivers/ata/pata_octeon_cf.c 2011-05-19 00:06:34.000000000 -0400
25672+++ linux-2.6.39.1/drivers/ata/pata_octeon_cf.c 2011-05-22 19:36:31.000000000 -0400
25673@@ -780,7 +780,7 @@ static unsigned int octeon_cf_qc_issue(s
25674 return 0;
25675 }
25676
25677-static struct ata_port_operations octeon_cf_ops = {
25678+static struct ata_port_operations octeon_cf_ops = { /* cannot be const */
25679 .inherits = &ata_sff_port_ops,
25680 .check_atapi_dma = octeon_cf_check_atapi_dma,
25681 .qc_prep = ata_noop_qc_prep,
25682diff -urNp linux-2.6.39.1/drivers/ata/pata_oldpiix.c linux-2.6.39.1/drivers/ata/pata_oldpiix.c
25683--- linux-2.6.39.1/drivers/ata/pata_oldpiix.c 2011-05-19 00:06:34.000000000 -0400
25684+++ linux-2.6.39.1/drivers/ata/pata_oldpiix.c 2011-05-22 19:36:31.000000000 -0400
25685@@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
25686 ATA_BMDMA_SHT(DRV_NAME),
25687 };
25688
25689-static struct ata_port_operations oldpiix_pata_ops = {
25690+static const struct ata_port_operations oldpiix_pata_ops = {
25691 .inherits = &ata_bmdma_port_ops,
25692 .qc_issue = oldpiix_qc_issue,
25693 .cable_detect = ata_cable_40wire,
25694diff -urNp linux-2.6.39.1/drivers/ata/pata_opti.c linux-2.6.39.1/drivers/ata/pata_opti.c
25695--- linux-2.6.39.1/drivers/ata/pata_opti.c 2011-05-19 00:06:34.000000000 -0400
25696+++ linux-2.6.39.1/drivers/ata/pata_opti.c 2011-05-22 19:36:31.000000000 -0400
25697@@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
25698 ATA_PIO_SHT(DRV_NAME),
25699 };
25700
25701-static struct ata_port_operations opti_port_ops = {
25702+static const struct ata_port_operations opti_port_ops = {
25703 .inherits = &ata_sff_port_ops,
25704 .cable_detect = ata_cable_40wire,
25705 .set_piomode = opti_set_piomode,
25706diff -urNp linux-2.6.39.1/drivers/ata/pata_optidma.c linux-2.6.39.1/drivers/ata/pata_optidma.c
25707--- linux-2.6.39.1/drivers/ata/pata_optidma.c 2011-05-19 00:06:34.000000000 -0400
25708+++ linux-2.6.39.1/drivers/ata/pata_optidma.c 2011-05-22 19:36:31.000000000 -0400
25709@@ -337,7 +337,7 @@ static struct scsi_host_template optidma
25710 ATA_BMDMA_SHT(DRV_NAME),
25711 };
25712
25713-static struct ata_port_operations optidma_port_ops = {
25714+static const struct ata_port_operations optidma_port_ops = {
25715 .inherits = &ata_bmdma_port_ops,
25716 .cable_detect = ata_cable_40wire,
25717 .set_piomode = optidma_set_pio_mode,
25718@@ -346,7 +346,7 @@ static struct ata_port_operations optidm
25719 .prereset = optidma_pre_reset,
25720 };
25721
25722-static struct ata_port_operations optiplus_port_ops = {
25723+static const struct ata_port_operations optiplus_port_ops = {
25724 .inherits = &optidma_port_ops,
25725 .set_piomode = optiplus_set_pio_mode,
25726 .set_dmamode = optiplus_set_dma_mode,
25727diff -urNp linux-2.6.39.1/drivers/ata/pata_palmld.c linux-2.6.39.1/drivers/ata/pata_palmld.c
25728--- linux-2.6.39.1/drivers/ata/pata_palmld.c 2011-05-19 00:06:34.000000000 -0400
25729+++ linux-2.6.39.1/drivers/ata/pata_palmld.c 2011-05-22 19:36:31.000000000 -0400
25730@@ -42,7 +42,7 @@ static struct scsi_host_template palmld_
25731 ATA_PIO_SHT(DRV_NAME),
25732 };
25733
25734-static struct ata_port_operations palmld_port_ops = {
25735+static const struct ata_port_operations palmld_port_ops = {
25736 .inherits = &ata_sff_port_ops,
25737 .sff_data_xfer = ata_sff_data_xfer_noirq,
25738 .cable_detect = ata_cable_40wire,
25739diff -urNp linux-2.6.39.1/drivers/ata/pata_pcmcia.c linux-2.6.39.1/drivers/ata/pata_pcmcia.c
25740--- linux-2.6.39.1/drivers/ata/pata_pcmcia.c 2011-05-19 00:06:34.000000000 -0400
25741+++ linux-2.6.39.1/drivers/ata/pata_pcmcia.c 2011-05-22 19:36:31.000000000 -0400
25742@@ -151,14 +151,14 @@ static struct scsi_host_template pcmcia_
25743 ATA_PIO_SHT(DRV_NAME),
25744 };
25745
25746-static struct ata_port_operations pcmcia_port_ops = {
25747+static const struct ata_port_operations pcmcia_port_ops = {
25748 .inherits = &ata_sff_port_ops,
25749 .sff_data_xfer = ata_sff_data_xfer_noirq,
25750 .cable_detect = ata_cable_40wire,
25751 .set_mode = pcmcia_set_mode,
25752 };
25753
25754-static struct ata_port_operations pcmcia_8bit_port_ops = {
25755+static const struct ata_port_operations pcmcia_8bit_port_ops = {
25756 .inherits = &ata_sff_port_ops,
25757 .sff_data_xfer = ata_data_xfer_8bit,
25758 .cable_detect = ata_cable_40wire,
25759@@ -205,7 +205,7 @@ static int pcmcia_init_one(struct pcmcia
25760 unsigned long io_base, ctl_base;
25761 void __iomem *io_addr, *ctl_addr;
25762 int n_ports = 1;
25763- struct ata_port_operations *ops = &pcmcia_port_ops;
25764+ const struct ata_port_operations *ops = &pcmcia_port_ops;
25765
25766 /* Set up attributes in order to probe card and get resources */
25767 pdev->config_flags |= CONF_ENABLE_IRQ | CONF_AUTO_SET_IO |
25768diff -urNp linux-2.6.39.1/drivers/ata/pata_pdc2027x.c linux-2.6.39.1/drivers/ata/pata_pdc2027x.c
25769--- linux-2.6.39.1/drivers/ata/pata_pdc2027x.c 2011-05-19 00:06:34.000000000 -0400
25770+++ linux-2.6.39.1/drivers/ata/pata_pdc2027x.c 2011-05-22 19:36:31.000000000 -0400
25771@@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
25772 ATA_BMDMA_SHT(DRV_NAME),
25773 };
25774
25775-static struct ata_port_operations pdc2027x_pata100_ops = {
25776+static const struct ata_port_operations pdc2027x_pata100_ops = {
25777 .inherits = &ata_bmdma_port_ops,
25778 .check_atapi_dma = pdc2027x_check_atapi_dma,
25779 .cable_detect = pdc2027x_cable_detect,
25780 .prereset = pdc2027x_prereset,
25781 };
25782
25783-static struct ata_port_operations pdc2027x_pata133_ops = {
25784+static const struct ata_port_operations pdc2027x_pata133_ops = {
25785 .inherits = &pdc2027x_pata100_ops,
25786 .mode_filter = pdc2027x_mode_filter,
25787 .set_piomode = pdc2027x_set_piomode,
25788diff -urNp linux-2.6.39.1/drivers/ata/pata_pdc202xx_old.c linux-2.6.39.1/drivers/ata/pata_pdc202xx_old.c
25789--- linux-2.6.39.1/drivers/ata/pata_pdc202xx_old.c 2011-05-19 00:06:34.000000000 -0400
25790+++ linux-2.6.39.1/drivers/ata/pata_pdc202xx_old.c 2011-05-22 19:36:31.000000000 -0400
25791@@ -295,7 +295,7 @@ static struct scsi_host_template pdc202x
25792 ATA_BMDMA_SHT(DRV_NAME),
25793 };
25794
25795-static struct ata_port_operations pdc2024x_port_ops = {
25796+static const struct ata_port_operations pdc2024x_port_ops = {
25797 .inherits = &ata_bmdma_port_ops,
25798
25799 .cable_detect = ata_cable_40wire,
25800@@ -306,7 +306,7 @@ static struct ata_port_operations pdc202
25801 .sff_irq_check = pdc202xx_irq_check,
25802 };
25803
25804-static struct ata_port_operations pdc2026x_port_ops = {
25805+static const struct ata_port_operations pdc2026x_port_ops = {
25806 .inherits = &pdc2024x_port_ops,
25807
25808 .check_atapi_dma = pdc2026x_check_atapi_dma,
25809diff -urNp linux-2.6.39.1/drivers/ata/pata_piccolo.c linux-2.6.39.1/drivers/ata/pata_piccolo.c
25810--- linux-2.6.39.1/drivers/ata/pata_piccolo.c 2011-05-19 00:06:34.000000000 -0400
25811+++ linux-2.6.39.1/drivers/ata/pata_piccolo.c 2011-05-22 19:36:31.000000000 -0400
25812@@ -67,7 +67,7 @@ static struct scsi_host_template tosh_sh
25813 ATA_BMDMA_SHT(DRV_NAME),
25814 };
25815
25816-static struct ata_port_operations tosh_port_ops = {
25817+static const struct ata_port_operations tosh_port_ops = {
25818 .inherits = &ata_bmdma_port_ops,
25819 .cable_detect = ata_cable_unknown,
25820 .set_piomode = tosh_set_piomode,
25821diff -urNp linux-2.6.39.1/drivers/ata/pata_platform.c linux-2.6.39.1/drivers/ata/pata_platform.c
25822--- linux-2.6.39.1/drivers/ata/pata_platform.c 2011-05-19 00:06:34.000000000 -0400
25823+++ linux-2.6.39.1/drivers/ata/pata_platform.c 2011-05-22 19:36:31.000000000 -0400
25824@@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
25825 ATA_PIO_SHT(DRV_NAME),
25826 };
25827
25828-static struct ata_port_operations pata_platform_port_ops = {
25829+static const struct ata_port_operations pata_platform_port_ops = {
25830 .inherits = &ata_sff_port_ops,
25831 .sff_data_xfer = ata_sff_data_xfer_noirq,
25832 .cable_detect = ata_cable_unknown,
25833diff -urNp linux-2.6.39.1/drivers/ata/pata_pxa.c linux-2.6.39.1/drivers/ata/pata_pxa.c
25834--- linux-2.6.39.1/drivers/ata/pata_pxa.c 2011-05-19 00:06:34.000000000 -0400
25835+++ linux-2.6.39.1/drivers/ata/pata_pxa.c 2011-05-22 19:36:31.000000000 -0400
25836@@ -198,7 +198,7 @@ static struct scsi_host_template pxa_ata
25837 ATA_BMDMA_SHT(DRV_NAME),
25838 };
25839
25840-static struct ata_port_operations pxa_ata_port_ops = {
25841+static const struct ata_port_operations pxa_ata_port_ops = {
25842 .inherits = &ata_bmdma_port_ops,
25843 .cable_detect = ata_cable_40wire,
25844
25845diff -urNp linux-2.6.39.1/drivers/ata/pata_qdi.c linux-2.6.39.1/drivers/ata/pata_qdi.c
25846--- linux-2.6.39.1/drivers/ata/pata_qdi.c 2011-05-19 00:06:34.000000000 -0400
25847+++ linux-2.6.39.1/drivers/ata/pata_qdi.c 2011-05-22 19:36:31.000000000 -0400
25848@@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
25849 ATA_PIO_SHT(DRV_NAME),
25850 };
25851
25852-static struct ata_port_operations qdi6500_port_ops = {
25853+static const struct ata_port_operations qdi6500_port_ops = {
25854 .inherits = &ata_sff_port_ops,
25855 .qc_issue = qdi_qc_issue,
25856 .sff_data_xfer = qdi_data_xfer,
25857@@ -165,7 +165,7 @@ static struct ata_port_operations qdi650
25858 .set_piomode = qdi6500_set_piomode,
25859 };
25860
25861-static struct ata_port_operations qdi6580_port_ops = {
25862+static const struct ata_port_operations qdi6580_port_ops = {
25863 .inherits = &qdi6500_port_ops,
25864 .set_piomode = qdi6580_set_piomode,
25865 };
25866diff -urNp linux-2.6.39.1/drivers/ata/pata_radisys.c linux-2.6.39.1/drivers/ata/pata_radisys.c
25867--- linux-2.6.39.1/drivers/ata/pata_radisys.c 2011-05-19 00:06:34.000000000 -0400
25868+++ linux-2.6.39.1/drivers/ata/pata_radisys.c 2011-05-22 19:36:31.000000000 -0400
25869@@ -187,7 +187,7 @@ static struct scsi_host_template radisys
25870 ATA_BMDMA_SHT(DRV_NAME),
25871 };
25872
25873-static struct ata_port_operations radisys_pata_ops = {
25874+static const struct ata_port_operations radisys_pata_ops = {
25875 .inherits = &ata_bmdma_port_ops,
25876 .qc_issue = radisys_qc_issue,
25877 .cable_detect = ata_cable_unknown,
25878diff -urNp linux-2.6.39.1/drivers/ata/pata_rb532_cf.c linux-2.6.39.1/drivers/ata/pata_rb532_cf.c
25879--- linux-2.6.39.1/drivers/ata/pata_rb532_cf.c 2011-05-19 00:06:34.000000000 -0400
25880+++ linux-2.6.39.1/drivers/ata/pata_rb532_cf.c 2011-05-22 19:36:31.000000000 -0400
25881@@ -69,7 +69,7 @@ static irqreturn_t rb532_pata_irq_handle
25882 return IRQ_HANDLED;
25883 }
25884
25885-static struct ata_port_operations rb532_pata_port_ops = {
25886+static const struct ata_port_operations rb532_pata_port_ops = {
25887 .inherits = &ata_sff_port_ops,
25888 .sff_data_xfer = ata_sff_data_xfer32,
25889 };
25890diff -urNp linux-2.6.39.1/drivers/ata/pata_rdc.c linux-2.6.39.1/drivers/ata/pata_rdc.c
25891--- linux-2.6.39.1/drivers/ata/pata_rdc.c 2011-05-19 00:06:34.000000000 -0400
25892+++ linux-2.6.39.1/drivers/ata/pata_rdc.c 2011-05-22 19:36:31.000000000 -0400
25893@@ -273,7 +273,7 @@ static void rdc_set_dmamode(struct ata_p
25894 pci_write_config_byte(dev, 0x48, udma_enable);
25895 }
25896
25897-static struct ata_port_operations rdc_pata_ops = {
25898+static const struct ata_port_operations rdc_pata_ops = {
25899 .inherits = &ata_bmdma32_port_ops,
25900 .cable_detect = rdc_pata_cable_detect,
25901 .set_piomode = rdc_set_piomode,
25902diff -urNp linux-2.6.39.1/drivers/ata/pata_rz1000.c linux-2.6.39.1/drivers/ata/pata_rz1000.c
25903--- linux-2.6.39.1/drivers/ata/pata_rz1000.c 2011-05-19 00:06:34.000000000 -0400
25904+++ linux-2.6.39.1/drivers/ata/pata_rz1000.c 2011-05-22 19:36:31.000000000 -0400
25905@@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
25906 ATA_PIO_SHT(DRV_NAME),
25907 };
25908
25909-static struct ata_port_operations rz1000_port_ops = {
25910+static const struct ata_port_operations rz1000_port_ops = {
25911 .inherits = &ata_sff_port_ops,
25912 .cable_detect = ata_cable_40wire,
25913 .set_mode = rz1000_set_mode,
25914diff -urNp linux-2.6.39.1/drivers/ata/pata_samsung_cf.c linux-2.6.39.1/drivers/ata/pata_samsung_cf.c
25915--- linux-2.6.39.1/drivers/ata/pata_samsung_cf.c 2011-05-19 00:06:34.000000000 -0400
25916+++ linux-2.6.39.1/drivers/ata/pata_samsung_cf.c 2011-05-22 19:36:31.000000000 -0400
25917@@ -399,7 +399,7 @@ static struct scsi_host_template pata_s3
25918 ATA_PIO_SHT(DRV_NAME),
25919 };
25920
25921-static struct ata_port_operations pata_s3c_port_ops = {
25922+static const struct ata_port_operations pata_s3c_port_ops = {
25923 .inherits = &ata_sff_port_ops,
25924 .sff_check_status = pata_s3c_check_status,
25925 .sff_check_altstatus = pata_s3c_check_altstatus,
25926@@ -413,7 +413,7 @@ static struct ata_port_operations pata_s
25927 .set_piomode = pata_s3c_set_piomode,
25928 };
25929
25930-static struct ata_port_operations pata_s5p_port_ops = {
25931+static const struct ata_port_operations pata_s5p_port_ops = {
25932 .inherits = &ata_sff_port_ops,
25933 .set_piomode = pata_s3c_set_piomode,
25934 };
25935diff -urNp linux-2.6.39.1/drivers/ata/pata_sc1200.c linux-2.6.39.1/drivers/ata/pata_sc1200.c
25936--- linux-2.6.39.1/drivers/ata/pata_sc1200.c 2011-05-19 00:06:34.000000000 -0400
25937+++ linux-2.6.39.1/drivers/ata/pata_sc1200.c 2011-05-22 19:36:31.000000000 -0400
25938@@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
25939 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25940 };
25941
25942-static struct ata_port_operations sc1200_port_ops = {
25943+static const struct ata_port_operations sc1200_port_ops = {
25944 .inherits = &ata_bmdma_port_ops,
25945 .qc_prep = ata_bmdma_dumb_qc_prep,
25946 .qc_issue = sc1200_qc_issue,
25947diff -urNp linux-2.6.39.1/drivers/ata/pata_scc.c linux-2.6.39.1/drivers/ata/pata_scc.c
25948--- linux-2.6.39.1/drivers/ata/pata_scc.c 2011-05-19 00:06:34.000000000 -0400
25949+++ linux-2.6.39.1/drivers/ata/pata_scc.c 2011-05-22 19:36:31.000000000 -0400
25950@@ -926,7 +926,7 @@ static struct scsi_host_template scc_sht
25951 ATA_BMDMA_SHT(DRV_NAME),
25952 };
25953
25954-static struct ata_port_operations scc_pata_ops = {
25955+static const struct ata_port_operations scc_pata_ops = {
25956 .inherits = &ata_bmdma_port_ops,
25957
25958 .set_piomode = scc_set_piomode,
25959diff -urNp linux-2.6.39.1/drivers/ata/pata_sch.c linux-2.6.39.1/drivers/ata/pata_sch.c
25960--- linux-2.6.39.1/drivers/ata/pata_sch.c 2011-05-19 00:06:34.000000000 -0400
25961+++ linux-2.6.39.1/drivers/ata/pata_sch.c 2011-05-22 19:36:31.000000000 -0400
25962@@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
25963 ATA_BMDMA_SHT(DRV_NAME),
25964 };
25965
25966-static struct ata_port_operations sch_pata_ops = {
25967+static const struct ata_port_operations sch_pata_ops = {
25968 .inherits = &ata_bmdma_port_ops,
25969 .cable_detect = ata_cable_unknown,
25970 .set_piomode = sch_set_piomode,
25971diff -urNp linux-2.6.39.1/drivers/ata/pata_serverworks.c linux-2.6.39.1/drivers/ata/pata_serverworks.c
25972--- linux-2.6.39.1/drivers/ata/pata_serverworks.c 2011-05-19 00:06:34.000000000 -0400
25973+++ linux-2.6.39.1/drivers/ata/pata_serverworks.c 2011-05-22 19:36:31.000000000 -0400
25974@@ -300,7 +300,7 @@ static struct scsi_host_template serverw
25975 ATA_BMDMA_SHT(DRV_NAME),
25976 };
25977
25978-static struct ata_port_operations serverworks_osb4_port_ops = {
25979+static const struct ata_port_operations serverworks_osb4_port_ops = {
25980 .inherits = &ata_bmdma_port_ops,
25981 .cable_detect = serverworks_cable_detect,
25982 .mode_filter = serverworks_osb4_filter,
25983@@ -308,7 +308,7 @@ static struct ata_port_operations server
25984 .set_dmamode = serverworks_set_dmamode,
25985 };
25986
25987-static struct ata_port_operations serverworks_csb_port_ops = {
25988+static const struct ata_port_operations serverworks_csb_port_ops = {
25989 .inherits = &serverworks_osb4_port_ops,
25990 .mode_filter = serverworks_csb_filter,
25991 };
25992diff -urNp linux-2.6.39.1/drivers/ata/pata_sil680.c linux-2.6.39.1/drivers/ata/pata_sil680.c
25993--- linux-2.6.39.1/drivers/ata/pata_sil680.c 2011-05-19 00:06:34.000000000 -0400
25994+++ linux-2.6.39.1/drivers/ata/pata_sil680.c 2011-05-22 19:36:31.000000000 -0400
25995@@ -225,8 +225,7 @@ static struct scsi_host_template sil680_
25996 ATA_BMDMA_SHT(DRV_NAME),
25997 };
25998
25999-
26000-static struct ata_port_operations sil680_port_ops = {
26001+static const struct ata_port_operations sil680_port_ops = {
26002 .inherits = &ata_bmdma32_port_ops,
26003 .sff_exec_command = sil680_sff_exec_command,
26004 .sff_irq_check = sil680_sff_irq_check,
26005diff -urNp linux-2.6.39.1/drivers/ata/pata_sis.c linux-2.6.39.1/drivers/ata/pata_sis.c
26006--- linux-2.6.39.1/drivers/ata/pata_sis.c 2011-05-19 00:06:34.000000000 -0400
26007+++ linux-2.6.39.1/drivers/ata/pata_sis.c 2011-05-22 19:36:31.000000000 -0400
26008@@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
26009 ATA_BMDMA_SHT(DRV_NAME),
26010 };
26011
26012-static struct ata_port_operations sis_133_for_sata_ops = {
26013+static const struct ata_port_operations sis_133_for_sata_ops = {
26014 .inherits = &ata_bmdma_port_ops,
26015 .set_piomode = sis_133_set_piomode,
26016 .set_dmamode = sis_133_set_dmamode,
26017 .cable_detect = sis_133_cable_detect,
26018 };
26019
26020-static struct ata_port_operations sis_base_ops = {
26021+static const struct ata_port_operations sis_base_ops = {
26022 .inherits = &ata_bmdma_port_ops,
26023 .prereset = sis_pre_reset,
26024 };
26025
26026-static struct ata_port_operations sis_133_ops = {
26027+static const struct ata_port_operations sis_133_ops = {
26028 .inherits = &sis_base_ops,
26029 .set_piomode = sis_133_set_piomode,
26030 .set_dmamode = sis_133_set_dmamode,
26031 .cable_detect = sis_133_cable_detect,
26032 };
26033
26034-static struct ata_port_operations sis_133_early_ops = {
26035+static const struct ata_port_operations sis_133_early_ops = {
26036 .inherits = &sis_base_ops,
26037 .set_piomode = sis_100_set_piomode,
26038 .set_dmamode = sis_133_early_set_dmamode,
26039 .cable_detect = sis_66_cable_detect,
26040 };
26041
26042-static struct ata_port_operations sis_100_ops = {
26043+static const struct ata_port_operations sis_100_ops = {
26044 .inherits = &sis_base_ops,
26045 .set_piomode = sis_100_set_piomode,
26046 .set_dmamode = sis_100_set_dmamode,
26047 .cable_detect = sis_66_cable_detect,
26048 };
26049
26050-static struct ata_port_operations sis_66_ops = {
26051+static const struct ata_port_operations sis_66_ops = {
26052 .inherits = &sis_base_ops,
26053 .set_piomode = sis_old_set_piomode,
26054 .set_dmamode = sis_66_set_dmamode,
26055 .cable_detect = sis_66_cable_detect,
26056 };
26057
26058-static struct ata_port_operations sis_old_ops = {
26059+static const struct ata_port_operations sis_old_ops = {
26060 .inherits = &sis_base_ops,
26061 .set_piomode = sis_old_set_piomode,
26062 .set_dmamode = sis_old_set_dmamode,
26063diff -urNp linux-2.6.39.1/drivers/ata/pata_sl82c105.c linux-2.6.39.1/drivers/ata/pata_sl82c105.c
26064--- linux-2.6.39.1/drivers/ata/pata_sl82c105.c 2011-05-19 00:06:34.000000000 -0400
26065+++ linux-2.6.39.1/drivers/ata/pata_sl82c105.c 2011-05-22 19:36:31.000000000 -0400
26066@@ -241,7 +241,7 @@ static struct scsi_host_template sl82c10
26067 ATA_BMDMA_SHT(DRV_NAME),
26068 };
26069
26070-static struct ata_port_operations sl82c105_port_ops = {
26071+static const struct ata_port_operations sl82c105_port_ops = {
26072 .inherits = &ata_bmdma_port_ops,
26073 .qc_defer = sl82c105_qc_defer,
26074 .bmdma_start = sl82c105_bmdma_start,
26075diff -urNp linux-2.6.39.1/drivers/ata/pata_triflex.c linux-2.6.39.1/drivers/ata/pata_triflex.c
26076--- linux-2.6.39.1/drivers/ata/pata_triflex.c 2011-05-19 00:06:34.000000000 -0400
26077+++ linux-2.6.39.1/drivers/ata/pata_triflex.c 2011-05-22 19:36:31.000000000 -0400
26078@@ -178,7 +178,7 @@ static struct scsi_host_template triflex
26079 ATA_BMDMA_SHT(DRV_NAME),
26080 };
26081
26082-static struct ata_port_operations triflex_port_ops = {
26083+static const struct ata_port_operations triflex_port_ops = {
26084 .inherits = &ata_bmdma_port_ops,
26085 .bmdma_start = triflex_bmdma_start,
26086 .bmdma_stop = triflex_bmdma_stop,
26087diff -urNp linux-2.6.39.1/drivers/ata/pata_via.c linux-2.6.39.1/drivers/ata/pata_via.c
26088--- linux-2.6.39.1/drivers/ata/pata_via.c 2011-05-19 00:06:34.000000000 -0400
26089+++ linux-2.6.39.1/drivers/ata/pata_via.c 2011-05-22 19:36:31.000000000 -0400
26090@@ -441,7 +441,7 @@ static struct scsi_host_template via_sht
26091 ATA_BMDMA_SHT(DRV_NAME),
26092 };
26093
26094-static struct ata_port_operations via_port_ops = {
26095+static const struct ata_port_operations via_port_ops = {
26096 .inherits = &ata_bmdma_port_ops,
26097 .cable_detect = via_cable_detect,
26098 .set_piomode = via_set_piomode,
26099@@ -452,7 +452,7 @@ static struct ata_port_operations via_po
26100 .mode_filter = via_mode_filter,
26101 };
26102
26103-static struct ata_port_operations via_port_ops_noirq = {
26104+static const struct ata_port_operations via_port_ops_noirq = {
26105 .inherits = &via_port_ops,
26106 .sff_data_xfer = ata_sff_data_xfer_noirq,
26107 };
26108diff -urNp linux-2.6.39.1/drivers/ata/pdc_adma.c linux-2.6.39.1/drivers/ata/pdc_adma.c
26109--- linux-2.6.39.1/drivers/ata/pdc_adma.c 2011-05-19 00:06:34.000000000 -0400
26110+++ linux-2.6.39.1/drivers/ata/pdc_adma.c 2011-05-22 19:36:31.000000000 -0400
26111@@ -146,7 +146,7 @@ static struct scsi_host_template adma_at
26112 .dma_boundary = ADMA_DMA_BOUNDARY,
26113 };
26114
26115-static struct ata_port_operations adma_ata_ops = {
26116+static const struct ata_port_operations adma_ata_ops = {
26117 .inherits = &ata_sff_port_ops,
26118
26119 .lost_interrupt = ATA_OP_NULL,
26120diff -urNp linux-2.6.39.1/drivers/ata/sata_dwc_460ex.c linux-2.6.39.1/drivers/ata/sata_dwc_460ex.c
26121--- linux-2.6.39.1/drivers/ata/sata_dwc_460ex.c 2011-05-19 00:06:34.000000000 -0400
26122+++ linux-2.6.39.1/drivers/ata/sata_dwc_460ex.c 2011-05-22 19:36:31.000000000 -0400
26123@@ -1598,7 +1598,7 @@ static struct scsi_host_template sata_dw
26124 .dma_boundary = ATA_DMA_BOUNDARY,
26125 };
26126
26127-static struct ata_port_operations sata_dwc_ops = {
26128+static const struct ata_port_operations sata_dwc_ops = {
26129 .inherits = &ata_sff_port_ops,
26130
26131 .error_handler = sata_dwc_error_handler,
26132diff -urNp linux-2.6.39.1/drivers/ata/sata_fsl.c linux-2.6.39.1/drivers/ata/sata_fsl.c
26133--- linux-2.6.39.1/drivers/ata/sata_fsl.c 2011-05-19 00:06:34.000000000 -0400
26134+++ linux-2.6.39.1/drivers/ata/sata_fsl.c 2011-05-22 19:36:31.000000000 -0400
26135@@ -1268,7 +1268,7 @@ static struct scsi_host_template sata_fs
26136 .dma_boundary = ATA_DMA_BOUNDARY,
26137 };
26138
26139-static struct ata_port_operations sata_fsl_ops = {
26140+static const struct ata_port_operations sata_fsl_ops = {
26141 .inherits = &sata_pmp_port_ops,
26142
26143 .qc_defer = ata_std_qc_defer,
26144diff -urNp linux-2.6.39.1/drivers/ata/sata_inic162x.c linux-2.6.39.1/drivers/ata/sata_inic162x.c
26145--- linux-2.6.39.1/drivers/ata/sata_inic162x.c 2011-05-19 00:06:34.000000000 -0400
26146+++ linux-2.6.39.1/drivers/ata/sata_inic162x.c 2011-05-22 19:36:31.000000000 -0400
26147@@ -705,7 +705,7 @@ static int inic_port_start(struct ata_po
26148 return 0;
26149 }
26150
26151-static struct ata_port_operations inic_port_ops = {
26152+static const struct ata_port_operations inic_port_ops = {
26153 .inherits = &sata_port_ops,
26154
26155 .check_atapi_dma = inic_check_atapi_dma,
26156diff -urNp linux-2.6.39.1/drivers/ata/sata_mv.c linux-2.6.39.1/drivers/ata/sata_mv.c
26157--- linux-2.6.39.1/drivers/ata/sata_mv.c 2011-05-19 00:06:34.000000000 -0400
26158+++ linux-2.6.39.1/drivers/ata/sata_mv.c 2011-05-22 19:36:31.000000000 -0400
26159@@ -662,7 +662,7 @@ static struct scsi_host_template mv6_sht
26160 .dma_boundary = MV_DMA_BOUNDARY,
26161 };
26162
26163-static struct ata_port_operations mv5_ops = {
26164+static const struct ata_port_operations mv5_ops = {
26165 .inherits = &ata_sff_port_ops,
26166
26167 .lost_interrupt = ATA_OP_NULL,
26168@@ -682,7 +682,7 @@ static struct ata_port_operations mv5_op
26169 .port_stop = mv_port_stop,
26170 };
26171
26172-static struct ata_port_operations mv6_ops = {
26173+static const struct ata_port_operations mv6_ops = {
26174 .inherits = &ata_bmdma_port_ops,
26175
26176 .lost_interrupt = ATA_OP_NULL,
26177@@ -716,7 +716,7 @@ static struct ata_port_operations mv6_op
26178 .port_stop = mv_port_stop,
26179 };
26180
26181-static struct ata_port_operations mv_iie_ops = {
26182+static const struct ata_port_operations mv_iie_ops = {
26183 .inherits = &mv6_ops,
26184 .dev_config = ATA_OP_NULL,
26185 .qc_prep = mv_qc_prep_iie,
26186diff -urNp linux-2.6.39.1/drivers/ata/sata_nv.c linux-2.6.39.1/drivers/ata/sata_nv.c
26187--- linux-2.6.39.1/drivers/ata/sata_nv.c 2011-05-19 00:06:34.000000000 -0400
26188+++ linux-2.6.39.1/drivers/ata/sata_nv.c 2011-05-22 19:36:31.000000000 -0400
26189@@ -465,7 +465,7 @@ static struct scsi_host_template nv_swnc
26190 * cases. Define nv_hardreset() which only kicks in for post-boot
26191 * probing and use it for all variants.
26192 */
26193-static struct ata_port_operations nv_generic_ops = {
26194+static const struct ata_port_operations nv_generic_ops = {
26195 .inherits = &ata_bmdma_port_ops,
26196 .lost_interrupt = ATA_OP_NULL,
26197 .scr_read = nv_scr_read,
26198@@ -473,20 +473,20 @@ static struct ata_port_operations nv_gen
26199 .hardreset = nv_hardreset,
26200 };
26201
26202-static struct ata_port_operations nv_nf2_ops = {
26203+static const struct ata_port_operations nv_nf2_ops = {
26204 .inherits = &nv_generic_ops,
26205 .freeze = nv_nf2_freeze,
26206 .thaw = nv_nf2_thaw,
26207 };
26208
26209-static struct ata_port_operations nv_ck804_ops = {
26210+static const struct ata_port_operations nv_ck804_ops = {
26211 .inherits = &nv_generic_ops,
26212 .freeze = nv_ck804_freeze,
26213 .thaw = nv_ck804_thaw,
26214 .host_stop = nv_ck804_host_stop,
26215 };
26216
26217-static struct ata_port_operations nv_adma_ops = {
26218+static const struct ata_port_operations nv_adma_ops = {
26219 .inherits = &nv_ck804_ops,
26220
26221 .check_atapi_dma = nv_adma_check_atapi_dma,
26222@@ -510,7 +510,7 @@ static struct ata_port_operations nv_adm
26223 .host_stop = nv_adma_host_stop,
26224 };
26225
26226-static struct ata_port_operations nv_swncq_ops = {
26227+static const struct ata_port_operations nv_swncq_ops = {
26228 .inherits = &nv_generic_ops,
26229
26230 .qc_defer = ata_std_qc_defer,
26231diff -urNp linux-2.6.39.1/drivers/ata/sata_promise.c linux-2.6.39.1/drivers/ata/sata_promise.c
26232--- linux-2.6.39.1/drivers/ata/sata_promise.c 2011-05-19 00:06:34.000000000 -0400
26233+++ linux-2.6.39.1/drivers/ata/sata_promise.c 2011-05-22 19:36:31.000000000 -0400
26234@@ -194,7 +194,7 @@ static const struct ata_port_operations
26235 .error_handler = pdc_error_handler,
26236 };
26237
26238-static struct ata_port_operations pdc_sata_ops = {
26239+static const struct ata_port_operations pdc_sata_ops = {
26240 .inherits = &pdc_common_ops,
26241 .cable_detect = pdc_sata_cable_detect,
26242 .freeze = pdc_sata_freeze,
26243@@ -207,14 +207,14 @@ static struct ata_port_operations pdc_sa
26244
26245 /* First-generation chips need a more restrictive ->check_atapi_dma op,
26246 and ->freeze/thaw that ignore the hotplug controls. */
26247-static struct ata_port_operations pdc_old_sata_ops = {
26248+static const struct ata_port_operations pdc_old_sata_ops = {
26249 .inherits = &pdc_sata_ops,
26250 .freeze = pdc_freeze,
26251 .thaw = pdc_thaw,
26252 .check_atapi_dma = pdc_old_sata_check_atapi_dma,
26253 };
26254
26255-static struct ata_port_operations pdc_pata_ops = {
26256+static const struct ata_port_operations pdc_pata_ops = {
26257 .inherits = &pdc_common_ops,
26258 .cable_detect = pdc_pata_cable_detect,
26259 .freeze = pdc_freeze,
26260diff -urNp linux-2.6.39.1/drivers/ata/sata_qstor.c linux-2.6.39.1/drivers/ata/sata_qstor.c
26261--- linux-2.6.39.1/drivers/ata/sata_qstor.c 2011-05-19 00:06:34.000000000 -0400
26262+++ linux-2.6.39.1/drivers/ata/sata_qstor.c 2011-05-22 19:36:31.000000000 -0400
26263@@ -131,7 +131,7 @@ static struct scsi_host_template qs_ata_
26264 .dma_boundary = QS_DMA_BOUNDARY,
26265 };
26266
26267-static struct ata_port_operations qs_ata_ops = {
26268+static const struct ata_port_operations qs_ata_ops = {
26269 .inherits = &ata_sff_port_ops,
26270
26271 .check_atapi_dma = qs_check_atapi_dma,
26272diff -urNp linux-2.6.39.1/drivers/ata/sata_sil24.c linux-2.6.39.1/drivers/ata/sata_sil24.c
26273--- linux-2.6.39.1/drivers/ata/sata_sil24.c 2011-05-19 00:06:34.000000000 -0400
26274+++ linux-2.6.39.1/drivers/ata/sata_sil24.c 2011-05-22 19:36:31.000000000 -0400
26275@@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
26276 .dma_boundary = ATA_DMA_BOUNDARY,
26277 };
26278
26279-static struct ata_port_operations sil24_ops = {
26280+static const struct ata_port_operations sil24_ops = {
26281 .inherits = &sata_pmp_port_ops,
26282
26283 .qc_defer = sil24_qc_defer,
26284diff -urNp linux-2.6.39.1/drivers/ata/sata_sil.c linux-2.6.39.1/drivers/ata/sata_sil.c
26285--- linux-2.6.39.1/drivers/ata/sata_sil.c 2011-05-19 00:06:34.000000000 -0400
26286+++ linux-2.6.39.1/drivers/ata/sata_sil.c 2011-05-22 19:36:31.000000000 -0400
26287@@ -181,7 +181,7 @@ static struct scsi_host_template sil_sht
26288 .sg_tablesize = ATA_MAX_PRD
26289 };
26290
26291-static struct ata_port_operations sil_ops = {
26292+static const struct ata_port_operations sil_ops = {
26293 .inherits = &ata_bmdma32_port_ops,
26294 .dev_config = sil_dev_config,
26295 .set_mode = sil_set_mode,
26296diff -urNp linux-2.6.39.1/drivers/ata/sata_sis.c linux-2.6.39.1/drivers/ata/sata_sis.c
26297--- linux-2.6.39.1/drivers/ata/sata_sis.c 2011-05-19 00:06:34.000000000 -0400
26298+++ linux-2.6.39.1/drivers/ata/sata_sis.c 2011-05-22 19:36:31.000000000 -0400
26299@@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
26300 ATA_BMDMA_SHT(DRV_NAME),
26301 };
26302
26303-static struct ata_port_operations sis_ops = {
26304+static const struct ata_port_operations sis_ops = {
26305 .inherits = &ata_bmdma_port_ops,
26306 .scr_read = sis_scr_read,
26307 .scr_write = sis_scr_write,
26308diff -urNp linux-2.6.39.1/drivers/ata/sata_svw.c linux-2.6.39.1/drivers/ata/sata_svw.c
26309--- linux-2.6.39.1/drivers/ata/sata_svw.c 2011-05-19 00:06:34.000000000 -0400
26310+++ linux-2.6.39.1/drivers/ata/sata_svw.c 2011-05-22 19:36:31.000000000 -0400
26311@@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
26312 };
26313
26314
26315-static struct ata_port_operations k2_sata_ops = {
26316+static const struct ata_port_operations k2_sata_ops = {
26317 .inherits = &ata_bmdma_port_ops,
26318 .sff_tf_load = k2_sata_tf_load,
26319 .sff_tf_read = k2_sata_tf_read,
26320diff -urNp linux-2.6.39.1/drivers/ata/sata_sx4.c linux-2.6.39.1/drivers/ata/sata_sx4.c
26321--- linux-2.6.39.1/drivers/ata/sata_sx4.c 2011-05-19 00:06:34.000000000 -0400
26322+++ linux-2.6.39.1/drivers/ata/sata_sx4.c 2011-05-22 19:36:31.000000000 -0400
26323@@ -249,7 +249,7 @@ static struct scsi_host_template pdc_sat
26324 };
26325
26326 /* TODO: inherit from base port_ops after converting to new EH */
26327-static struct ata_port_operations pdc_20621_ops = {
26328+static const struct ata_port_operations pdc_20621_ops = {
26329 .inherits = &ata_sff_port_ops,
26330
26331 .check_atapi_dma = pdc_check_atapi_dma,
26332diff -urNp linux-2.6.39.1/drivers/ata/sata_uli.c linux-2.6.39.1/drivers/ata/sata_uli.c
26333--- linux-2.6.39.1/drivers/ata/sata_uli.c 2011-05-19 00:06:34.000000000 -0400
26334+++ linux-2.6.39.1/drivers/ata/sata_uli.c 2011-05-22 19:36:31.000000000 -0400
26335@@ -80,7 +80,7 @@ static struct scsi_host_template uli_sht
26336 ATA_BMDMA_SHT(DRV_NAME),
26337 };
26338
26339-static struct ata_port_operations uli_ops = {
26340+static const struct ata_port_operations uli_ops = {
26341 .inherits = &ata_bmdma_port_ops,
26342 .scr_read = uli_scr_read,
26343 .scr_write = uli_scr_write,
26344diff -urNp linux-2.6.39.1/drivers/ata/sata_via.c linux-2.6.39.1/drivers/ata/sata_via.c
26345--- linux-2.6.39.1/drivers/ata/sata_via.c 2011-05-19 00:06:34.000000000 -0400
26346+++ linux-2.6.39.1/drivers/ata/sata_via.c 2011-05-22 19:36:31.000000000 -0400
26347@@ -115,32 +115,32 @@ static struct scsi_host_template svia_sh
26348 ATA_BMDMA_SHT(DRV_NAME),
26349 };
26350
26351-static struct ata_port_operations svia_base_ops = {
26352+static const struct ata_port_operations svia_base_ops = {
26353 .inherits = &ata_bmdma_port_ops,
26354 .sff_tf_load = svia_tf_load,
26355 };
26356
26357-static struct ata_port_operations vt6420_sata_ops = {
26358+static const struct ata_port_operations vt6420_sata_ops = {
26359 .inherits = &svia_base_ops,
26360 .freeze = svia_noop_freeze,
26361 .prereset = vt6420_prereset,
26362 .bmdma_start = vt6420_bmdma_start,
26363 };
26364
26365-static struct ata_port_operations vt6421_pata_ops = {
26366+static const struct ata_port_operations vt6421_pata_ops = {
26367 .inherits = &svia_base_ops,
26368 .cable_detect = vt6421_pata_cable_detect,
26369 .set_piomode = vt6421_set_pio_mode,
26370 .set_dmamode = vt6421_set_dma_mode,
26371 };
26372
26373-static struct ata_port_operations vt6421_sata_ops = {
26374+static const struct ata_port_operations vt6421_sata_ops = {
26375 .inherits = &svia_base_ops,
26376 .scr_read = svia_scr_read,
26377 .scr_write = svia_scr_write,
26378 };
26379
26380-static struct ata_port_operations vt8251_ops = {
26381+static const struct ata_port_operations vt8251_ops = {
26382 .inherits = &svia_base_ops,
26383 .hardreset = sata_std_hardreset,
26384 .scr_read = vt8251_scr_read,
26385diff -urNp linux-2.6.39.1/drivers/ata/sata_vsc.c linux-2.6.39.1/drivers/ata/sata_vsc.c
26386--- linux-2.6.39.1/drivers/ata/sata_vsc.c 2011-05-19 00:06:34.000000000 -0400
26387+++ linux-2.6.39.1/drivers/ata/sata_vsc.c 2011-05-22 19:36:31.000000000 -0400
26388@@ -300,7 +300,7 @@ static struct scsi_host_template vsc_sat
26389 };
26390
26391
26392-static struct ata_port_operations vsc_sata_ops = {
26393+static const struct ata_port_operations vsc_sata_ops = {
26394 .inherits = &ata_bmdma_port_ops,
26395 /* The IRQ handling is not quite standard SFF behaviour so we
26396 cannot use the default lost interrupt handler */
26397diff -urNp linux-2.6.39.1/drivers/atm/adummy.c linux-2.6.39.1/drivers/atm/adummy.c
26398--- linux-2.6.39.1/drivers/atm/adummy.c 2011-05-19 00:06:34.000000000 -0400
26399+++ linux-2.6.39.1/drivers/atm/adummy.c 2011-05-22 19:36:31.000000000 -0400
26400@@ -114,7 +114,7 @@ adummy_send(struct atm_vcc *vcc, struct
26401 vcc->pop(vcc, skb);
26402 else
26403 dev_kfree_skb_any(skb);
26404- atomic_inc(&vcc->stats->tx);
26405+ atomic_inc_unchecked(&vcc->stats->tx);
26406
26407 return 0;
26408 }
26409diff -urNp linux-2.6.39.1/drivers/atm/ambassador.c linux-2.6.39.1/drivers/atm/ambassador.c
26410--- linux-2.6.39.1/drivers/atm/ambassador.c 2011-05-19 00:06:34.000000000 -0400
26411+++ linux-2.6.39.1/drivers/atm/ambassador.c 2011-05-22 19:36:31.000000000 -0400
26412@@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev,
26413 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
26414
26415 // VC layer stats
26416- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26417+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26418
26419 // free the descriptor
26420 kfree (tx_descr);
26421@@ -495,7 +495,7 @@ static void rx_complete (amb_dev * dev,
26422 dump_skb ("<<<", vc, skb);
26423
26424 // VC layer stats
26425- atomic_inc(&atm_vcc->stats->rx);
26426+ atomic_inc_unchecked(&atm_vcc->stats->rx);
26427 __net_timestamp(skb);
26428 // end of our responsibility
26429 atm_vcc->push (atm_vcc, skb);
26430@@ -510,7 +510,7 @@ static void rx_complete (amb_dev * dev,
26431 } else {
26432 PRINTK (KERN_INFO, "dropped over-size frame");
26433 // should we count this?
26434- atomic_inc(&atm_vcc->stats->rx_drop);
26435+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26436 }
26437
26438 } else {
26439@@ -1342,7 +1342,7 @@ static int amb_send (struct atm_vcc * at
26440 }
26441
26442 if (check_area (skb->data, skb->len)) {
26443- atomic_inc(&atm_vcc->stats->tx_err);
26444+ atomic_inc_unchecked(&atm_vcc->stats->tx_err);
26445 return -ENOMEM; // ?
26446 }
26447
26448diff -urNp linux-2.6.39.1/drivers/atm/atmtcp.c linux-2.6.39.1/drivers/atm/atmtcp.c
26449--- linux-2.6.39.1/drivers/atm/atmtcp.c 2011-05-19 00:06:34.000000000 -0400
26450+++ linux-2.6.39.1/drivers/atm/atmtcp.c 2011-05-22 19:36:31.000000000 -0400
26451@@ -207,7 +207,7 @@ static int atmtcp_v_send(struct atm_vcc
26452 if (vcc->pop) vcc->pop(vcc,skb);
26453 else dev_kfree_skb(skb);
26454 if (dev_data) return 0;
26455- atomic_inc(&vcc->stats->tx_err);
26456+ atomic_inc_unchecked(&vcc->stats->tx_err);
26457 return -ENOLINK;
26458 }
26459 size = skb->len+sizeof(struct atmtcp_hdr);
26460@@ -215,7 +215,7 @@ static int atmtcp_v_send(struct atm_vcc
26461 if (!new_skb) {
26462 if (vcc->pop) vcc->pop(vcc,skb);
26463 else dev_kfree_skb(skb);
26464- atomic_inc(&vcc->stats->tx_err);
26465+ atomic_inc_unchecked(&vcc->stats->tx_err);
26466 return -ENOBUFS;
26467 }
26468 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
26469@@ -226,8 +226,8 @@ static int atmtcp_v_send(struct atm_vcc
26470 if (vcc->pop) vcc->pop(vcc,skb);
26471 else dev_kfree_skb(skb);
26472 out_vcc->push(out_vcc,new_skb);
26473- atomic_inc(&vcc->stats->tx);
26474- atomic_inc(&out_vcc->stats->rx);
26475+ atomic_inc_unchecked(&vcc->stats->tx);
26476+ atomic_inc_unchecked(&out_vcc->stats->rx);
26477 return 0;
26478 }
26479
26480@@ -301,7 +301,7 @@ static int atmtcp_c_send(struct atm_vcc
26481 out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
26482 read_unlock(&vcc_sklist_lock);
26483 if (!out_vcc) {
26484- atomic_inc(&vcc->stats->tx_err);
26485+ atomic_inc_unchecked(&vcc->stats->tx_err);
26486 goto done;
26487 }
26488 skb_pull(skb,sizeof(struct atmtcp_hdr));
26489@@ -313,8 +313,8 @@ static int atmtcp_c_send(struct atm_vcc
26490 __net_timestamp(new_skb);
26491 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
26492 out_vcc->push(out_vcc,new_skb);
26493- atomic_inc(&vcc->stats->tx);
26494- atomic_inc(&out_vcc->stats->rx);
26495+ atomic_inc_unchecked(&vcc->stats->tx);
26496+ atomic_inc_unchecked(&out_vcc->stats->rx);
26497 done:
26498 if (vcc->pop) vcc->pop(vcc,skb);
26499 else dev_kfree_skb(skb);
26500diff -urNp linux-2.6.39.1/drivers/atm/eni.c linux-2.6.39.1/drivers/atm/eni.c
26501--- linux-2.6.39.1/drivers/atm/eni.c 2011-05-19 00:06:34.000000000 -0400
26502+++ linux-2.6.39.1/drivers/atm/eni.c 2011-05-22 19:36:31.000000000 -0400
26503@@ -526,7 +526,7 @@ static int rx_aal0(struct atm_vcc *vcc)
26504 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
26505 vcc->dev->number);
26506 length = 0;
26507- atomic_inc(&vcc->stats->rx_err);
26508+ atomic_inc_unchecked(&vcc->stats->rx_err);
26509 }
26510 else {
26511 length = ATM_CELL_SIZE-1; /* no HEC */
26512@@ -581,7 +581,7 @@ static int rx_aal5(struct atm_vcc *vcc)
26513 size);
26514 }
26515 eff = length = 0;
26516- atomic_inc(&vcc->stats->rx_err);
26517+ atomic_inc_unchecked(&vcc->stats->rx_err);
26518 }
26519 else {
26520 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
26521@@ -598,7 +598,7 @@ static int rx_aal5(struct atm_vcc *vcc)
26522 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
26523 vcc->dev->number,vcc->vci,length,size << 2,descr);
26524 length = eff = 0;
26525- atomic_inc(&vcc->stats->rx_err);
26526+ atomic_inc_unchecked(&vcc->stats->rx_err);
26527 }
26528 }
26529 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
26530@@ -771,7 +771,7 @@ rx_dequeued++;
26531 vcc->push(vcc,skb);
26532 pushed++;
26533 }
26534- atomic_inc(&vcc->stats->rx);
26535+ atomic_inc_unchecked(&vcc->stats->rx);
26536 }
26537 wake_up(&eni_dev->rx_wait);
26538 }
26539@@ -1228,7 +1228,7 @@ static void dequeue_tx(struct atm_dev *d
26540 PCI_DMA_TODEVICE);
26541 if (vcc->pop) vcc->pop(vcc,skb);
26542 else dev_kfree_skb_irq(skb);
26543- atomic_inc(&vcc->stats->tx);
26544+ atomic_inc_unchecked(&vcc->stats->tx);
26545 wake_up(&eni_dev->tx_wait);
26546 dma_complete++;
26547 }
26548diff -urNp linux-2.6.39.1/drivers/atm/firestream.c linux-2.6.39.1/drivers/atm/firestream.c
26549--- linux-2.6.39.1/drivers/atm/firestream.c 2011-05-19 00:06:34.000000000 -0400
26550+++ linux-2.6.39.1/drivers/atm/firestream.c 2011-05-22 19:36:31.000000000 -0400
26551@@ -749,7 +749,7 @@ static void process_txdone_queue (struct
26552 }
26553 }
26554
26555- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26556+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26557
26558 fs_dprintk (FS_DEBUG_TXMEM, "i");
26559 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
26560@@ -816,7 +816,7 @@ static void process_incoming (struct fs_
26561 #endif
26562 skb_put (skb, qe->p1 & 0xffff);
26563 ATM_SKB(skb)->vcc = atm_vcc;
26564- atomic_inc(&atm_vcc->stats->rx);
26565+ atomic_inc_unchecked(&atm_vcc->stats->rx);
26566 __net_timestamp(skb);
26567 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
26568 atm_vcc->push (atm_vcc, skb);
26569@@ -837,12 +837,12 @@ static void process_incoming (struct fs_
26570 kfree (pe);
26571 }
26572 if (atm_vcc)
26573- atomic_inc(&atm_vcc->stats->rx_drop);
26574+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26575 break;
26576 case 0x1f: /* Reassembly abort: no buffers. */
26577 /* Silently increment error counter. */
26578 if (atm_vcc)
26579- atomic_inc(&atm_vcc->stats->rx_drop);
26580+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26581 break;
26582 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
26583 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
26584diff -urNp linux-2.6.39.1/drivers/atm/fore200e.c linux-2.6.39.1/drivers/atm/fore200e.c
26585--- linux-2.6.39.1/drivers/atm/fore200e.c 2011-05-19 00:06:34.000000000 -0400
26586+++ linux-2.6.39.1/drivers/atm/fore200e.c 2011-05-22 19:36:31.000000000 -0400
26587@@ -933,9 +933,9 @@ fore200e_tx_irq(struct fore200e* fore200
26588 #endif
26589 /* check error condition */
26590 if (*entry->status & STATUS_ERROR)
26591- atomic_inc(&vcc->stats->tx_err);
26592+ atomic_inc_unchecked(&vcc->stats->tx_err);
26593 else
26594- atomic_inc(&vcc->stats->tx);
26595+ atomic_inc_unchecked(&vcc->stats->tx);
26596 }
26597 }
26598
26599@@ -1084,7 +1084,7 @@ fore200e_push_rpd(struct fore200e* fore2
26600 if (skb == NULL) {
26601 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
26602
26603- atomic_inc(&vcc->stats->rx_drop);
26604+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26605 return -ENOMEM;
26606 }
26607
26608@@ -1127,14 +1127,14 @@ fore200e_push_rpd(struct fore200e* fore2
26609
26610 dev_kfree_skb_any(skb);
26611
26612- atomic_inc(&vcc->stats->rx_drop);
26613+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26614 return -ENOMEM;
26615 }
26616
26617 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
26618
26619 vcc->push(vcc, skb);
26620- atomic_inc(&vcc->stats->rx);
26621+ atomic_inc_unchecked(&vcc->stats->rx);
26622
26623 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
26624
26625@@ -1212,7 +1212,7 @@ fore200e_rx_irq(struct fore200e* fore200
26626 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
26627 fore200e->atm_dev->number,
26628 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
26629- atomic_inc(&vcc->stats->rx_err);
26630+ atomic_inc_unchecked(&vcc->stats->rx_err);
26631 }
26632 }
26633
26634@@ -1657,7 +1657,7 @@ fore200e_send(struct atm_vcc *vcc, struc
26635 goto retry_here;
26636 }
26637
26638- atomic_inc(&vcc->stats->tx_err);
26639+ atomic_inc_unchecked(&vcc->stats->tx_err);
26640
26641 fore200e->tx_sat++;
26642 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
26643diff -urNp linux-2.6.39.1/drivers/atm/he.c linux-2.6.39.1/drivers/atm/he.c
26644--- linux-2.6.39.1/drivers/atm/he.c 2011-05-19 00:06:34.000000000 -0400
26645+++ linux-2.6.39.1/drivers/atm/he.c 2011-05-22 19:36:31.000000000 -0400
26646@@ -1709,7 +1709,7 @@ he_service_rbrq(struct he_dev *he_dev, i
26647
26648 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
26649 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
26650- atomic_inc(&vcc->stats->rx_drop);
26651+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26652 goto return_host_buffers;
26653 }
26654
26655@@ -1736,7 +1736,7 @@ he_service_rbrq(struct he_dev *he_dev, i
26656 RBRQ_LEN_ERR(he_dev->rbrq_head)
26657 ? "LEN_ERR" : "",
26658 vcc->vpi, vcc->vci);
26659- atomic_inc(&vcc->stats->rx_err);
26660+ atomic_inc_unchecked(&vcc->stats->rx_err);
26661 goto return_host_buffers;
26662 }
26663
26664@@ -1788,7 +1788,7 @@ he_service_rbrq(struct he_dev *he_dev, i
26665 vcc->push(vcc, skb);
26666 spin_lock(&he_dev->global_lock);
26667
26668- atomic_inc(&vcc->stats->rx);
26669+ atomic_inc_unchecked(&vcc->stats->rx);
26670
26671 return_host_buffers:
26672 ++pdus_assembled;
26673@@ -2114,7 +2114,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
26674 tpd->vcc->pop(tpd->vcc, tpd->skb);
26675 else
26676 dev_kfree_skb_any(tpd->skb);
26677- atomic_inc(&tpd->vcc->stats->tx_err);
26678+ atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
26679 }
26680 pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
26681 return;
26682@@ -2526,7 +2526,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26683 vcc->pop(vcc, skb);
26684 else
26685 dev_kfree_skb_any(skb);
26686- atomic_inc(&vcc->stats->tx_err);
26687+ atomic_inc_unchecked(&vcc->stats->tx_err);
26688 return -EINVAL;
26689 }
26690
26691@@ -2537,7 +2537,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26692 vcc->pop(vcc, skb);
26693 else
26694 dev_kfree_skb_any(skb);
26695- atomic_inc(&vcc->stats->tx_err);
26696+ atomic_inc_unchecked(&vcc->stats->tx_err);
26697 return -EINVAL;
26698 }
26699 #endif
26700@@ -2549,7 +2549,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26701 vcc->pop(vcc, skb);
26702 else
26703 dev_kfree_skb_any(skb);
26704- atomic_inc(&vcc->stats->tx_err);
26705+ atomic_inc_unchecked(&vcc->stats->tx_err);
26706 spin_unlock_irqrestore(&he_dev->global_lock, flags);
26707 return -ENOMEM;
26708 }
26709@@ -2591,7 +2591,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26710 vcc->pop(vcc, skb);
26711 else
26712 dev_kfree_skb_any(skb);
26713- atomic_inc(&vcc->stats->tx_err);
26714+ atomic_inc_unchecked(&vcc->stats->tx_err);
26715 spin_unlock_irqrestore(&he_dev->global_lock, flags);
26716 return -ENOMEM;
26717 }
26718@@ -2622,7 +2622,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26719 __enqueue_tpd(he_dev, tpd, cid);
26720 spin_unlock_irqrestore(&he_dev->global_lock, flags);
26721
26722- atomic_inc(&vcc->stats->tx);
26723+ atomic_inc_unchecked(&vcc->stats->tx);
26724
26725 return 0;
26726 }
26727diff -urNp linux-2.6.39.1/drivers/atm/horizon.c linux-2.6.39.1/drivers/atm/horizon.c
26728--- linux-2.6.39.1/drivers/atm/horizon.c 2011-05-19 00:06:34.000000000 -0400
26729+++ linux-2.6.39.1/drivers/atm/horizon.c 2011-05-22 19:36:31.000000000 -0400
26730@@ -1034,7 +1034,7 @@ static void rx_schedule (hrz_dev * dev,
26731 {
26732 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
26733 // VC layer stats
26734- atomic_inc(&vcc->stats->rx);
26735+ atomic_inc_unchecked(&vcc->stats->rx);
26736 __net_timestamp(skb);
26737 // end of our responsibility
26738 vcc->push (vcc, skb);
26739@@ -1186,7 +1186,7 @@ static void tx_schedule (hrz_dev * const
26740 dev->tx_iovec = NULL;
26741
26742 // VC layer stats
26743- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26744+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26745
26746 // free the skb
26747 hrz_kfree_skb (skb);
26748diff -urNp linux-2.6.39.1/drivers/atm/idt77252.c linux-2.6.39.1/drivers/atm/idt77252.c
26749--- linux-2.6.39.1/drivers/atm/idt77252.c 2011-05-19 00:06:34.000000000 -0400
26750+++ linux-2.6.39.1/drivers/atm/idt77252.c 2011-05-22 19:36:31.000000000 -0400
26751@@ -811,7 +811,7 @@ drain_scq(struct idt77252_dev *card, str
26752 else
26753 dev_kfree_skb(skb);
26754
26755- atomic_inc(&vcc->stats->tx);
26756+ atomic_inc_unchecked(&vcc->stats->tx);
26757 }
26758
26759 atomic_dec(&scq->used);
26760@@ -1074,13 +1074,13 @@ dequeue_rx(struct idt77252_dev *card, st
26761 if ((sb = dev_alloc_skb(64)) == NULL) {
26762 printk("%s: Can't allocate buffers for aal0.\n",
26763 card->name);
26764- atomic_add(i, &vcc->stats->rx_drop);
26765+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
26766 break;
26767 }
26768 if (!atm_charge(vcc, sb->truesize)) {
26769 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
26770 card->name);
26771- atomic_add(i - 1, &vcc->stats->rx_drop);
26772+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
26773 dev_kfree_skb(sb);
26774 break;
26775 }
26776@@ -1097,7 +1097,7 @@ dequeue_rx(struct idt77252_dev *card, st
26777 ATM_SKB(sb)->vcc = vcc;
26778 __net_timestamp(sb);
26779 vcc->push(vcc, sb);
26780- atomic_inc(&vcc->stats->rx);
26781+ atomic_inc_unchecked(&vcc->stats->rx);
26782
26783 cell += ATM_CELL_PAYLOAD;
26784 }
26785@@ -1134,13 +1134,13 @@ dequeue_rx(struct idt77252_dev *card, st
26786 "(CDC: %08x)\n",
26787 card->name, len, rpp->len, readl(SAR_REG_CDC));
26788 recycle_rx_pool_skb(card, rpp);
26789- atomic_inc(&vcc->stats->rx_err);
26790+ atomic_inc_unchecked(&vcc->stats->rx_err);
26791 return;
26792 }
26793 if (stat & SAR_RSQE_CRC) {
26794 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
26795 recycle_rx_pool_skb(card, rpp);
26796- atomic_inc(&vcc->stats->rx_err);
26797+ atomic_inc_unchecked(&vcc->stats->rx_err);
26798 return;
26799 }
26800 if (skb_queue_len(&rpp->queue) > 1) {
26801@@ -1151,7 +1151,7 @@ dequeue_rx(struct idt77252_dev *card, st
26802 RXPRINTK("%s: Can't alloc RX skb.\n",
26803 card->name);
26804 recycle_rx_pool_skb(card, rpp);
26805- atomic_inc(&vcc->stats->rx_err);
26806+ atomic_inc_unchecked(&vcc->stats->rx_err);
26807 return;
26808 }
26809 if (!atm_charge(vcc, skb->truesize)) {
26810@@ -1170,7 +1170,7 @@ dequeue_rx(struct idt77252_dev *card, st
26811 __net_timestamp(skb);
26812
26813 vcc->push(vcc, skb);
26814- atomic_inc(&vcc->stats->rx);
26815+ atomic_inc_unchecked(&vcc->stats->rx);
26816
26817 return;
26818 }
26819@@ -1192,7 +1192,7 @@ dequeue_rx(struct idt77252_dev *card, st
26820 __net_timestamp(skb);
26821
26822 vcc->push(vcc, skb);
26823- atomic_inc(&vcc->stats->rx);
26824+ atomic_inc_unchecked(&vcc->stats->rx);
26825
26826 if (skb->truesize > SAR_FB_SIZE_3)
26827 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
26828@@ -1304,14 +1304,14 @@ idt77252_rx_raw(struct idt77252_dev *car
26829 if (vcc->qos.aal != ATM_AAL0) {
26830 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
26831 card->name, vpi, vci);
26832- atomic_inc(&vcc->stats->rx_drop);
26833+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26834 goto drop;
26835 }
26836
26837 if ((sb = dev_alloc_skb(64)) == NULL) {
26838 printk("%s: Can't allocate buffers for AAL0.\n",
26839 card->name);
26840- atomic_inc(&vcc->stats->rx_err);
26841+ atomic_inc_unchecked(&vcc->stats->rx_err);
26842 goto drop;
26843 }
26844
26845@@ -1330,7 +1330,7 @@ idt77252_rx_raw(struct idt77252_dev *car
26846 ATM_SKB(sb)->vcc = vcc;
26847 __net_timestamp(sb);
26848 vcc->push(vcc, sb);
26849- atomic_inc(&vcc->stats->rx);
26850+ atomic_inc_unchecked(&vcc->stats->rx);
26851
26852 drop:
26853 skb_pull(queue, 64);
26854@@ -1955,13 +1955,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
26855
26856 if (vc == NULL) {
26857 printk("%s: NULL connection in send().\n", card->name);
26858- atomic_inc(&vcc->stats->tx_err);
26859+ atomic_inc_unchecked(&vcc->stats->tx_err);
26860 dev_kfree_skb(skb);
26861 return -EINVAL;
26862 }
26863 if (!test_bit(VCF_TX, &vc->flags)) {
26864 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
26865- atomic_inc(&vcc->stats->tx_err);
26866+ atomic_inc_unchecked(&vcc->stats->tx_err);
26867 dev_kfree_skb(skb);
26868 return -EINVAL;
26869 }
26870@@ -1973,14 +1973,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
26871 break;
26872 default:
26873 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
26874- atomic_inc(&vcc->stats->tx_err);
26875+ atomic_inc_unchecked(&vcc->stats->tx_err);
26876 dev_kfree_skb(skb);
26877 return -EINVAL;
26878 }
26879
26880 if (skb_shinfo(skb)->nr_frags != 0) {
26881 printk("%s: No scatter-gather yet.\n", card->name);
26882- atomic_inc(&vcc->stats->tx_err);
26883+ atomic_inc_unchecked(&vcc->stats->tx_err);
26884 dev_kfree_skb(skb);
26885 return -EINVAL;
26886 }
26887@@ -1988,7 +1988,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
26888
26889 err = queue_skb(card, vc, skb, oam);
26890 if (err) {
26891- atomic_inc(&vcc->stats->tx_err);
26892+ atomic_inc_unchecked(&vcc->stats->tx_err);
26893 dev_kfree_skb(skb);
26894 return err;
26895 }
26896@@ -2011,7 +2011,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
26897 skb = dev_alloc_skb(64);
26898 if (!skb) {
26899 printk("%s: Out of memory in send_oam().\n", card->name);
26900- atomic_inc(&vcc->stats->tx_err);
26901+ atomic_inc_unchecked(&vcc->stats->tx_err);
26902 return -ENOMEM;
26903 }
26904 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
26905diff -urNp linux-2.6.39.1/drivers/atm/iphase.c linux-2.6.39.1/drivers/atm/iphase.c
26906--- linux-2.6.39.1/drivers/atm/iphase.c 2011-05-19 00:06:34.000000000 -0400
26907+++ linux-2.6.39.1/drivers/atm/iphase.c 2011-05-22 19:36:31.000000000 -0400
26908@@ -1124,7 +1124,7 @@ static int rx_pkt(struct atm_dev *dev)
26909 status = (u_short) (buf_desc_ptr->desc_mode);
26910 if (status & (RX_CER | RX_PTE | RX_OFL))
26911 {
26912- atomic_inc(&vcc->stats->rx_err);
26913+ atomic_inc_unchecked(&vcc->stats->rx_err);
26914 IF_ERR(printk("IA: bad packet, dropping it");)
26915 if (status & RX_CER) {
26916 IF_ERR(printk(" cause: packet CRC error\n");)
26917@@ -1147,7 +1147,7 @@ static int rx_pkt(struct atm_dev *dev)
26918 len = dma_addr - buf_addr;
26919 if (len > iadev->rx_buf_sz) {
26920 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
26921- atomic_inc(&vcc->stats->rx_err);
26922+ atomic_inc_unchecked(&vcc->stats->rx_err);
26923 goto out_free_desc;
26924 }
26925
26926@@ -1297,7 +1297,7 @@ static void rx_dle_intr(struct atm_dev *
26927 ia_vcc = INPH_IA_VCC(vcc);
26928 if (ia_vcc == NULL)
26929 {
26930- atomic_inc(&vcc->stats->rx_err);
26931+ atomic_inc_unchecked(&vcc->stats->rx_err);
26932 dev_kfree_skb_any(skb);
26933 atm_return(vcc, atm_guess_pdu2truesize(len));
26934 goto INCR_DLE;
26935@@ -1309,7 +1309,7 @@ static void rx_dle_intr(struct atm_dev *
26936 if ((length > iadev->rx_buf_sz) || (length >
26937 (skb->len - sizeof(struct cpcs_trailer))))
26938 {
26939- atomic_inc(&vcc->stats->rx_err);
26940+ atomic_inc_unchecked(&vcc->stats->rx_err);
26941 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
26942 length, skb->len);)
26943 dev_kfree_skb_any(skb);
26944@@ -1325,7 +1325,7 @@ static void rx_dle_intr(struct atm_dev *
26945
26946 IF_RX(printk("rx_dle_intr: skb push");)
26947 vcc->push(vcc,skb);
26948- atomic_inc(&vcc->stats->rx);
26949+ atomic_inc_unchecked(&vcc->stats->rx);
26950 iadev->rx_pkt_cnt++;
26951 }
26952 INCR_DLE:
26953@@ -2807,15 +2807,15 @@ static int ia_ioctl(struct atm_dev *dev,
26954 {
26955 struct k_sonet_stats *stats;
26956 stats = &PRIV(_ia_dev[board])->sonet_stats;
26957- printk("section_bip: %d\n", atomic_read(&stats->section_bip));
26958- printk("line_bip : %d\n", atomic_read(&stats->line_bip));
26959- printk("path_bip : %d\n", atomic_read(&stats->path_bip));
26960- printk("line_febe : %d\n", atomic_read(&stats->line_febe));
26961- printk("path_febe : %d\n", atomic_read(&stats->path_febe));
26962- printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
26963- printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
26964- printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
26965- printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
26966+ printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
26967+ printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
26968+ printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
26969+ printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
26970+ printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
26971+ printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
26972+ printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
26973+ printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
26974+ printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
26975 }
26976 ia_cmds.status = 0;
26977 break;
26978@@ -2920,7 +2920,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
26979 if ((desc == 0) || (desc > iadev->num_tx_desc))
26980 {
26981 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
26982- atomic_inc(&vcc->stats->tx);
26983+ atomic_inc_unchecked(&vcc->stats->tx);
26984 if (vcc->pop)
26985 vcc->pop(vcc, skb);
26986 else
26987@@ -3025,14 +3025,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
26988 ATM_DESC(skb) = vcc->vci;
26989 skb_queue_tail(&iadev->tx_dma_q, skb);
26990
26991- atomic_inc(&vcc->stats->tx);
26992+ atomic_inc_unchecked(&vcc->stats->tx);
26993 iadev->tx_pkt_cnt++;
26994 /* Increment transaction counter */
26995 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
26996
26997 #if 0
26998 /* add flow control logic */
26999- if (atomic_read(&vcc->stats->tx) % 20 == 0) {
27000+ if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
27001 if (iavcc->vc_desc_cnt > 10) {
27002 vcc->tx_quota = vcc->tx_quota * 3 / 4;
27003 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
27004diff -urNp linux-2.6.39.1/drivers/atm/lanai.c linux-2.6.39.1/drivers/atm/lanai.c
27005--- linux-2.6.39.1/drivers/atm/lanai.c 2011-05-19 00:06:34.000000000 -0400
27006+++ linux-2.6.39.1/drivers/atm/lanai.c 2011-05-22 19:36:31.000000000 -0400
27007@@ -1303,7 +1303,7 @@ static void lanai_send_one_aal5(struct l
27008 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
27009 lanai_endtx(lanai, lvcc);
27010 lanai_free_skb(lvcc->tx.atmvcc, skb);
27011- atomic_inc(&lvcc->tx.atmvcc->stats->tx);
27012+ atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
27013 }
27014
27015 /* Try to fill the buffer - don't call unless there is backlog */
27016@@ -1426,7 +1426,7 @@ static void vcc_rx_aal5(struct lanai_vcc
27017 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
27018 __net_timestamp(skb);
27019 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
27020- atomic_inc(&lvcc->rx.atmvcc->stats->rx);
27021+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
27022 out:
27023 lvcc->rx.buf.ptr = end;
27024 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
27025@@ -1668,7 +1668,7 @@ static int handle_service(struct lanai_d
27026 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
27027 "vcc %d\n", lanai->number, (unsigned int) s, vci);
27028 lanai->stats.service_rxnotaal5++;
27029- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27030+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27031 return 0;
27032 }
27033 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
27034@@ -1680,7 +1680,7 @@ static int handle_service(struct lanai_d
27035 int bytes;
27036 read_unlock(&vcc_sklist_lock);
27037 DPRINTK("got trashed rx pdu on vci %d\n", vci);
27038- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27039+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27040 lvcc->stats.x.aal5.service_trash++;
27041 bytes = (SERVICE_GET_END(s) * 16) -
27042 (((unsigned long) lvcc->rx.buf.ptr) -
27043@@ -1692,7 +1692,7 @@ static int handle_service(struct lanai_d
27044 }
27045 if (s & SERVICE_STREAM) {
27046 read_unlock(&vcc_sklist_lock);
27047- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27048+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27049 lvcc->stats.x.aal5.service_stream++;
27050 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
27051 "PDU on VCI %d!\n", lanai->number, vci);
27052@@ -1700,7 +1700,7 @@ static int handle_service(struct lanai_d
27053 return 0;
27054 }
27055 DPRINTK("got rx crc error on vci %d\n", vci);
27056- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27057+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27058 lvcc->stats.x.aal5.service_rxcrc++;
27059 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
27060 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
27061diff -urNp linux-2.6.39.1/drivers/atm/nicstar.c linux-2.6.39.1/drivers/atm/nicstar.c
27062--- linux-2.6.39.1/drivers/atm/nicstar.c 2011-05-19 00:06:34.000000000 -0400
27063+++ linux-2.6.39.1/drivers/atm/nicstar.c 2011-05-22 19:36:31.000000000 -0400
27064@@ -1654,7 +1654,7 @@ static int ns_send(struct atm_vcc *vcc,
27065 if ((vc = (vc_map *) vcc->dev_data) == NULL) {
27066 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n",
27067 card->index);
27068- atomic_inc(&vcc->stats->tx_err);
27069+ atomic_inc_unchecked(&vcc->stats->tx_err);
27070 dev_kfree_skb_any(skb);
27071 return -EINVAL;
27072 }
27073@@ -1662,7 +1662,7 @@ static int ns_send(struct atm_vcc *vcc,
27074 if (!vc->tx) {
27075 printk("nicstar%d: Trying to transmit on a non-tx VC.\n",
27076 card->index);
27077- atomic_inc(&vcc->stats->tx_err);
27078+ atomic_inc_unchecked(&vcc->stats->tx_err);
27079 dev_kfree_skb_any(skb);
27080 return -EINVAL;
27081 }
27082@@ -1670,14 +1670,14 @@ static int ns_send(struct atm_vcc *vcc,
27083 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0) {
27084 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n",
27085 card->index);
27086- atomic_inc(&vcc->stats->tx_err);
27087+ atomic_inc_unchecked(&vcc->stats->tx_err);
27088 dev_kfree_skb_any(skb);
27089 return -EINVAL;
27090 }
27091
27092 if (skb_shinfo(skb)->nr_frags != 0) {
27093 printk("nicstar%d: No scatter-gather yet.\n", card->index);
27094- atomic_inc(&vcc->stats->tx_err);
27095+ atomic_inc_unchecked(&vcc->stats->tx_err);
27096 dev_kfree_skb_any(skb);
27097 return -EINVAL;
27098 }
27099@@ -1725,11 +1725,11 @@ static int ns_send(struct atm_vcc *vcc,
27100 }
27101
27102 if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
27103- atomic_inc(&vcc->stats->tx_err);
27104+ atomic_inc_unchecked(&vcc->stats->tx_err);
27105 dev_kfree_skb_any(skb);
27106 return -EIO;
27107 }
27108- atomic_inc(&vcc->stats->tx);
27109+ atomic_inc_unchecked(&vcc->stats->tx);
27110
27111 return 0;
27112 }
27113@@ -2046,14 +2046,14 @@ static void dequeue_rx(ns_dev * card, ns
27114 printk
27115 ("nicstar%d: Can't allocate buffers for aal0.\n",
27116 card->index);
27117- atomic_add(i, &vcc->stats->rx_drop);
27118+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
27119 break;
27120 }
27121 if (!atm_charge(vcc, sb->truesize)) {
27122 RXPRINTK
27123 ("nicstar%d: atm_charge() dropped aal0 packets.\n",
27124 card->index);
27125- atomic_add(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
27126+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
27127 dev_kfree_skb_any(sb);
27128 break;
27129 }
27130@@ -2068,7 +2068,7 @@ static void dequeue_rx(ns_dev * card, ns
27131 ATM_SKB(sb)->vcc = vcc;
27132 __net_timestamp(sb);
27133 vcc->push(vcc, sb);
27134- atomic_inc(&vcc->stats->rx);
27135+ atomic_inc_unchecked(&vcc->stats->rx);
27136 cell += ATM_CELL_PAYLOAD;
27137 }
27138
27139@@ -2085,7 +2085,7 @@ static void dequeue_rx(ns_dev * card, ns
27140 if (iovb == NULL) {
27141 printk("nicstar%d: Out of iovec buffers.\n",
27142 card->index);
27143- atomic_inc(&vcc->stats->rx_drop);
27144+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27145 recycle_rx_buf(card, skb);
27146 return;
27147 }
27148@@ -2109,7 +2109,7 @@ static void dequeue_rx(ns_dev * card, ns
27149 small or large buffer itself. */
27150 } else if (NS_PRV_IOVCNT(iovb) >= NS_MAX_IOVECS) {
27151 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
27152- atomic_inc(&vcc->stats->rx_err);
27153+ atomic_inc_unchecked(&vcc->stats->rx_err);
27154 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
27155 NS_MAX_IOVECS);
27156 NS_PRV_IOVCNT(iovb) = 0;
27157@@ -2129,7 +2129,7 @@ static void dequeue_rx(ns_dev * card, ns
27158 ("nicstar%d: Expected a small buffer, and this is not one.\n",
27159 card->index);
27160 which_list(card, skb);
27161- atomic_inc(&vcc->stats->rx_err);
27162+ atomic_inc_unchecked(&vcc->stats->rx_err);
27163 recycle_rx_buf(card, skb);
27164 vc->rx_iov = NULL;
27165 recycle_iov_buf(card, iovb);
27166@@ -2142,7 +2142,7 @@ static void dequeue_rx(ns_dev * card, ns
27167 ("nicstar%d: Expected a large buffer, and this is not one.\n",
27168 card->index);
27169 which_list(card, skb);
27170- atomic_inc(&vcc->stats->rx_err);
27171+ atomic_inc_unchecked(&vcc->stats->rx_err);
27172 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
27173 NS_PRV_IOVCNT(iovb));
27174 vc->rx_iov = NULL;
27175@@ -2165,7 +2165,7 @@ static void dequeue_rx(ns_dev * card, ns
27176 printk(" - PDU size mismatch.\n");
27177 else
27178 printk(".\n");
27179- atomic_inc(&vcc->stats->rx_err);
27180+ atomic_inc_unchecked(&vcc->stats->rx_err);
27181 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
27182 NS_PRV_IOVCNT(iovb));
27183 vc->rx_iov = NULL;
27184@@ -2179,7 +2179,7 @@ static void dequeue_rx(ns_dev * card, ns
27185 /* skb points to a small buffer */
27186 if (!atm_charge(vcc, skb->truesize)) {
27187 push_rxbufs(card, skb);
27188- atomic_inc(&vcc->stats->rx_drop);
27189+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27190 } else {
27191 skb_put(skb, len);
27192 dequeue_sm_buf(card, skb);
27193@@ -2189,7 +2189,7 @@ static void dequeue_rx(ns_dev * card, ns
27194 ATM_SKB(skb)->vcc = vcc;
27195 __net_timestamp(skb);
27196 vcc->push(vcc, skb);
27197- atomic_inc(&vcc->stats->rx);
27198+ atomic_inc_unchecked(&vcc->stats->rx);
27199 }
27200 } else if (NS_PRV_IOVCNT(iovb) == 2) { /* One small plus one large buffer */
27201 struct sk_buff *sb;
27202@@ -2200,7 +2200,7 @@ static void dequeue_rx(ns_dev * card, ns
27203 if (len <= NS_SMBUFSIZE) {
27204 if (!atm_charge(vcc, sb->truesize)) {
27205 push_rxbufs(card, sb);
27206- atomic_inc(&vcc->stats->rx_drop);
27207+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27208 } else {
27209 skb_put(sb, len);
27210 dequeue_sm_buf(card, sb);
27211@@ -2210,7 +2210,7 @@ static void dequeue_rx(ns_dev * card, ns
27212 ATM_SKB(sb)->vcc = vcc;
27213 __net_timestamp(sb);
27214 vcc->push(vcc, sb);
27215- atomic_inc(&vcc->stats->rx);
27216+ atomic_inc_unchecked(&vcc->stats->rx);
27217 }
27218
27219 push_rxbufs(card, skb);
27220@@ -2219,7 +2219,7 @@ static void dequeue_rx(ns_dev * card, ns
27221
27222 if (!atm_charge(vcc, skb->truesize)) {
27223 push_rxbufs(card, skb);
27224- atomic_inc(&vcc->stats->rx_drop);
27225+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27226 } else {
27227 dequeue_lg_buf(card, skb);
27228 #ifdef NS_USE_DESTRUCTORS
27229@@ -2232,7 +2232,7 @@ static void dequeue_rx(ns_dev * card, ns
27230 ATM_SKB(skb)->vcc = vcc;
27231 __net_timestamp(skb);
27232 vcc->push(vcc, skb);
27233- atomic_inc(&vcc->stats->rx);
27234+ atomic_inc_unchecked(&vcc->stats->rx);
27235 }
27236
27237 push_rxbufs(card, sb);
27238@@ -2253,7 +2253,7 @@ static void dequeue_rx(ns_dev * card, ns
27239 printk
27240 ("nicstar%d: Out of huge buffers.\n",
27241 card->index);
27242- atomic_inc(&vcc->stats->rx_drop);
27243+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27244 recycle_iovec_rx_bufs(card,
27245 (struct iovec *)
27246 iovb->data,
27247@@ -2304,7 +2304,7 @@ static void dequeue_rx(ns_dev * card, ns
27248 card->hbpool.count++;
27249 } else
27250 dev_kfree_skb_any(hb);
27251- atomic_inc(&vcc->stats->rx_drop);
27252+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27253 } else {
27254 /* Copy the small buffer to the huge buffer */
27255 sb = (struct sk_buff *)iov->iov_base;
27256@@ -2341,7 +2341,7 @@ static void dequeue_rx(ns_dev * card, ns
27257 #endif /* NS_USE_DESTRUCTORS */
27258 __net_timestamp(hb);
27259 vcc->push(vcc, hb);
27260- atomic_inc(&vcc->stats->rx);
27261+ atomic_inc_unchecked(&vcc->stats->rx);
27262 }
27263 }
27264
27265diff -urNp linux-2.6.39.1/drivers/atm/solos-pci.c linux-2.6.39.1/drivers/atm/solos-pci.c
27266--- linux-2.6.39.1/drivers/atm/solos-pci.c 2011-05-19 00:06:34.000000000 -0400
27267+++ linux-2.6.39.1/drivers/atm/solos-pci.c 2011-05-22 19:36:31.000000000 -0400
27268@@ -715,7 +715,7 @@ void solos_bh(unsigned long card_arg)
27269 }
27270 atm_charge(vcc, skb->truesize);
27271 vcc->push(vcc, skb);
27272- atomic_inc(&vcc->stats->rx);
27273+ atomic_inc_unchecked(&vcc->stats->rx);
27274 break;
27275
27276 case PKT_STATUS:
27277@@ -900,6 +900,8 @@ static int print_buffer(struct sk_buff *
27278 char msg[500];
27279 char item[10];
27280
27281+ pax_track_stack();
27282+
27283 len = buf->len;
27284 for (i = 0; i < len; i++){
27285 if(i % 8 == 0)
27286@@ -1009,7 +1011,7 @@ static uint32_t fpga_tx(struct solos_car
27287 vcc = SKB_CB(oldskb)->vcc;
27288
27289 if (vcc) {
27290- atomic_inc(&vcc->stats->tx);
27291+ atomic_inc_unchecked(&vcc->stats->tx);
27292 solos_pop(vcc, oldskb);
27293 } else
27294 dev_kfree_skb_irq(oldskb);
27295diff -urNp linux-2.6.39.1/drivers/atm/suni.c linux-2.6.39.1/drivers/atm/suni.c
27296--- linux-2.6.39.1/drivers/atm/suni.c 2011-05-19 00:06:34.000000000 -0400
27297+++ linux-2.6.39.1/drivers/atm/suni.c 2011-05-22 19:36:31.000000000 -0400
27298@@ -50,8 +50,8 @@ static DEFINE_SPINLOCK(sunis_lock);
27299
27300
27301 #define ADD_LIMITED(s,v) \
27302- atomic_add((v),&stats->s); \
27303- if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
27304+ atomic_add_unchecked((v),&stats->s); \
27305+ if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
27306
27307
27308 static void suni_hz(unsigned long from_timer)
27309diff -urNp linux-2.6.39.1/drivers/atm/uPD98402.c linux-2.6.39.1/drivers/atm/uPD98402.c
27310--- linux-2.6.39.1/drivers/atm/uPD98402.c 2011-05-19 00:06:34.000000000 -0400
27311+++ linux-2.6.39.1/drivers/atm/uPD98402.c 2011-05-22 19:36:31.000000000 -0400
27312@@ -42,7 +42,7 @@ static int fetch_stats(struct atm_dev *d
27313 struct sonet_stats tmp;
27314 int error = 0;
27315
27316- atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
27317+ atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
27318 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
27319 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
27320 if (zero && !error) {
27321@@ -161,9 +161,9 @@ static int uPD98402_ioctl(struct atm_dev
27322
27323
27324 #define ADD_LIMITED(s,v) \
27325- { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
27326- if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
27327- atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
27328+ { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
27329+ if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
27330+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
27331
27332
27333 static void stat_event(struct atm_dev *dev)
27334@@ -194,7 +194,7 @@ static void uPD98402_int(struct atm_dev
27335 if (reason & uPD98402_INT_PFM) stat_event(dev);
27336 if (reason & uPD98402_INT_PCO) {
27337 (void) GET(PCOCR); /* clear interrupt cause */
27338- atomic_add(GET(HECCT),
27339+ atomic_add_unchecked(GET(HECCT),
27340 &PRIV(dev)->sonet_stats.uncorr_hcs);
27341 }
27342 if ((reason & uPD98402_INT_RFO) &&
27343@@ -222,9 +222,9 @@ static int uPD98402_start(struct atm_dev
27344 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
27345 uPD98402_INT_LOS),PIMR); /* enable them */
27346 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
27347- atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
27348- atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
27349- atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
27350+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
27351+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
27352+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
27353 return 0;
27354 }
27355
27356diff -urNp linux-2.6.39.1/drivers/atm/zatm.c linux-2.6.39.1/drivers/atm/zatm.c
27357--- linux-2.6.39.1/drivers/atm/zatm.c 2011-05-19 00:06:34.000000000 -0400
27358+++ linux-2.6.39.1/drivers/atm/zatm.c 2011-05-22 19:36:31.000000000 -0400
27359@@ -459,7 +459,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
27360 }
27361 if (!size) {
27362 dev_kfree_skb_irq(skb);
27363- if (vcc) atomic_inc(&vcc->stats->rx_err);
27364+ if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
27365 continue;
27366 }
27367 if (!atm_charge(vcc,skb->truesize)) {
27368@@ -469,7 +469,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
27369 skb->len = size;
27370 ATM_SKB(skb)->vcc = vcc;
27371 vcc->push(vcc,skb);
27372- atomic_inc(&vcc->stats->rx);
27373+ atomic_inc_unchecked(&vcc->stats->rx);
27374 }
27375 zout(pos & 0xffff,MTA(mbx));
27376 #if 0 /* probably a stupid idea */
27377@@ -733,7 +733,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
27378 skb_queue_head(&zatm_vcc->backlog,skb);
27379 break;
27380 }
27381- atomic_inc(&vcc->stats->tx);
27382+ atomic_inc_unchecked(&vcc->stats->tx);
27383 wake_up(&zatm_vcc->tx_wait);
27384 }
27385
27386diff -urNp linux-2.6.39.1/drivers/base/iommu.c linux-2.6.39.1/drivers/base/iommu.c
27387--- linux-2.6.39.1/drivers/base/iommu.c 2011-05-19 00:06:34.000000000 -0400
27388+++ linux-2.6.39.1/drivers/base/iommu.c 2011-05-22 19:36:31.000000000 -0400
27389@@ -23,9 +23,8 @@
27390 #include <linux/errno.h>
27391 #include <linux/iommu.h>
27392
27393-static struct iommu_ops *iommu_ops;
27394-
27395-void register_iommu(struct iommu_ops *ops)
27396+static const struct iommu_ops *iommu_ops;
27397+void register_iommu(const struct iommu_ops *ops)
27398 {
27399 if (iommu_ops)
27400 BUG();
27401diff -urNp linux-2.6.39.1/drivers/base/power/generic_ops.c linux-2.6.39.1/drivers/base/power/generic_ops.c
27402--- linux-2.6.39.1/drivers/base/power/generic_ops.c 2011-05-19 00:06:34.000000000 -0400
27403+++ linux-2.6.39.1/drivers/base/power/generic_ops.c 2011-05-22 19:36:31.000000000 -0400
27404@@ -215,7 +215,7 @@ int pm_generic_restore(struct device *de
27405 EXPORT_SYMBOL_GPL(pm_generic_restore);
27406 #endif /* CONFIG_PM_SLEEP */
27407
27408-struct dev_pm_ops generic_subsys_pm_ops = {
27409+const struct dev_pm_ops generic_subsys_pm_ops = {
27410 #ifdef CONFIG_PM_SLEEP
27411 .suspend = pm_generic_suspend,
27412 .resume = pm_generic_resume,
27413diff -urNp linux-2.6.39.1/drivers/base/power/wakeup.c linux-2.6.39.1/drivers/base/power/wakeup.c
27414--- linux-2.6.39.1/drivers/base/power/wakeup.c 2011-05-19 00:06:34.000000000 -0400
27415+++ linux-2.6.39.1/drivers/base/power/wakeup.c 2011-05-22 19:36:31.000000000 -0400
27416@@ -29,14 +29,14 @@ bool events_check_enabled;
27417 * They need to be modified together atomically, so it's better to use one
27418 * atomic variable to hold them both.
27419 */
27420-static atomic_t combined_event_count = ATOMIC_INIT(0);
27421+static atomic_unchecked_t combined_event_count = ATOMIC_INIT(0);
27422
27423 #define IN_PROGRESS_BITS (sizeof(int) * 4)
27424 #define MAX_IN_PROGRESS ((1 << IN_PROGRESS_BITS) - 1)
27425
27426 static void split_counters(unsigned int *cnt, unsigned int *inpr)
27427 {
27428- unsigned int comb = atomic_read(&combined_event_count);
27429+ unsigned int comb = atomic_read_unchecked(&combined_event_count);
27430
27431 *cnt = (comb >> IN_PROGRESS_BITS);
27432 *inpr = comb & MAX_IN_PROGRESS;
27433@@ -351,7 +351,7 @@ static void wakeup_source_activate(struc
27434 ws->last_time = ktime_get();
27435
27436 /* Increment the counter of events in progress. */
27437- atomic_inc(&combined_event_count);
27438+ atomic_inc_unchecked(&combined_event_count);
27439 }
27440
27441 /**
27442@@ -441,7 +441,7 @@ static void wakeup_source_deactivate(str
27443 * Increment the counter of registered wakeup events and decrement the
27444 * couter of wakeup events in progress simultaneously.
27445 */
27446- atomic_add(MAX_IN_PROGRESS, &combined_event_count);
27447+ atomic_add_unchecked(MAX_IN_PROGRESS, &combined_event_count);
27448 }
27449
27450 /**
27451diff -urNp linux-2.6.39.1/drivers/block/cciss.c linux-2.6.39.1/drivers/block/cciss.c
27452--- linux-2.6.39.1/drivers/block/cciss.c 2011-05-19 00:06:34.000000000 -0400
27453+++ linux-2.6.39.1/drivers/block/cciss.c 2011-05-22 19:41:32.000000000 -0400
27454@@ -103,7 +103,7 @@ MODULE_DEVICE_TABLE(pci, cciss_pci_devic
27455 * product = Marketing Name for the board
27456 * access = Address of the struct of function pointers
27457 */
27458-static struct board_type products[] = {
27459+static const struct board_type products[] = {
27460 {0x40700E11, "Smart Array 5300", &SA5_access},
27461 {0x40800E11, "Smart Array 5i", &SA5B_access},
27462 {0x40820E11, "Smart Array 532", &SA5B_access},
27463@@ -1151,6 +1151,8 @@ static int cciss_ioctl32_passthru(struct
27464 int err;
27465 u32 cp;
27466
27467+ memset(&arg64, 0, sizeof(arg64));
27468+
27469 err = 0;
27470 err |=
27471 copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
27472diff -urNp linux-2.6.39.1/drivers/block/cciss.h linux-2.6.39.1/drivers/block/cciss.h
27473--- linux-2.6.39.1/drivers/block/cciss.h 2011-05-19 00:06:34.000000000 -0400
27474+++ linux-2.6.39.1/drivers/block/cciss.h 2011-05-22 19:36:31.000000000 -0400
27475@@ -393,7 +393,7 @@ static bool SA5_performant_intr_pending(
27476 return register_value & SA5_OUTDB_STATUS_PERF_BIT;
27477 }
27478
27479-static struct access_method SA5_access = {
27480+static const struct access_method SA5_access = {
27481 SA5_submit_command,
27482 SA5_intr_mask,
27483 SA5_fifo_full,
27484@@ -401,7 +401,7 @@ static struct access_method SA5_access =
27485 SA5_completed,
27486 };
27487
27488-static struct access_method SA5B_access = {
27489+static const struct access_method SA5B_access = {
27490 SA5_submit_command,
27491 SA5B_intr_mask,
27492 SA5_fifo_full,
27493@@ -409,7 +409,7 @@ static struct access_method SA5B_access
27494 SA5_completed,
27495 };
27496
27497-static struct access_method SA5_performant_access = {
27498+static const struct access_method SA5_performant_access = {
27499 SA5_submit_command,
27500 SA5_performant_intr_mask,
27501 SA5_fifo_full,
27502@@ -420,7 +420,7 @@ static struct access_method SA5_performa
27503 struct board_type {
27504 __u32 board_id;
27505 char *product_name;
27506- struct access_method *access;
27507+ const struct access_method *access;
27508 int nr_cmds; /* Max cmds this kind of ctlr can handle. */
27509 };
27510
27511diff -urNp linux-2.6.39.1/drivers/block/cpqarray.c linux-2.6.39.1/drivers/block/cpqarray.c
27512--- linux-2.6.39.1/drivers/block/cpqarray.c 2011-05-19 00:06:34.000000000 -0400
27513+++ linux-2.6.39.1/drivers/block/cpqarray.c 2011-05-22 19:36:31.000000000 -0400
27514@@ -80,7 +80,7 @@ static int eisa[8];
27515 * product = Marketing Name for the board
27516 * access = Address of the struct of function pointers
27517 */
27518-static struct board_type products[] = {
27519+static const struct board_type products[] = {
27520 { 0x0040110E, "IDA", &smart1_access },
27521 { 0x0140110E, "IDA-2", &smart1_access },
27522 { 0x1040110E, "IAES", &smart1_access },
27523@@ -911,6 +911,8 @@ static void do_ida_request(struct reques
27524 struct scatterlist tmp_sg[SG_MAX];
27525 int i, dir, seg;
27526
27527+ pax_track_stack();
27528+
27529 queue_next:
27530 creq = blk_peek_request(q);
27531 if (!creq)
27532diff -urNp linux-2.6.39.1/drivers/block/cpqarray.h linux-2.6.39.1/drivers/block/cpqarray.h
27533--- linux-2.6.39.1/drivers/block/cpqarray.h 2011-05-19 00:06:34.000000000 -0400
27534+++ linux-2.6.39.1/drivers/block/cpqarray.h 2011-05-22 19:36:31.000000000 -0400
27535@@ -69,7 +69,7 @@ struct access_method {
27536 struct board_type {
27537 __u32 board_id;
27538 char *product_name;
27539- struct access_method *access;
27540+ const struct access_method *access;
27541 };
27542
27543 struct ctlr_info {
27544diff -urNp linux-2.6.39.1/drivers/block/DAC960.c linux-2.6.39.1/drivers/block/DAC960.c
27545--- linux-2.6.39.1/drivers/block/DAC960.c 2011-05-19 00:06:34.000000000 -0400
27546+++ linux-2.6.39.1/drivers/block/DAC960.c 2011-05-22 19:36:31.000000000 -0400
27547@@ -1980,6 +1980,8 @@ static bool DAC960_V1_ReadDeviceConfigur
27548 unsigned long flags;
27549 int Channel, TargetID;
27550
27551+ pax_track_stack();
27552+
27553 if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
27554 DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
27555 sizeof(DAC960_SCSI_Inquiry_T) +
27556diff -urNp linux-2.6.39.1/drivers/block/drbd/drbd_int.h linux-2.6.39.1/drivers/block/drbd/drbd_int.h
27557--- linux-2.6.39.1/drivers/block/drbd/drbd_int.h 2011-05-19 00:06:34.000000000 -0400
27558+++ linux-2.6.39.1/drivers/block/drbd/drbd_int.h 2011-05-22 19:36:31.000000000 -0400
27559@@ -736,7 +736,7 @@ struct drbd_request;
27560 struct drbd_epoch {
27561 struct list_head list;
27562 unsigned int barrier_nr;
27563- atomic_t epoch_size; /* increased on every request added. */
27564+ atomic_unchecked_t epoch_size; /* increased on every request added. */
27565 atomic_t active; /* increased on every req. added, and dec on every finished. */
27566 unsigned long flags;
27567 };
27568@@ -1108,7 +1108,7 @@ struct drbd_conf {
27569 void *int_dig_in;
27570 void *int_dig_vv;
27571 wait_queue_head_t seq_wait;
27572- atomic_t packet_seq;
27573+ atomic_unchecked_t packet_seq;
27574 unsigned int peer_seq;
27575 spinlock_t peer_seq_lock;
27576 unsigned int minor;
27577diff -urNp linux-2.6.39.1/drivers/block/drbd/drbd_main.c linux-2.6.39.1/drivers/block/drbd/drbd_main.c
27578--- linux-2.6.39.1/drivers/block/drbd/drbd_main.c 2011-05-19 00:06:34.000000000 -0400
27579+++ linux-2.6.39.1/drivers/block/drbd/drbd_main.c 2011-05-22 19:36:31.000000000 -0400
27580@@ -2387,7 +2387,7 @@ static int _drbd_send_ack(struct drbd_co
27581 p.sector = sector;
27582 p.block_id = block_id;
27583 p.blksize = blksize;
27584- p.seq_num = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq));
27585+ p.seq_num = cpu_to_be32(atomic_add_return_unchecked(1, &mdev->packet_seq));
27586
27587 if (!mdev->meta.socket || mdev->state.conn < C_CONNECTED)
27588 return false;
27589@@ -2686,7 +2686,7 @@ int drbd_send_dblock(struct drbd_conf *m
27590 p.sector = cpu_to_be64(req->sector);
27591 p.block_id = (unsigned long)req;
27592 p.seq_num = cpu_to_be32(req->seq_num =
27593- atomic_add_return(1, &mdev->packet_seq));
27594+ atomic_add_return_unchecked(1, &mdev->packet_seq));
27595
27596 dp_flags = bio_flags_to_wire(mdev, req->master_bio->bi_rw);
27597
27598@@ -2971,7 +2971,7 @@ void drbd_init_set_defaults(struct drbd_
27599 atomic_set(&mdev->unacked_cnt, 0);
27600 atomic_set(&mdev->local_cnt, 0);
27601 atomic_set(&mdev->net_cnt, 0);
27602- atomic_set(&mdev->packet_seq, 0);
27603+ atomic_set_unchecked(&mdev->packet_seq, 0);
27604 atomic_set(&mdev->pp_in_use, 0);
27605 atomic_set(&mdev->pp_in_use_by_net, 0);
27606 atomic_set(&mdev->rs_sect_in, 0);
27607@@ -3051,8 +3051,8 @@ void drbd_mdev_cleanup(struct drbd_conf
27608 mdev->receiver.t_state);
27609
27610 /* no need to lock it, I'm the only thread alive */
27611- if (atomic_read(&mdev->current_epoch->epoch_size) != 0)
27612- dev_err(DEV, "epoch_size:%d\n", atomic_read(&mdev->current_epoch->epoch_size));
27613+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size) != 0)
27614+ dev_err(DEV, "epoch_size:%d\n", atomic_read_unchecked(&mdev->current_epoch->epoch_size));
27615 mdev->al_writ_cnt =
27616 mdev->bm_writ_cnt =
27617 mdev->read_cnt =
27618diff -urNp linux-2.6.39.1/drivers/block/drbd/drbd_nl.c linux-2.6.39.1/drivers/block/drbd/drbd_nl.c
27619--- linux-2.6.39.1/drivers/block/drbd/drbd_nl.c 2011-05-19 00:06:34.000000000 -0400
27620+++ linux-2.6.39.1/drivers/block/drbd/drbd_nl.c 2011-05-22 19:36:31.000000000 -0400
27621@@ -2298,7 +2298,7 @@ static void drbd_connector_callback(stru
27622 module_put(THIS_MODULE);
27623 }
27624
27625-static atomic_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
27626+static atomic_unchecked_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
27627
27628 static unsigned short *
27629 __tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data,
27630@@ -2369,7 +2369,7 @@ void drbd_bcast_state(struct drbd_conf *
27631 cn_reply->id.idx = CN_IDX_DRBD;
27632 cn_reply->id.val = CN_VAL_DRBD;
27633
27634- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
27635+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
27636 cn_reply->ack = 0; /* not used here. */
27637 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27638 (int)((char *)tl - (char *)reply->tag_list);
27639@@ -2401,7 +2401,7 @@ void drbd_bcast_ev_helper(struct drbd_co
27640 cn_reply->id.idx = CN_IDX_DRBD;
27641 cn_reply->id.val = CN_VAL_DRBD;
27642
27643- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
27644+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
27645 cn_reply->ack = 0; /* not used here. */
27646 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27647 (int)((char *)tl - (char *)reply->tag_list);
27648@@ -2479,7 +2479,7 @@ void drbd_bcast_ee(struct drbd_conf *mde
27649 cn_reply->id.idx = CN_IDX_DRBD;
27650 cn_reply->id.val = CN_VAL_DRBD;
27651
27652- cn_reply->seq = atomic_add_return(1,&drbd_nl_seq);
27653+ cn_reply->seq = atomic_add_return_unchecked(1,&drbd_nl_seq);
27654 cn_reply->ack = 0; // not used here.
27655 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27656 (int)((char*)tl - (char*)reply->tag_list);
27657@@ -2518,7 +2518,7 @@ void drbd_bcast_sync_progress(struct drb
27658 cn_reply->id.idx = CN_IDX_DRBD;
27659 cn_reply->id.val = CN_VAL_DRBD;
27660
27661- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
27662+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
27663 cn_reply->ack = 0; /* not used here. */
27664 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27665 (int)((char *)tl - (char *)reply->tag_list);
27666diff -urNp linux-2.6.39.1/drivers/block/drbd/drbd_receiver.c linux-2.6.39.1/drivers/block/drbd/drbd_receiver.c
27667--- linux-2.6.39.1/drivers/block/drbd/drbd_receiver.c 2011-05-19 00:06:34.000000000 -0400
27668+++ linux-2.6.39.1/drivers/block/drbd/drbd_receiver.c 2011-05-22 19:36:31.000000000 -0400
27669@@ -894,7 +894,7 @@ retry:
27670 sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10;
27671 sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
27672
27673- atomic_set(&mdev->packet_seq, 0);
27674+ atomic_set_unchecked(&mdev->packet_seq, 0);
27675 mdev->peer_seq = 0;
27676
27677 drbd_thread_start(&mdev->asender);
27678@@ -990,7 +990,7 @@ static enum finish_epoch drbd_may_finish
27679 do {
27680 next_epoch = NULL;
27681
27682- epoch_size = atomic_read(&epoch->epoch_size);
27683+ epoch_size = atomic_read_unchecked(&epoch->epoch_size);
27684
27685 switch (ev & ~EV_CLEANUP) {
27686 case EV_PUT:
27687@@ -1025,7 +1025,7 @@ static enum finish_epoch drbd_may_finish
27688 rv = FE_DESTROYED;
27689 } else {
27690 epoch->flags = 0;
27691- atomic_set(&epoch->epoch_size, 0);
27692+ atomic_set_unchecked(&epoch->epoch_size, 0);
27693 /* atomic_set(&epoch->active, 0); is already zero */
27694 if (rv == FE_STILL_LIVE)
27695 rv = FE_RECYCLED;
27696@@ -1196,14 +1196,14 @@ static int receive_Barrier(struct drbd_c
27697 drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
27698 drbd_flush(mdev);
27699
27700- if (atomic_read(&mdev->current_epoch->epoch_size)) {
27701+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
27702 epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO);
27703 if (epoch)
27704 break;
27705 }
27706
27707 epoch = mdev->current_epoch;
27708- wait_event(mdev->ee_wait, atomic_read(&epoch->epoch_size) == 0);
27709+ wait_event(mdev->ee_wait, atomic_read_unchecked(&epoch->epoch_size) == 0);
27710
27711 D_ASSERT(atomic_read(&epoch->active) == 0);
27712 D_ASSERT(epoch->flags == 0);
27713@@ -1215,11 +1215,11 @@ static int receive_Barrier(struct drbd_c
27714 }
27715
27716 epoch->flags = 0;
27717- atomic_set(&epoch->epoch_size, 0);
27718+ atomic_set_unchecked(&epoch->epoch_size, 0);
27719 atomic_set(&epoch->active, 0);
27720
27721 spin_lock(&mdev->epoch_lock);
27722- if (atomic_read(&mdev->current_epoch->epoch_size)) {
27723+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
27724 list_add(&epoch->list, &mdev->current_epoch->list);
27725 mdev->current_epoch = epoch;
27726 mdev->epochs++;
27727@@ -1668,7 +1668,7 @@ static int receive_Data(struct drbd_conf
27728 spin_unlock(&mdev->peer_seq_lock);
27729
27730 drbd_send_ack_dp(mdev, P_NEG_ACK, p, data_size);
27731- atomic_inc(&mdev->current_epoch->epoch_size);
27732+ atomic_inc_unchecked(&mdev->current_epoch->epoch_size);
27733 return drbd_drain_block(mdev, data_size);
27734 }
27735
27736@@ -1694,7 +1694,7 @@ static int receive_Data(struct drbd_conf
27737
27738 spin_lock(&mdev->epoch_lock);
27739 e->epoch = mdev->current_epoch;
27740- atomic_inc(&e->epoch->epoch_size);
27741+ atomic_inc_unchecked(&e->epoch->epoch_size);
27742 atomic_inc(&e->epoch->active);
27743 spin_unlock(&mdev->epoch_lock);
27744
27745@@ -3905,7 +3905,7 @@ static void drbd_disconnect(struct drbd_
27746 D_ASSERT(list_empty(&mdev->done_ee));
27747
27748 /* ok, no more ee's on the fly, it is safe to reset the epoch_size */
27749- atomic_set(&mdev->current_epoch->epoch_size, 0);
27750+ atomic_set_unchecked(&mdev->current_epoch->epoch_size, 0);
27751 D_ASSERT(list_empty(&mdev->current_epoch->list));
27752 }
27753
27754diff -urNp linux-2.6.39.1/drivers/block/nbd.c linux-2.6.39.1/drivers/block/nbd.c
27755--- linux-2.6.39.1/drivers/block/nbd.c 2011-05-19 00:06:34.000000000 -0400
27756+++ linux-2.6.39.1/drivers/block/nbd.c 2011-05-22 19:36:31.000000000 -0400
27757@@ -157,6 +157,8 @@ static int sock_xmit(struct nbd_device *
27758 struct kvec iov;
27759 sigset_t blocked, oldset;
27760
27761+ pax_track_stack();
27762+
27763 if (unlikely(!sock)) {
27764 printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
27765 lo->disk->disk_name, (send ? "send" : "recv"));
27766@@ -571,6 +573,8 @@ static void do_nbd_request(struct reques
27767 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
27768 unsigned int cmd, unsigned long arg)
27769 {
27770+ pax_track_stack();
27771+
27772 switch (cmd) {
27773 case NBD_DISCONNECT: {
27774 struct request sreq;
27775diff -urNp linux-2.6.39.1/drivers/block/smart1,2.h linux-2.6.39.1/drivers/block/smart1,2.h
27776--- linux-2.6.39.1/drivers/block/smart1,2.h 2011-05-19 00:06:34.000000000 -0400
27777+++ linux-2.6.39.1/drivers/block/smart1,2.h 2011-05-22 19:36:31.000000000 -0400
27778@@ -107,7 +107,7 @@ static unsigned long smart4_intr_pending
27779 return 0 ;
27780 }
27781
27782-static struct access_method smart4_access = {
27783+static const struct access_method smart4_access = {
27784 smart4_submit_command,
27785 smart4_intr_mask,
27786 smart4_fifo_full,
27787@@ -143,7 +143,7 @@ static unsigned long smart2_intr_pending
27788 return readl(h->vaddr + INTR_PENDING);
27789 }
27790
27791-static struct access_method smart2_access = {
27792+static const struct access_method smart2_access = {
27793 smart2_submit_command,
27794 smart2_intr_mask,
27795 smart2_fifo_full,
27796@@ -179,7 +179,7 @@ static unsigned long smart2e_intr_pendin
27797 return inl(h->io_mem_addr + INTR_PENDING);
27798 }
27799
27800-static struct access_method smart2e_access = {
27801+static const struct access_method smart2e_access = {
27802 smart2e_submit_command,
27803 smart2e_intr_mask,
27804 smart2e_fifo_full,
27805@@ -269,7 +269,7 @@ static unsigned long smart1_intr_pending
27806 return chan;
27807 }
27808
27809-static struct access_method smart1_access = {
27810+static const struct access_method smart1_access = {
27811 smart1_submit_command,
27812 smart1_intr_mask,
27813 smart1_fifo_full,
27814diff -urNp linux-2.6.39.1/drivers/block/xsysace.c linux-2.6.39.1/drivers/block/xsysace.c
27815--- linux-2.6.39.1/drivers/block/xsysace.c 2011-05-19 00:06:34.000000000 -0400
27816+++ linux-2.6.39.1/drivers/block/xsysace.c 2011-05-22 19:36:31.000000000 -0400
27817@@ -262,7 +262,7 @@ static void ace_dataout_8(struct ace_dev
27818 ace->data_ptr = src;
27819 }
27820
27821-static struct ace_reg_ops ace_reg_8_ops = {
27822+static const struct ace_reg_ops ace_reg_8_ops = {
27823 .in = ace_in_8,
27824 .out = ace_out_8,
27825 .datain = ace_datain_8,
27826@@ -327,14 +327,14 @@ static void ace_dataout_le16(struct ace_
27827 ace->data_ptr = src;
27828 }
27829
27830-static struct ace_reg_ops ace_reg_be16_ops = {
27831+static const struct ace_reg_ops ace_reg_be16_ops = {
27832 .in = ace_in_be16,
27833 .out = ace_out_be16,
27834 .datain = ace_datain_be16,
27835 .dataout = ace_dataout_be16,
27836 };
27837
27838-static struct ace_reg_ops ace_reg_le16_ops = {
27839+static const struct ace_reg_ops ace_reg_le16_ops = {
27840 .in = ace_in_le16,
27841 .out = ace_out_le16,
27842 .datain = ace_datain_le16,
27843diff -urNp linux-2.6.39.1/drivers/char/agp/frontend.c linux-2.6.39.1/drivers/char/agp/frontend.c
27844--- linux-2.6.39.1/drivers/char/agp/frontend.c 2011-05-19 00:06:34.000000000 -0400
27845+++ linux-2.6.39.1/drivers/char/agp/frontend.c 2011-05-22 19:36:31.000000000 -0400
27846@@ -817,7 +817,7 @@ static int agpioc_reserve_wrap(struct ag
27847 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
27848 return -EFAULT;
27849
27850- if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
27851+ if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
27852 return -EFAULT;
27853
27854 client = agp_find_client_by_pid(reserve.pid);
27855diff -urNp linux-2.6.39.1/drivers/char/briq_panel.c linux-2.6.39.1/drivers/char/briq_panel.c
27856--- linux-2.6.39.1/drivers/char/briq_panel.c 2011-05-19 00:06:34.000000000 -0400
27857+++ linux-2.6.39.1/drivers/char/briq_panel.c 2011-05-22 19:41:32.000000000 -0400
27858@@ -9,6 +9,7 @@
27859 #include <linux/types.h>
27860 #include <linux/errno.h>
27861 #include <linux/tty.h>
27862+#include <linux/mutex.h>
27863 #include <linux/timer.h>
27864 #include <linux/kernel.h>
27865 #include <linux/wait.h>
27866@@ -34,6 +35,7 @@ static int vfd_is_open;
27867 static unsigned char vfd[40];
27868 static int vfd_cursor;
27869 static unsigned char ledpb, led;
27870+static DEFINE_MUTEX(vfd_mutex);
27871
27872 static void update_vfd(void)
27873 {
27874@@ -140,12 +142,15 @@ static ssize_t briq_panel_write(struct f
27875 if (!vfd_is_open)
27876 return -EBUSY;
27877
27878+ mutex_lock(&vfd_mutex);
27879 for (;;) {
27880 char c;
27881 if (!indx)
27882 break;
27883- if (get_user(c, buf))
27884+ if (get_user(c, buf)) {
27885+ mutex_unlock(&vfd_mutex);
27886 return -EFAULT;
27887+ }
27888 if (esc) {
27889 set_led(c);
27890 esc = 0;
27891@@ -175,6 +180,7 @@ static ssize_t briq_panel_write(struct f
27892 buf++;
27893 }
27894 update_vfd();
27895+ mutex_unlock(&vfd_mutex);
27896
27897 return len;
27898 }
27899diff -urNp linux-2.6.39.1/drivers/char/genrtc.c linux-2.6.39.1/drivers/char/genrtc.c
27900--- linux-2.6.39.1/drivers/char/genrtc.c 2011-05-19 00:06:34.000000000 -0400
27901+++ linux-2.6.39.1/drivers/char/genrtc.c 2011-05-22 19:41:32.000000000 -0400
27902@@ -273,6 +273,7 @@ static int gen_rtc_ioctl(struct file *fi
27903 switch (cmd) {
27904
27905 case RTC_PLL_GET:
27906+ memset(&pll, 0, sizeof(pll));
27907 if (get_rtc_pll(&pll))
27908 return -EINVAL;
27909 else
27910diff -urNp linux-2.6.39.1/drivers/char/hpet.c linux-2.6.39.1/drivers/char/hpet.c
27911--- linux-2.6.39.1/drivers/char/hpet.c 2011-05-19 00:06:34.000000000 -0400
27912+++ linux-2.6.39.1/drivers/char/hpet.c 2011-05-22 19:36:31.000000000 -0400
27913@@ -553,7 +553,7 @@ static inline unsigned long hpet_time_di
27914 }
27915
27916 static int
27917-hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
27918+hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg,
27919 struct hpet_info *info)
27920 {
27921 struct hpet_timer __iomem *timer;
27922diff -urNp linux-2.6.39.1/drivers/char/ipmi/ipmi_devintf.c linux-2.6.39.1/drivers/char/ipmi/ipmi_devintf.c
27923--- linux-2.6.39.1/drivers/char/ipmi/ipmi_devintf.c 2011-05-19 00:06:34.000000000 -0400
27924+++ linux-2.6.39.1/drivers/char/ipmi/ipmi_devintf.c 2011-05-22 19:36:31.000000000 -0400
27925@@ -109,8 +109,7 @@ static int ipmi_fasync(int fd, struct fi
27926 return (result);
27927 }
27928
27929-static struct ipmi_user_hndl ipmi_hndlrs =
27930-{
27931+static const struct ipmi_user_hndl ipmi_hndlrs = {
27932 .ipmi_recv_hndl = file_receive_handler,
27933 };
27934
27935diff -urNp linux-2.6.39.1/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.39.1/drivers/char/ipmi/ipmi_msghandler.c
27936--- linux-2.6.39.1/drivers/char/ipmi/ipmi_msghandler.c 2011-05-19 00:06:34.000000000 -0400
27937+++ linux-2.6.39.1/drivers/char/ipmi/ipmi_msghandler.c 2011-05-22 19:36:31.000000000 -0400
27938@@ -82,7 +82,7 @@ struct ipmi_user {
27939 struct kref refcount;
27940
27941 /* The upper layer that handles receive messages. */
27942- struct ipmi_user_hndl *handler;
27943+ const struct ipmi_user_hndl *handler;
27944 void *handler_data;
27945
27946 /* The interface this user is bound to. */
27947@@ -414,7 +414,7 @@ struct ipmi_smi {
27948 struct proc_dir_entry *proc_dir;
27949 char proc_dir_name[10];
27950
27951- atomic_t stats[IPMI_NUM_STATS];
27952+ atomic_unchecked_t stats[IPMI_NUM_STATS];
27953
27954 /*
27955 * run_to_completion duplicate of smb_info, smi_info
27956@@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
27957
27958
27959 #define ipmi_inc_stat(intf, stat) \
27960- atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
27961+ atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
27962 #define ipmi_get_stat(intf, stat) \
27963- ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
27964+ ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
27965
27966 static int is_lan_addr(struct ipmi_addr *addr)
27967 {
27968@@ -875,7 +875,7 @@ static int intf_err_seq(ipmi_smi_t int
27969
27970
27971 int ipmi_create_user(unsigned int if_num,
27972- struct ipmi_user_hndl *handler,
27973+ const struct ipmi_user_hndl *handler,
27974 void *handler_data,
27975 ipmi_user_t *user)
27976 {
27977@@ -2844,7 +2844,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
27978 INIT_LIST_HEAD(&intf->cmd_rcvrs);
27979 init_waitqueue_head(&intf->waitq);
27980 for (i = 0; i < IPMI_NUM_STATS; i++)
27981- atomic_set(&intf->stats[i], 0);
27982+ atomic_set_unchecked(&intf->stats[i], 0);
27983
27984 intf->proc_dir = NULL;
27985
27986@@ -4196,6 +4196,8 @@ static void send_panic_events(char *str)
27987 struct ipmi_smi_msg smi_msg;
27988 struct ipmi_recv_msg recv_msg;
27989
27990+ pax_track_stack();
27991+
27992 si = (struct ipmi_system_interface_addr *) &addr;
27993 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
27994 si->channel = IPMI_BMC_CHANNEL;
27995diff -urNp linux-2.6.39.1/drivers/char/ipmi/ipmi_poweroff.c linux-2.6.39.1/drivers/char/ipmi/ipmi_poweroff.c
27996--- linux-2.6.39.1/drivers/char/ipmi/ipmi_poweroff.c 2011-05-19 00:06:34.000000000 -0400
27997+++ linux-2.6.39.1/drivers/char/ipmi/ipmi_poweroff.c 2011-05-22 19:36:31.000000000 -0400
27998@@ -133,7 +133,7 @@ static void receive_handler(struct ipmi_
27999 complete(comp);
28000 }
28001
28002-static struct ipmi_user_hndl ipmi_poweroff_handler = {
28003+static const struct ipmi_user_hndl ipmi_poweroff_handler = {
28004 .ipmi_recv_hndl = receive_handler
28005 };
28006
28007diff -urNp linux-2.6.39.1/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.39.1/drivers/char/ipmi/ipmi_si_intf.c
28008--- linux-2.6.39.1/drivers/char/ipmi/ipmi_si_intf.c 2011-05-19 00:06:34.000000000 -0400
28009+++ linux-2.6.39.1/drivers/char/ipmi/ipmi_si_intf.c 2011-05-22 19:36:31.000000000 -0400
28010@@ -276,7 +276,7 @@ struct smi_info {
28011 unsigned char slave_addr;
28012
28013 /* Counters and things for the proc filesystem. */
28014- atomic_t stats[SI_NUM_STATS];
28015+ atomic_unchecked_t stats[SI_NUM_STATS];
28016
28017 struct task_struct *thread;
28018
28019@@ -285,9 +285,9 @@ struct smi_info {
28020 };
28021
28022 #define smi_inc_stat(smi, stat) \
28023- atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
28024+ atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
28025 #define smi_get_stat(smi, stat) \
28026- ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
28027+ ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
28028
28029 #define SI_MAX_PARMS 4
28030
28031@@ -3198,7 +3198,7 @@ static int try_smi_init(struct smi_info
28032 atomic_set(&new_smi->req_events, 0);
28033 new_smi->run_to_completion = 0;
28034 for (i = 0; i < SI_NUM_STATS; i++)
28035- atomic_set(&new_smi->stats[i], 0);
28036+ atomic_set_unchecked(&new_smi->stats[i], 0);
28037
28038 new_smi->interrupt_disabled = 1;
28039 atomic_set(&new_smi->stop_operation, 0);
28040diff -urNp linux-2.6.39.1/drivers/char/ipmi/ipmi_watchdog.c linux-2.6.39.1/drivers/char/ipmi/ipmi_watchdog.c
28041--- linux-2.6.39.1/drivers/char/ipmi/ipmi_watchdog.c 2011-05-19 00:06:34.000000000 -0400
28042+++ linux-2.6.39.1/drivers/char/ipmi/ipmi_watchdog.c 2011-05-22 19:36:31.000000000 -0400
28043@@ -216,7 +216,7 @@ static int set_param_timeout(const char
28044 return rv;
28045 }
28046
28047-static struct kernel_param_ops param_ops_timeout = {
28048+static const struct kernel_param_ops param_ops_timeout = {
28049 .set = set_param_timeout,
28050 .get = param_get_int,
28051 };
28052@@ -278,14 +278,14 @@ static int set_param_wdog_ifnum(const ch
28053 return 0;
28054 }
28055
28056-static struct kernel_param_ops param_ops_wdog_ifnum = {
28057+static const struct kernel_param_ops param_ops_wdog_ifnum = {
28058 .set = set_param_wdog_ifnum,
28059 .get = param_get_int,
28060 };
28061
28062 #define param_check_wdog_ifnum param_check_int
28063
28064-static struct kernel_param_ops param_ops_str = {
28065+static const struct kernel_param_ops param_ops_str = {
28066 .set = set_param_str,
28067 .get = get_param_str,
28068 };
28069@@ -953,7 +953,7 @@ static void ipmi_wdog_pretimeout_handler
28070 pretimeout_since_last_heartbeat = 1;
28071 }
28072
28073-static struct ipmi_user_hndl ipmi_hndlrs = {
28074+static const struct ipmi_user_hndl ipmi_hndlrs = {
28075 .ipmi_recv_hndl = ipmi_wdog_msg_handler,
28076 .ipmi_watchdog_pretimeout = ipmi_wdog_pretimeout_handler
28077 };
28078diff -urNp linux-2.6.39.1/drivers/char/Kconfig linux-2.6.39.1/drivers/char/Kconfig
28079--- linux-2.6.39.1/drivers/char/Kconfig 2011-05-19 00:06:34.000000000 -0400
28080+++ linux-2.6.39.1/drivers/char/Kconfig 2011-05-22 19:41:37.000000000 -0400
28081@@ -8,7 +8,8 @@ source "drivers/tty/Kconfig"
28082
28083 config DEVKMEM
28084 bool "/dev/kmem virtual device support"
28085- default y
28086+ default n
28087+ depends on !GRKERNSEC_KMEM
28088 help
28089 Say Y here if you want to support the /dev/kmem device. The
28090 /dev/kmem device is rarely used, but can be used for certain
28091@@ -596,6 +597,7 @@ config DEVPORT
28092 bool
28093 depends on !M68K
28094 depends on ISA || PCI
28095+ depends on !GRKERNSEC_KMEM
28096 default y
28097
28098 source "drivers/s390/char/Kconfig"
28099diff -urNp linux-2.6.39.1/drivers/char/mem.c linux-2.6.39.1/drivers/char/mem.c
28100--- linux-2.6.39.1/drivers/char/mem.c 2011-05-19 00:06:34.000000000 -0400
28101+++ linux-2.6.39.1/drivers/char/mem.c 2011-05-22 19:41:37.000000000 -0400
28102@@ -18,6 +18,7 @@
28103 #include <linux/raw.h>
28104 #include <linux/tty.h>
28105 #include <linux/capability.h>
28106+#include <linux/security.h>
28107 #include <linux/ptrace.h>
28108 #include <linux/device.h>
28109 #include <linux/highmem.h>
28110@@ -34,6 +35,10 @@
28111 # include <linux/efi.h>
28112 #endif
28113
28114+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
28115+extern struct file_operations grsec_fops;
28116+#endif
28117+
28118 static inline unsigned long size_inside_page(unsigned long start,
28119 unsigned long size)
28120 {
28121@@ -65,9 +70,13 @@ static inline int range_is_allowed(unsig
28122
28123 while (cursor < to) {
28124 if (!devmem_is_allowed(pfn)) {
28125+#ifdef CONFIG_GRKERNSEC_KMEM
28126+ gr_handle_mem_readwrite(from, to);
28127+#else
28128 printk(KERN_INFO
28129 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
28130 current->comm, from, to);
28131+#endif
28132 return 0;
28133 }
28134 cursor += PAGE_SIZE;
28135@@ -75,6 +84,11 @@ static inline int range_is_allowed(unsig
28136 }
28137 return 1;
28138 }
28139+#elif defined(CONFIG_GRKERNSEC_KMEM)
28140+static inline int range_is_allowed(unsigned long pfn, unsigned long size)
28141+{
28142+ return 0;
28143+}
28144 #else
28145 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
28146 {
28147@@ -117,6 +131,7 @@ static ssize_t read_mem(struct file *fil
28148
28149 while (count > 0) {
28150 unsigned long remaining;
28151+ char *temp;
28152
28153 sz = size_inside_page(p, count);
28154
28155@@ -132,7 +147,23 @@ static ssize_t read_mem(struct file *fil
28156 if (!ptr)
28157 return -EFAULT;
28158
28159- remaining = copy_to_user(buf, ptr, sz);
28160+#ifdef CONFIG_PAX_USERCOPY
28161+ temp = kmalloc(sz, GFP_KERNEL);
28162+ if (!temp) {
28163+ unxlate_dev_mem_ptr(p, ptr);
28164+ return -ENOMEM;
28165+ }
28166+ memcpy(temp, ptr, sz);
28167+#else
28168+ temp = ptr;
28169+#endif
28170+
28171+ remaining = copy_to_user(buf, temp, sz);
28172+
28173+#ifdef CONFIG_PAX_USERCOPY
28174+ kfree(temp);
28175+#endif
28176+
28177 unxlate_dev_mem_ptr(p, ptr);
28178 if (remaining)
28179 return -EFAULT;
28180@@ -395,9 +426,8 @@ static ssize_t read_kmem(struct file *fi
28181 size_t count, loff_t *ppos)
28182 {
28183 unsigned long p = *ppos;
28184- ssize_t low_count, read, sz;
28185+ ssize_t low_count, read, sz, err = 0;
28186 char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
28187- int err = 0;
28188
28189 read = 0;
28190 if (p < (unsigned long) high_memory) {
28191@@ -419,6 +449,8 @@ static ssize_t read_kmem(struct file *fi
28192 }
28193 #endif
28194 while (low_count > 0) {
28195+ char *temp;
28196+
28197 sz = size_inside_page(p, low_count);
28198
28199 /*
28200@@ -428,7 +460,22 @@ static ssize_t read_kmem(struct file *fi
28201 */
28202 kbuf = xlate_dev_kmem_ptr((char *)p);
28203
28204- if (copy_to_user(buf, kbuf, sz))
28205+#ifdef CONFIG_PAX_USERCOPY
28206+ temp = kmalloc(sz, GFP_KERNEL);
28207+ if (!temp)
28208+ return -ENOMEM;
28209+ memcpy(temp, kbuf, sz);
28210+#else
28211+ temp = kbuf;
28212+#endif
28213+
28214+ err = copy_to_user(buf, temp, sz);
28215+
28216+#ifdef CONFIG_PAX_USERCOPY
28217+ kfree(temp);
28218+#endif
28219+
28220+ if (err)
28221 return -EFAULT;
28222 buf += sz;
28223 p += sz;
28224@@ -854,6 +901,9 @@ static const struct memdev {
28225 #ifdef CONFIG_CRASH_DUMP
28226 [12] = { "oldmem", 0, &oldmem_fops, NULL },
28227 #endif
28228+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
28229+ [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
28230+#endif
28231 };
28232
28233 static int memory_open(struct inode *inode, struct file *filp)
28234diff -urNp linux-2.6.39.1/drivers/char/mmtimer.c linux-2.6.39.1/drivers/char/mmtimer.c
28235--- linux-2.6.39.1/drivers/char/mmtimer.c 2011-05-19 00:06:34.000000000 -0400
28236+++ linux-2.6.39.1/drivers/char/mmtimer.c 2011-05-22 19:36:31.000000000 -0400
28237@@ -53,7 +53,7 @@ MODULE_LICENSE("GPL");
28238
28239 #define RTC_BITS 55 /* 55 bits for this implementation */
28240
28241-static struct k_clock sgi_clock;
28242+static const struct k_clock sgi_clock;
28243
28244 extern unsigned long sn_rtc_cycles_per_second;
28245
28246@@ -772,7 +772,7 @@ static int sgi_clock_getres(const clocki
28247 return 0;
28248 }
28249
28250-static struct k_clock sgi_clock = {
28251+static const struct k_clock sgi_clock = {
28252 .clock_set = sgi_clock_set,
28253 .clock_get = sgi_clock_get,
28254 .clock_getres = sgi_clock_getres,
28255diff -urNp linux-2.6.39.1/drivers/char/nvram.c linux-2.6.39.1/drivers/char/nvram.c
28256--- linux-2.6.39.1/drivers/char/nvram.c 2011-05-19 00:06:34.000000000 -0400
28257+++ linux-2.6.39.1/drivers/char/nvram.c 2011-05-22 19:36:31.000000000 -0400
28258@@ -246,7 +246,7 @@ static ssize_t nvram_read(struct file *f
28259
28260 spin_unlock_irq(&rtc_lock);
28261
28262- if (copy_to_user(buf, contents, tmp - contents))
28263+ if (tmp - contents > sizeof(contents) || copy_to_user(buf, contents, tmp - contents))
28264 return -EFAULT;
28265
28266 *ppos = i;
28267diff -urNp linux-2.6.39.1/drivers/char/random.c linux-2.6.39.1/drivers/char/random.c
28268--- linux-2.6.39.1/drivers/char/random.c 2011-05-19 00:06:34.000000000 -0400
28269+++ linux-2.6.39.1/drivers/char/random.c 2011-05-22 19:41:37.000000000 -0400
28270@@ -261,8 +261,13 @@
28271 /*
28272 * Configuration information
28273 */
28274+#ifdef CONFIG_GRKERNSEC_RANDNET
28275+#define INPUT_POOL_WORDS 512
28276+#define OUTPUT_POOL_WORDS 128
28277+#else
28278 #define INPUT_POOL_WORDS 128
28279 #define OUTPUT_POOL_WORDS 32
28280+#endif
28281 #define SEC_XFER_SIZE 512
28282 #define EXTRACT_SIZE 10
28283
28284@@ -300,10 +305,17 @@ static struct poolinfo {
28285 int poolwords;
28286 int tap1, tap2, tap3, tap4, tap5;
28287 } poolinfo_table[] = {
28288+#ifdef CONFIG_GRKERNSEC_RANDNET
28289+ /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
28290+ { 512, 411, 308, 208, 104, 1 },
28291+ /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
28292+ { 128, 103, 76, 51, 25, 1 },
28293+#else
28294 /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
28295 { 128, 103, 76, 51, 25, 1 },
28296 /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
28297 { 32, 26, 20, 14, 7, 1 },
28298+#endif
28299 #if 0
28300 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
28301 { 2048, 1638, 1231, 819, 411, 1 },
28302@@ -909,7 +921,7 @@ static ssize_t extract_entropy_user(stru
28303
28304 extract_buf(r, tmp);
28305 i = min_t(int, nbytes, EXTRACT_SIZE);
28306- if (copy_to_user(buf, tmp, i)) {
28307+ if (i > sizeof(tmp) || copy_to_user(buf, tmp, i)) {
28308 ret = -EFAULT;
28309 break;
28310 }
28311@@ -1214,7 +1226,7 @@ EXPORT_SYMBOL(generate_random_uuid);
28312 #include <linux/sysctl.h>
28313
28314 static int min_read_thresh = 8, min_write_thresh;
28315-static int max_read_thresh = INPUT_POOL_WORDS * 32;
28316+static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
28317 static int max_write_thresh = INPUT_POOL_WORDS * 32;
28318 static char sysctl_bootid[16];
28319
28320diff -urNp linux-2.6.39.1/drivers/char/sonypi.c linux-2.6.39.1/drivers/char/sonypi.c
28321--- linux-2.6.39.1/drivers/char/sonypi.c 2011-05-19 00:06:34.000000000 -0400
28322+++ linux-2.6.39.1/drivers/char/sonypi.c 2011-05-22 19:36:31.000000000 -0400
28323@@ -55,6 +55,7 @@
28324 #include <asm/uaccess.h>
28325 #include <asm/io.h>
28326 #include <asm/system.h>
28327+#include <asm/local.h>
28328
28329 #include <linux/sonypi.h>
28330
28331@@ -491,7 +492,7 @@ static struct sonypi_device {
28332 spinlock_t fifo_lock;
28333 wait_queue_head_t fifo_proc_list;
28334 struct fasync_struct *fifo_async;
28335- int open_count;
28336+ local_t open_count;
28337 int model;
28338 struct input_dev *input_jog_dev;
28339 struct input_dev *input_key_dev;
28340@@ -898,7 +899,7 @@ static int sonypi_misc_fasync(int fd, st
28341 static int sonypi_misc_release(struct inode *inode, struct file *file)
28342 {
28343 mutex_lock(&sonypi_device.lock);
28344- sonypi_device.open_count--;
28345+ local_dec(&sonypi_device.open_count);
28346 mutex_unlock(&sonypi_device.lock);
28347 return 0;
28348 }
28349@@ -907,9 +908,9 @@ static int sonypi_misc_open(struct inode
28350 {
28351 mutex_lock(&sonypi_device.lock);
28352 /* Flush input queue on first open */
28353- if (!sonypi_device.open_count)
28354+ if (!local_read(&sonypi_device.open_count))
28355 kfifo_reset(&sonypi_device.fifo);
28356- sonypi_device.open_count++;
28357+ local_inc(&sonypi_device.open_count);
28358 mutex_unlock(&sonypi_device.lock);
28359
28360 return 0;
28361diff -urNp linux-2.6.39.1/drivers/char/tpm/tpm_bios.c linux-2.6.39.1/drivers/char/tpm/tpm_bios.c
28362--- linux-2.6.39.1/drivers/char/tpm/tpm_bios.c 2011-05-19 00:06:34.000000000 -0400
28363+++ linux-2.6.39.1/drivers/char/tpm/tpm_bios.c 2011-05-22 19:36:31.000000000 -0400
28364@@ -173,7 +173,7 @@ static void *tpm_bios_measurements_start
28365 event = addr;
28366
28367 if ((event->event_type == 0 && event->event_size == 0) ||
28368- ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
28369+ (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
28370 return NULL;
28371
28372 return addr;
28373@@ -198,7 +198,7 @@ static void *tpm_bios_measurements_next(
28374 return NULL;
28375
28376 if ((event->event_type == 0 && event->event_size == 0) ||
28377- ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
28378+ (event->event_size >= limit - v - sizeof(struct tcpa_event)))
28379 return NULL;
28380
28381 (*pos)++;
28382@@ -291,7 +291,8 @@ static int tpm_binary_bios_measurements_
28383 int i;
28384
28385 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
28386- seq_putc(m, data[i]);
28387+ if (!seq_putc(m, data[i]))
28388+ return -EFAULT;
28389
28390 return 0;
28391 }
28392@@ -410,6 +411,11 @@ static int read_log(struct tpm_bios_log
28393 log->bios_event_log_end = log->bios_event_log + len;
28394
28395 virt = acpi_os_map_memory(start, len);
28396+ if (!virt) {
28397+ kfree(log->bios_event_log);
28398+ log->bios_event_log = NULL;
28399+ return -EFAULT;
28400+ }
28401
28402 memcpy(log->bios_event_log, virt, len);
28403
28404diff -urNp linux-2.6.39.1/drivers/char/tpm/tpm.c linux-2.6.39.1/drivers/char/tpm/tpm.c
28405--- linux-2.6.39.1/drivers/char/tpm/tpm.c 2011-05-19 00:06:34.000000000 -0400
28406+++ linux-2.6.39.1/drivers/char/tpm/tpm.c 2011-05-22 19:36:31.000000000 -0400
28407@@ -411,7 +411,7 @@ static ssize_t tpm_transmit(struct tpm_c
28408 chip->vendor.req_complete_val)
28409 goto out_recv;
28410
28411- if ((status == chip->vendor.req_canceled)) {
28412+ if (status == chip->vendor.req_canceled) {
28413 dev_err(chip->dev, "Operation Canceled\n");
28414 rc = -ECANCELED;
28415 goto out;
28416@@ -844,6 +844,8 @@ ssize_t tpm_show_pubek(struct device *de
28417
28418 struct tpm_chip *chip = dev_get_drvdata(dev);
28419
28420+ pax_track_stack();
28421+
28422 tpm_cmd.header.in = tpm_readpubek_header;
28423 err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
28424 "attempting to read the PUBEK");
28425diff -urNp linux-2.6.39.1/drivers/char/ttyprintk.c linux-2.6.39.1/drivers/char/ttyprintk.c
28426--- linux-2.6.39.1/drivers/char/ttyprintk.c 2011-05-19 00:06:34.000000000 -0400
28427+++ linux-2.6.39.1/drivers/char/ttyprintk.c 2011-05-22 19:36:31.000000000 -0400
28428@@ -170,7 +170,7 @@ static const struct tty_operations ttypr
28429 .ioctl = tpk_ioctl,
28430 };
28431
28432-struct tty_port_operations null_ops = { };
28433+const struct tty_port_operations null_ops = { };
28434
28435 static struct tty_driver *ttyprintk_driver;
28436
28437diff -urNp linux-2.6.39.1/drivers/char/xilinx_hwicap/xilinx_hwicap.c linux-2.6.39.1/drivers/char/xilinx_hwicap/xilinx_hwicap.c
28438--- linux-2.6.39.1/drivers/char/xilinx_hwicap/xilinx_hwicap.c 2011-05-19 00:06:34.000000000 -0400
28439+++ linux-2.6.39.1/drivers/char/xilinx_hwicap/xilinx_hwicap.c 2011-05-22 19:36:31.000000000 -0400
28440@@ -678,14 +678,14 @@ static int __devinit hwicap_setup(struct
28441 return retval;
28442 }
28443
28444-static struct hwicap_driver_config buffer_icap_config = {
28445+static const struct hwicap_driver_config buffer_icap_config = {
28446 .get_configuration = buffer_icap_get_configuration,
28447 .set_configuration = buffer_icap_set_configuration,
28448 .get_status = buffer_icap_get_status,
28449 .reset = buffer_icap_reset,
28450 };
28451
28452-static struct hwicap_driver_config fifo_icap_config = {
28453+static const struct hwicap_driver_config fifo_icap_config = {
28454 .get_configuration = fifo_icap_get_configuration,
28455 .set_configuration = fifo_icap_set_configuration,
28456 .get_status = fifo_icap_get_status,
28457diff -urNp linux-2.6.39.1/drivers/crypto/hifn_795x.c linux-2.6.39.1/drivers/crypto/hifn_795x.c
28458--- linux-2.6.39.1/drivers/crypto/hifn_795x.c 2011-05-19 00:06:34.000000000 -0400
28459+++ linux-2.6.39.1/drivers/crypto/hifn_795x.c 2011-05-22 19:36:31.000000000 -0400
28460@@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device
28461 0xCA, 0x34, 0x2B, 0x2E};
28462 struct scatterlist sg;
28463
28464+ pax_track_stack();
28465+
28466 memset(src, 0, sizeof(src));
28467 memset(ctx.key, 0, sizeof(ctx.key));
28468
28469diff -urNp linux-2.6.39.1/drivers/crypto/padlock-aes.c linux-2.6.39.1/drivers/crypto/padlock-aes.c
28470--- linux-2.6.39.1/drivers/crypto/padlock-aes.c 2011-05-19 00:06:34.000000000 -0400
28471+++ linux-2.6.39.1/drivers/crypto/padlock-aes.c 2011-05-22 19:36:31.000000000 -0400
28472@@ -109,6 +109,8 @@ static int aes_set_key(struct crypto_tfm
28473 struct crypto_aes_ctx gen_aes;
28474 int cpu;
28475
28476+ pax_track_stack();
28477+
28478 if (key_len % 8) {
28479 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
28480 return -EINVAL;
28481diff -urNp linux-2.6.39.1/drivers/dca/dca-core.c linux-2.6.39.1/drivers/dca/dca-core.c
28482--- linux-2.6.39.1/drivers/dca/dca-core.c 2011-05-19 00:06:34.000000000 -0400
28483+++ linux-2.6.39.1/drivers/dca/dca-core.c 2011-05-22 19:36:31.000000000 -0400
28484@@ -325,7 +325,7 @@ EXPORT_SYMBOL_GPL(dca_get_tag);
28485 * @ops - pointer to struct of dca operation function pointers
28486 * @priv_size - size of extra mem to be added for provider's needs
28487 */
28488-struct dca_provider *alloc_dca_provider(struct dca_ops *ops, int priv_size)
28489+struct dca_provider *alloc_dca_provider(const struct dca_ops *ops, int priv_size)
28490 {
28491 struct dca_provider *dca;
28492 int alloc_size;
28493diff -urNp linux-2.6.39.1/drivers/dma/ioat/dca.c linux-2.6.39.1/drivers/dma/ioat/dca.c
28494--- linux-2.6.39.1/drivers/dma/ioat/dca.c 2011-05-19 00:06:34.000000000 -0400
28495+++ linux-2.6.39.1/drivers/dma/ioat/dca.c 2011-05-22 19:36:31.000000000 -0400
28496@@ -234,7 +234,7 @@ static int ioat_dca_dev_managed(struct d
28497 return 0;
28498 }
28499
28500-static struct dca_ops ioat_dca_ops = {
28501+static const struct dca_ops ioat_dca_ops = {
28502 .add_requester = ioat_dca_add_requester,
28503 .remove_requester = ioat_dca_remove_requester,
28504 .get_tag = ioat_dca_get_tag,
28505@@ -384,7 +384,7 @@ static u8 ioat2_dca_get_tag(struct dca_p
28506 return tag;
28507 }
28508
28509-static struct dca_ops ioat2_dca_ops = {
28510+static const struct dca_ops ioat2_dca_ops = {
28511 .add_requester = ioat2_dca_add_requester,
28512 .remove_requester = ioat2_dca_remove_requester,
28513 .get_tag = ioat2_dca_get_tag,
28514@@ -579,7 +579,7 @@ static u8 ioat3_dca_get_tag(struct dca_p
28515 return tag;
28516 }
28517
28518-static struct dca_ops ioat3_dca_ops = {
28519+static const struct dca_ops ioat3_dca_ops = {
28520 .add_requester = ioat3_dca_add_requester,
28521 .remove_requester = ioat3_dca_remove_requester,
28522 .get_tag = ioat3_dca_get_tag,
28523diff -urNp linux-2.6.39.1/drivers/edac/amd64_edac.h linux-2.6.39.1/drivers/edac/amd64_edac.h
28524--- linux-2.6.39.1/drivers/edac/amd64_edac.h 2011-05-19 00:06:34.000000000 -0400
28525+++ linux-2.6.39.1/drivers/edac/amd64_edac.h 2011-05-22 19:36:31.000000000 -0400
28526@@ -333,7 +333,7 @@ struct chip_select {
28527 };
28528
28529 struct amd64_pvt {
28530- struct low_ops *ops;
28531+ const struct low_ops *ops;
28532
28533 /* pci_device handles which we utilize */
28534 struct pci_dev *F1, *F2, *F3;
28535@@ -443,7 +443,7 @@ struct low_ops {
28536 struct amd64_family_type {
28537 const char *ctl_name;
28538 u16 f1_id, f3_id;
28539- struct low_ops ops;
28540+ const struct low_ops ops;
28541 };
28542
28543 int __amd64_write_pci_cfg_dword(struct pci_dev *pdev, int offset,
28544diff -urNp linux-2.6.39.1/drivers/edac/edac_mc_sysfs.c linux-2.6.39.1/drivers/edac/edac_mc_sysfs.c
28545--- linux-2.6.39.1/drivers/edac/edac_mc_sysfs.c 2011-05-19 00:06:34.000000000 -0400
28546+++ linux-2.6.39.1/drivers/edac/edac_mc_sysfs.c 2011-05-22 19:36:31.000000000 -0400
28547@@ -760,7 +760,7 @@ static void edac_inst_grp_release(struct
28548 }
28549
28550 /* Intermediate show/store table */
28551-static struct sysfs_ops inst_grp_ops = {
28552+static const struct sysfs_ops inst_grp_ops = {
28553 .show = inst_grp_show,
28554 .store = inst_grp_store
28555 };
28556diff -urNp linux-2.6.39.1/drivers/edac/edac_pci_sysfs.c linux-2.6.39.1/drivers/edac/edac_pci_sysfs.c
28557--- linux-2.6.39.1/drivers/edac/edac_pci_sysfs.c 2011-05-19 00:06:34.000000000 -0400
28558+++ linux-2.6.39.1/drivers/edac/edac_pci_sysfs.c 2011-05-22 19:36:31.000000000 -0400
28559@@ -26,8 +26,8 @@ static int edac_pci_log_pe = 1; /* log
28560 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
28561 static int edac_pci_poll_msec = 1000; /* one second workq period */
28562
28563-static atomic_t pci_parity_count = ATOMIC_INIT(0);
28564-static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
28565+static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
28566+static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
28567
28568 static struct kobject *edac_pci_top_main_kobj;
28569 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
28570@@ -582,7 +582,7 @@ static void edac_pci_dev_parity_test(str
28571 edac_printk(KERN_CRIT, EDAC_PCI,
28572 "Signaled System Error on %s\n",
28573 pci_name(dev));
28574- atomic_inc(&pci_nonparity_count);
28575+ atomic_inc_unchecked(&pci_nonparity_count);
28576 }
28577
28578 if (status & (PCI_STATUS_PARITY)) {
28579@@ -590,7 +590,7 @@ static void edac_pci_dev_parity_test(str
28580 "Master Data Parity Error on %s\n",
28581 pci_name(dev));
28582
28583- atomic_inc(&pci_parity_count);
28584+ atomic_inc_unchecked(&pci_parity_count);
28585 }
28586
28587 if (status & (PCI_STATUS_DETECTED_PARITY)) {
28588@@ -598,7 +598,7 @@ static void edac_pci_dev_parity_test(str
28589 "Detected Parity Error on %s\n",
28590 pci_name(dev));
28591
28592- atomic_inc(&pci_parity_count);
28593+ atomic_inc_unchecked(&pci_parity_count);
28594 }
28595 }
28596
28597@@ -619,7 +619,7 @@ static void edac_pci_dev_parity_test(str
28598 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
28599 "Signaled System Error on %s\n",
28600 pci_name(dev));
28601- atomic_inc(&pci_nonparity_count);
28602+ atomic_inc_unchecked(&pci_nonparity_count);
28603 }
28604
28605 if (status & (PCI_STATUS_PARITY)) {
28606@@ -627,7 +627,7 @@ static void edac_pci_dev_parity_test(str
28607 "Master Data Parity Error on "
28608 "%s\n", pci_name(dev));
28609
28610- atomic_inc(&pci_parity_count);
28611+ atomic_inc_unchecked(&pci_parity_count);
28612 }
28613
28614 if (status & (PCI_STATUS_DETECTED_PARITY)) {
28615@@ -635,7 +635,7 @@ static void edac_pci_dev_parity_test(str
28616 "Detected Parity Error on %s\n",
28617 pci_name(dev));
28618
28619- atomic_inc(&pci_parity_count);
28620+ atomic_inc_unchecked(&pci_parity_count);
28621 }
28622 }
28623 }
28624@@ -677,7 +677,7 @@ void edac_pci_do_parity_check(void)
28625 if (!check_pci_errors)
28626 return;
28627
28628- before_count = atomic_read(&pci_parity_count);
28629+ before_count = atomic_read_unchecked(&pci_parity_count);
28630
28631 /* scan all PCI devices looking for a Parity Error on devices and
28632 * bridges.
28633@@ -689,7 +689,7 @@ void edac_pci_do_parity_check(void)
28634 /* Only if operator has selected panic on PCI Error */
28635 if (edac_pci_get_panic_on_pe()) {
28636 /* If the count is different 'after' from 'before' */
28637- if (before_count != atomic_read(&pci_parity_count))
28638+ if (before_count != atomic_read_unchecked(&pci_parity_count))
28639 panic("EDAC: PCI Parity Error");
28640 }
28641 }
28642diff -urNp linux-2.6.39.1/drivers/firewire/core-cdev.c linux-2.6.39.1/drivers/firewire/core-cdev.c
28643--- linux-2.6.39.1/drivers/firewire/core-cdev.c 2011-05-19 00:06:34.000000000 -0400
28644+++ linux-2.6.39.1/drivers/firewire/core-cdev.c 2011-05-22 19:36:31.000000000 -0400
28645@@ -1312,8 +1312,7 @@ static int init_iso_resource(struct clie
28646 int ret;
28647
28648 if ((request->channels == 0 && request->bandwidth == 0) ||
28649- request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
28650- request->bandwidth < 0)
28651+ request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
28652 return -EINVAL;
28653
28654 r = kmalloc(sizeof(*r), GFP_KERNEL);
28655diff -urNp linux-2.6.39.1/drivers/firewire/core-transaction.c linux-2.6.39.1/drivers/firewire/core-transaction.c
28656--- linux-2.6.39.1/drivers/firewire/core-transaction.c 2011-05-19 00:06:34.000000000 -0400
28657+++ linux-2.6.39.1/drivers/firewire/core-transaction.c 2011-05-22 19:36:31.000000000 -0400
28658@@ -36,6 +36,7 @@
28659 #include <linux/string.h>
28660 #include <linux/timer.h>
28661 #include <linux/types.h>
28662+#include <linux/sched.h>
28663
28664 #include <asm/byteorder.h>
28665
28666@@ -420,6 +421,8 @@ int fw_run_transaction(struct fw_card *c
28667 struct transaction_callback_data d;
28668 struct fw_transaction t;
28669
28670+ pax_track_stack();
28671+
28672 init_timer_on_stack(&t.split_timeout_timer);
28673 init_completion(&d.done);
28674 d.payload = payload;
28675diff -urNp linux-2.6.39.1/drivers/firmware/dmi_scan.c linux-2.6.39.1/drivers/firmware/dmi_scan.c
28676--- linux-2.6.39.1/drivers/firmware/dmi_scan.c 2011-05-19 00:06:34.000000000 -0400
28677+++ linux-2.6.39.1/drivers/firmware/dmi_scan.c 2011-05-22 19:36:31.000000000 -0400
28678@@ -449,11 +449,6 @@ void __init dmi_scan_machine(void)
28679 }
28680 }
28681 else {
28682- /*
28683- * no iounmap() for that ioremap(); it would be a no-op, but
28684- * it's so early in setup that sucker gets confused into doing
28685- * what it shouldn't if we actually call it.
28686- */
28687 p = dmi_ioremap(0xF0000, 0x10000);
28688 if (p == NULL)
28689 goto error;
28690diff -urNp linux-2.6.39.1/drivers/gpio/vr41xx_giu.c linux-2.6.39.1/drivers/gpio/vr41xx_giu.c
28691--- linux-2.6.39.1/drivers/gpio/vr41xx_giu.c 2011-05-19 00:06:34.000000000 -0400
28692+++ linux-2.6.39.1/drivers/gpio/vr41xx_giu.c 2011-05-22 19:36:31.000000000 -0400
28693@@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
28694 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
28695 maskl, pendl, maskh, pendh);
28696
28697- atomic_inc(&irq_err_count);
28698+ atomic_inc_unchecked(&irq_err_count);
28699
28700 return -EINVAL;
28701 }
28702diff -urNp linux-2.6.39.1/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.39.1/drivers/gpu/drm/drm_crtc_helper.c
28703--- linux-2.6.39.1/drivers/gpu/drm/drm_crtc_helper.c 2011-05-19 00:06:34.000000000 -0400
28704+++ linux-2.6.39.1/drivers/gpu/drm/drm_crtc_helper.c 2011-05-22 19:36:31.000000000 -0400
28705@@ -276,7 +276,7 @@ static bool drm_encoder_crtc_ok(struct d
28706 struct drm_crtc *tmp;
28707 int crtc_mask = 1;
28708
28709- WARN(!crtc, "checking null crtc?\n");
28710+ BUG_ON(!crtc);
28711
28712 dev = crtc->dev;
28713
28714@@ -343,6 +343,8 @@ bool drm_crtc_helper_set_mode(struct drm
28715 struct drm_encoder *encoder;
28716 bool ret = true;
28717
28718+ pax_track_stack();
28719+
28720 crtc->enabled = drm_helper_crtc_in_use(crtc);
28721 if (!crtc->enabled)
28722 return true;
28723diff -urNp linux-2.6.39.1/drivers/gpu/drm/drm_drv.c linux-2.6.39.1/drivers/gpu/drm/drm_drv.c
28724--- linux-2.6.39.1/drivers/gpu/drm/drm_drv.c 2011-05-19 00:06:34.000000000 -0400
28725+++ linux-2.6.39.1/drivers/gpu/drm/drm_drv.c 2011-05-22 19:36:31.000000000 -0400
28726@@ -386,7 +386,7 @@ long drm_ioctl(struct file *filp,
28727
28728 dev = file_priv->minor->dev;
28729 atomic_inc(&dev->ioctl_count);
28730- atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
28731+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
28732 ++file_priv->ioctl_count;
28733
28734 DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
28735diff -urNp linux-2.6.39.1/drivers/gpu/drm/drm_fops.c linux-2.6.39.1/drivers/gpu/drm/drm_fops.c
28736--- linux-2.6.39.1/drivers/gpu/drm/drm_fops.c 2011-05-19 00:06:34.000000000 -0400
28737+++ linux-2.6.39.1/drivers/gpu/drm/drm_fops.c 2011-05-22 19:36:31.000000000 -0400
28738@@ -70,7 +70,7 @@ static int drm_setup(struct drm_device *
28739 }
28740
28741 for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
28742- atomic_set(&dev->counts[i], 0);
28743+ atomic_set_unchecked(&dev->counts[i], 0);
28744
28745 dev->sigdata.lock = NULL;
28746
28747@@ -134,8 +134,8 @@ int drm_open(struct inode *inode, struct
28748
28749 retcode = drm_open_helper(inode, filp, dev);
28750 if (!retcode) {
28751- atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
28752- if (!dev->open_count++)
28753+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
28754+ if (local_inc_return(&dev->open_count) == 1)
28755 retcode = drm_setup(dev);
28756 }
28757 if (!retcode) {
28758@@ -472,7 +472,7 @@ int drm_release(struct inode *inode, str
28759
28760 mutex_lock(&drm_global_mutex);
28761
28762- DRM_DEBUG("open_count = %d\n", dev->open_count);
28763+ DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
28764
28765 if (dev->driver->preclose)
28766 dev->driver->preclose(dev, file_priv);
28767@@ -484,7 +484,7 @@ int drm_release(struct inode *inode, str
28768 DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
28769 task_pid_nr(current),
28770 (long)old_encode_dev(file_priv->minor->device),
28771- dev->open_count);
28772+ local_read(&dev->open_count));
28773
28774 /* if the master has gone away we can't do anything with the lock */
28775 if (file_priv->minor->master)
28776@@ -565,8 +565,8 @@ int drm_release(struct inode *inode, str
28777 * End inline drm_release
28778 */
28779
28780- atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
28781- if (!--dev->open_count) {
28782+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
28783+ if (local_dec_and_test(&dev->open_count)) {
28784 if (atomic_read(&dev->ioctl_count)) {
28785 DRM_ERROR("Device busy: %d\n",
28786 atomic_read(&dev->ioctl_count));
28787diff -urNp linux-2.6.39.1/drivers/gpu/drm/drm_global.c linux-2.6.39.1/drivers/gpu/drm/drm_global.c
28788--- linux-2.6.39.1/drivers/gpu/drm/drm_global.c 2011-05-19 00:06:34.000000000 -0400
28789+++ linux-2.6.39.1/drivers/gpu/drm/drm_global.c 2011-05-22 19:36:31.000000000 -0400
28790@@ -36,7 +36,7 @@
28791 struct drm_global_item {
28792 struct mutex mutex;
28793 void *object;
28794- int refcount;
28795+ atomic_t refcount;
28796 };
28797
28798 static struct drm_global_item glob[DRM_GLOBAL_NUM];
28799@@ -49,7 +49,7 @@ void drm_global_init(void)
28800 struct drm_global_item *item = &glob[i];
28801 mutex_init(&item->mutex);
28802 item->object = NULL;
28803- item->refcount = 0;
28804+ atomic_set(&item->refcount, 0);
28805 }
28806 }
28807
28808@@ -59,7 +59,7 @@ void drm_global_release(void)
28809 for (i = 0; i < DRM_GLOBAL_NUM; ++i) {
28810 struct drm_global_item *item = &glob[i];
28811 BUG_ON(item->object != NULL);
28812- BUG_ON(item->refcount != 0);
28813+ BUG_ON(atomic_read(&item->refcount) != 0);
28814 }
28815 }
28816
28817@@ -70,7 +70,7 @@ int drm_global_item_ref(struct drm_globa
28818 void *object;
28819
28820 mutex_lock(&item->mutex);
28821- if (item->refcount == 0) {
28822+ if (atomic_read(&item->refcount) == 0) {
28823 item->object = kzalloc(ref->size, GFP_KERNEL);
28824 if (unlikely(item->object == NULL)) {
28825 ret = -ENOMEM;
28826@@ -83,7 +83,7 @@ int drm_global_item_ref(struct drm_globa
28827 goto out_err;
28828
28829 }
28830- ++item->refcount;
28831+ atomic_inc(&item->refcount);
28832 ref->object = item->object;
28833 object = item->object;
28834 mutex_unlock(&item->mutex);
28835@@ -100,9 +100,9 @@ void drm_global_item_unref(struct drm_gl
28836 struct drm_global_item *item = &glob[ref->global_type];
28837
28838 mutex_lock(&item->mutex);
28839- BUG_ON(item->refcount == 0);
28840+ BUG_ON(atomic_read(&item->refcount) == 0);
28841 BUG_ON(ref->object != item->object);
28842- if (--item->refcount == 0) {
28843+ if (atomic_dec_and_test(&item->refcount)) {
28844 ref->release(ref);
28845 item->object = NULL;
28846 }
28847diff -urNp linux-2.6.39.1/drivers/gpu/drm/drm_info.c linux-2.6.39.1/drivers/gpu/drm/drm_info.c
28848--- linux-2.6.39.1/drivers/gpu/drm/drm_info.c 2011-05-19 00:06:34.000000000 -0400
28849+++ linux-2.6.39.1/drivers/gpu/drm/drm_info.c 2011-05-22 19:41:37.000000000 -0400
28850@@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void
28851 struct drm_local_map *map;
28852 struct drm_map_list *r_list;
28853
28854- /* Hardcoded from _DRM_FRAME_BUFFER,
28855- _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
28856- _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
28857- const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
28858+ static const char * const types[] = {
28859+ [_DRM_FRAME_BUFFER] = "FB",
28860+ [_DRM_REGISTERS] = "REG",
28861+ [_DRM_SHM] = "SHM",
28862+ [_DRM_AGP] = "AGP",
28863+ [_DRM_SCATTER_GATHER] = "SG",
28864+ [_DRM_CONSISTENT] = "PCI",
28865+ [_DRM_GEM] = "GEM" };
28866 const char *type;
28867 int i;
28868
28869@@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void
28870 map = r_list->map;
28871 if (!map)
28872 continue;
28873- if (map->type < 0 || map->type > 5)
28874+ if (map->type >= ARRAY_SIZE(types))
28875 type = "??";
28876 else
28877 type = types[map->type];
28878@@ -290,7 +294,11 @@ int drm_vma_info(struct seq_file *m, voi
28879 vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
28880 vma->vm_flags & VM_LOCKED ? 'l' : '-',
28881 vma->vm_flags & VM_IO ? 'i' : '-',
28882+#ifdef CONFIG_GRKERNSEC_HIDESYM
28883+ 0);
28884+#else
28885 vma->vm_pgoff);
28886+#endif
28887
28888 #if defined(__i386__)
28889 pgprot = pgprot_val(vma->vm_page_prot);
28890diff -urNp linux-2.6.39.1/drivers/gpu/drm/drm_ioctl.c linux-2.6.39.1/drivers/gpu/drm/drm_ioctl.c
28891--- linux-2.6.39.1/drivers/gpu/drm/drm_ioctl.c 2011-05-19 00:06:34.000000000 -0400
28892+++ linux-2.6.39.1/drivers/gpu/drm/drm_ioctl.c 2011-05-22 19:36:31.000000000 -0400
28893@@ -256,7 +256,7 @@ int drm_getstats(struct drm_device *dev,
28894 stats->data[i].value =
28895 (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
28896 else
28897- stats->data[i].value = atomic_read(&dev->counts[i]);
28898+ stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
28899 stats->data[i].type = dev->types[i];
28900 }
28901
28902diff -urNp linux-2.6.39.1/drivers/gpu/drm/drm_lock.c linux-2.6.39.1/drivers/gpu/drm/drm_lock.c
28903--- linux-2.6.39.1/drivers/gpu/drm/drm_lock.c 2011-05-19 00:06:34.000000000 -0400
28904+++ linux-2.6.39.1/drivers/gpu/drm/drm_lock.c 2011-05-22 19:36:31.000000000 -0400
28905@@ -89,7 +89,7 @@ int drm_lock(struct drm_device *dev, voi
28906 if (drm_lock_take(&master->lock, lock->context)) {
28907 master->lock.file_priv = file_priv;
28908 master->lock.lock_time = jiffies;
28909- atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
28910+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
28911 break; /* Got lock */
28912 }
28913
28914@@ -160,7 +160,7 @@ int drm_unlock(struct drm_device *dev, v
28915 return -EINVAL;
28916 }
28917
28918- atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
28919+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
28920
28921 if (drm_lock_free(&master->lock, lock->context)) {
28922 /* FIXME: Should really bail out here. */
28923diff -urNp linux-2.6.39.1/drivers/gpu/drm/i810/i810_dma.c linux-2.6.39.1/drivers/gpu/drm/i810/i810_dma.c
28924--- linux-2.6.39.1/drivers/gpu/drm/i810/i810_dma.c 2011-05-19 00:06:34.000000000 -0400
28925+++ linux-2.6.39.1/drivers/gpu/drm/i810/i810_dma.c 2011-05-22 19:36:31.000000000 -0400
28926@@ -950,8 +950,8 @@ static int i810_dma_vertex(struct drm_de
28927 dma->buflist[vertex->idx],
28928 vertex->discard, vertex->used);
28929
28930- atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
28931- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
28932+ atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
28933+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
28934 sarea_priv->last_enqueue = dev_priv->counter - 1;
28935 sarea_priv->last_dispatch = (int)hw_status[5];
28936
28937@@ -1111,8 +1111,8 @@ static int i810_dma_mc(struct drm_device
28938 i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
28939 mc->last_render);
28940
28941- atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
28942- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
28943+ atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
28944+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
28945 sarea_priv->last_enqueue = dev_priv->counter - 1;
28946 sarea_priv->last_dispatch = (int)hw_status[5];
28947
28948diff -urNp linux-2.6.39.1/drivers/gpu/drm/i810/i810_drv.h linux-2.6.39.1/drivers/gpu/drm/i810/i810_drv.h
28949--- linux-2.6.39.1/drivers/gpu/drm/i810/i810_drv.h 2011-05-19 00:06:34.000000000 -0400
28950+++ linux-2.6.39.1/drivers/gpu/drm/i810/i810_drv.h 2011-05-22 19:36:31.000000000 -0400
28951@@ -108,8 +108,8 @@ typedef struct drm_i810_private {
28952 int page_flipping;
28953
28954 wait_queue_head_t irq_queue;
28955- atomic_t irq_received;
28956- atomic_t irq_emitted;
28957+ atomic_unchecked_t irq_received;
28958+ atomic_unchecked_t irq_emitted;
28959
28960 int front_offset;
28961 } drm_i810_private_t;
28962diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ch7017.c
28963--- linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ch7017.c 2011-05-19 00:06:34.000000000 -0400
28964+++ linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ch7017.c 2011-05-22 19:36:31.000000000 -0400
28965@@ -390,7 +390,7 @@ static void ch7017_destroy(struct intel_
28966 }
28967 }
28968
28969-struct intel_dvo_dev_ops ch7017_ops = {
28970+const struct intel_dvo_dev_ops ch7017_ops = {
28971 .init = ch7017_init,
28972 .detect = ch7017_detect,
28973 .mode_valid = ch7017_mode_valid,
28974diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ch7xxx.c
28975--- linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-05-19 00:06:34.000000000 -0400
28976+++ linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-05-22 19:36:31.000000000 -0400
28977@@ -320,7 +320,7 @@ static void ch7xxx_destroy(struct intel_
28978 }
28979 }
28980
28981-struct intel_dvo_dev_ops ch7xxx_ops = {
28982+const struct intel_dvo_dev_ops ch7xxx_ops = {
28983 .init = ch7xxx_init,
28984 .detect = ch7xxx_detect,
28985 .mode_valid = ch7xxx_mode_valid,
28986diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/dvo.h linux-2.6.39.1/drivers/gpu/drm/i915/dvo.h
28987--- linux-2.6.39.1/drivers/gpu/drm/i915/dvo.h 2011-05-19 00:06:34.000000000 -0400
28988+++ linux-2.6.39.1/drivers/gpu/drm/i915/dvo.h 2011-05-22 19:36:31.000000000 -0400
28989@@ -122,23 +122,23 @@ struct intel_dvo_dev_ops {
28990 *
28991 * \return singly-linked list of modes or NULL if no modes found.
28992 */
28993- struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
28994+ struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
28995
28996 /**
28997 * Clean up driver-specific bits of the output
28998 */
28999- void (*destroy) (struct intel_dvo_device *dvo);
29000+ void (* const destroy) (struct intel_dvo_device *dvo);
29001
29002 /**
29003 * Debugging hook to dump device registers to log file
29004 */
29005- void (*dump_regs)(struct intel_dvo_device *dvo);
29006+ void (* const dump_regs)(struct intel_dvo_device *dvo);
29007 };
29008
29009-extern struct intel_dvo_dev_ops sil164_ops;
29010-extern struct intel_dvo_dev_ops ch7xxx_ops;
29011-extern struct intel_dvo_dev_ops ivch_ops;
29012-extern struct intel_dvo_dev_ops tfp410_ops;
29013-extern struct intel_dvo_dev_ops ch7017_ops;
29014+extern const struct intel_dvo_dev_ops sil164_ops;
29015+extern const struct intel_dvo_dev_ops ch7xxx_ops;
29016+extern const struct intel_dvo_dev_ops ivch_ops;
29017+extern const struct intel_dvo_dev_ops tfp410_ops;
29018+extern const struct intel_dvo_dev_ops ch7017_ops;
29019
29020 #endif /* _INTEL_DVO_H */
29021diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ivch.c
29022--- linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ivch.c 2011-05-19 00:06:34.000000000 -0400
29023+++ linux-2.6.39.1/drivers/gpu/drm/i915/dvo_ivch.c 2011-05-22 19:36:31.000000000 -0400
29024@@ -410,7 +410,7 @@ static void ivch_destroy(struct intel_dv
29025 }
29026 }
29027
29028-struct intel_dvo_dev_ops ivch_ops= {
29029+const struct intel_dvo_dev_ops ivch_ops= {
29030 .init = ivch_init,
29031 .dpms = ivch_dpms,
29032 .mode_valid = ivch_mode_valid,
29033diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.39.1/drivers/gpu/drm/i915/dvo_sil164.c
29034--- linux-2.6.39.1/drivers/gpu/drm/i915/dvo_sil164.c 2011-05-19 00:06:34.000000000 -0400
29035+++ linux-2.6.39.1/drivers/gpu/drm/i915/dvo_sil164.c 2011-05-22 19:36:31.000000000 -0400
29036@@ -252,7 +252,7 @@ static void sil164_destroy(struct intel_
29037 }
29038 }
29039
29040-struct intel_dvo_dev_ops sil164_ops = {
29041+const struct intel_dvo_dev_ops sil164_ops = {
29042 .init = sil164_init,
29043 .detect = sil164_detect,
29044 .mode_valid = sil164_mode_valid,
29045diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.39.1/drivers/gpu/drm/i915/dvo_tfp410.c
29046--- linux-2.6.39.1/drivers/gpu/drm/i915/dvo_tfp410.c 2011-05-19 00:06:34.000000000 -0400
29047+++ linux-2.6.39.1/drivers/gpu/drm/i915/dvo_tfp410.c 2011-05-22 19:36:31.000000000 -0400
29048@@ -293,7 +293,7 @@ static void tfp410_destroy(struct intel_
29049 }
29050 }
29051
29052-struct intel_dvo_dev_ops tfp410_ops = {
29053+const struct intel_dvo_dev_ops tfp410_ops = {
29054 .init = tfp410_init,
29055 .detect = tfp410_detect,
29056 .mode_valid = tfp410_mode_valid,
29057diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/i915_debugfs.c linux-2.6.39.1/drivers/gpu/drm/i915/i915_debugfs.c
29058--- linux-2.6.39.1/drivers/gpu/drm/i915/i915_debugfs.c 2011-05-19 00:06:34.000000000 -0400
29059+++ linux-2.6.39.1/drivers/gpu/drm/i915/i915_debugfs.c 2011-05-22 19:36:31.000000000 -0400
29060@@ -496,7 +496,7 @@ static int i915_interrupt_info(struct se
29061 I915_READ(GTIMR));
29062 }
29063 seq_printf(m, "Interrupts received: %d\n",
29064- atomic_read(&dev_priv->irq_received));
29065+ atomic_read_unchecked(&dev_priv->irq_received));
29066 for (i = 0; i < I915_NUM_RINGS; i++) {
29067 if (IS_GEN6(dev)) {
29068 seq_printf(m, "Graphics Interrupt mask (%s): %08x\n",
29069diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/i915_dma.c linux-2.6.39.1/drivers/gpu/drm/i915/i915_dma.c
29070--- linux-2.6.39.1/drivers/gpu/drm/i915/i915_dma.c 2011-05-19 00:06:34.000000000 -0400
29071+++ linux-2.6.39.1/drivers/gpu/drm/i915/i915_dma.c 2011-05-22 19:36:31.000000000 -0400
29072@@ -1171,7 +1171,7 @@ static bool i915_switcheroo_can_switch(s
29073 bool can_switch;
29074
29075 spin_lock(&dev->count_lock);
29076- can_switch = (dev->open_count == 0);
29077+ can_switch = (local_read(&dev->open_count) == 0);
29078 spin_unlock(&dev->count_lock);
29079 return can_switch;
29080 }
29081diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/i915_drv.c linux-2.6.39.1/drivers/gpu/drm/i915/i915_drv.c
29082--- linux-2.6.39.1/drivers/gpu/drm/i915/i915_drv.c 2011-05-19 00:06:34.000000000 -0400
29083+++ linux-2.6.39.1/drivers/gpu/drm/i915/i915_drv.c 2011-05-22 19:36:31.000000000 -0400
29084@@ -679,7 +679,7 @@ static const struct dev_pm_ops i915_pm_o
29085 .restore = i915_pm_resume,
29086 };
29087
29088-static struct vm_operations_struct i915_gem_vm_ops = {
29089+static const struct vm_operations_struct i915_gem_vm_ops = {
29090 .fault = i915_gem_fault,
29091 .open = drm_gem_vm_open,
29092 .close = drm_gem_vm_close,
29093diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/i915_drv.h linux-2.6.39.1/drivers/gpu/drm/i915/i915_drv.h
29094--- linux-2.6.39.1/drivers/gpu/drm/i915/i915_drv.h 2011-05-19 00:06:34.000000000 -0400
29095+++ linux-2.6.39.1/drivers/gpu/drm/i915/i915_drv.h 2011-05-22 19:36:31.000000000 -0400
29096@@ -287,7 +287,7 @@ typedef struct drm_i915_private {
29097 int current_page;
29098 int page_flipping;
29099
29100- atomic_t irq_received;
29101+ atomic_unchecked_t irq_received;
29102
29103 /* protects the irq masks */
29104 spinlock_t irq_lock;
29105@@ -848,7 +848,7 @@ struct drm_i915_gem_object {
29106 * will be page flipped away on the next vblank. When it
29107 * reaches 0, dev_priv->pending_flip_queue will be woken up.
29108 */
29109- atomic_t pending_flip;
29110+ atomic_unchecked_t pending_flip;
29111 };
29112
29113 #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
29114@@ -1232,7 +1232,7 @@ extern int intel_setup_gmbus(struct drm_
29115 extern void intel_teardown_gmbus(struct drm_device *dev);
29116 extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
29117 extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
29118-extern inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
29119+static inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
29120 {
29121 return container_of(adapter, struct intel_gmbus, adapter)->force_bit;
29122 }
29123diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/i915_gem_execbuffer.c linux-2.6.39.1/drivers/gpu/drm/i915/i915_gem_execbuffer.c
29124--- linux-2.6.39.1/drivers/gpu/drm/i915/i915_gem_execbuffer.c 2011-05-19 00:06:34.000000000 -0400
29125+++ linux-2.6.39.1/drivers/gpu/drm/i915/i915_gem_execbuffer.c 2011-05-22 19:36:31.000000000 -0400
29126@@ -192,7 +192,7 @@ i915_gem_object_set_to_gpu_domain(struct
29127 i915_gem_release_mmap(obj);
29128
29129 if (obj->base.pending_write_domain)
29130- cd->flips |= atomic_read(&obj->pending_flip);
29131+ cd->flips |= atomic_read_unchecked(&obj->pending_flip);
29132
29133 /* The actual obj->write_domain will be updated with
29134 * pending_write_domain after we emit the accumulated flush for all
29135diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/i915_irq.c linux-2.6.39.1/drivers/gpu/drm/i915/i915_irq.c
29136--- linux-2.6.39.1/drivers/gpu/drm/i915/i915_irq.c 2011-05-19 00:06:34.000000000 -0400
29137+++ linux-2.6.39.1/drivers/gpu/drm/i915/i915_irq.c 2011-05-22 19:36:31.000000000 -0400
29138@@ -1101,7 +1101,7 @@ irqreturn_t i915_driver_irq_handler(DRM_
29139 int ret = IRQ_NONE, pipe;
29140 bool blc_event = false;
29141
29142- atomic_inc(&dev_priv->irq_received);
29143+ atomic_inc_unchecked(&dev_priv->irq_received);
29144
29145 if (HAS_PCH_SPLIT(dev))
29146 return ironlake_irq_handler(dev);
29147@@ -1655,7 +1655,7 @@ void i915_driver_irq_preinstall(struct d
29148 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
29149 int pipe;
29150
29151- atomic_set(&dev_priv->irq_received, 0);
29152+ atomic_set_unchecked(&dev_priv->irq_received, 0);
29153
29154 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
29155 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
29156diff -urNp linux-2.6.39.1/drivers/gpu/drm/i915/intel_display.c linux-2.6.39.1/drivers/gpu/drm/i915/intel_display.c
29157--- linux-2.6.39.1/drivers/gpu/drm/i915/intel_display.c 2011-05-19 00:06:34.000000000 -0400
29158+++ linux-2.6.39.1/drivers/gpu/drm/i915/intel_display.c 2011-05-22 19:36:31.000000000 -0400
29159@@ -2244,7 +2244,7 @@ intel_pipe_set_base(struct drm_crtc *crt
29160
29161 wait_event(dev_priv->pending_flip_queue,
29162 atomic_read(&dev_priv->mm.wedged) ||
29163- atomic_read(&obj->pending_flip) == 0);
29164+ atomic_read_unchecked(&obj->pending_flip) == 0);
29165
29166 /* Big Hammer, we also need to ensure that any pending
29167 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
29168@@ -2712,7 +2712,7 @@ static void intel_crtc_wait_for_pending_
29169 obj = to_intel_framebuffer(crtc->fb)->obj;
29170 dev_priv = crtc->dev->dev_private;
29171 wait_event(dev_priv->pending_flip_queue,
29172- atomic_read(&obj->pending_flip) == 0);
29173+ atomic_read_unchecked(&obj->pending_flip) == 0);
29174 }
29175
29176 static bool intel_crtc_driving_pch(struct drm_crtc *crtc)
29177@@ -6016,7 +6016,7 @@ static void do_intel_finish_page_flip(st
29178
29179 atomic_clear_mask(1 << intel_crtc->plane,
29180 &obj->pending_flip.counter);
29181- if (atomic_read(&obj->pending_flip) == 0)
29182+ if (atomic_read_unchecked(&obj->pending_flip) == 0)
29183 wake_up(&dev_priv->pending_flip_queue);
29184
29185 schedule_work(&work->work);
29186@@ -6145,7 +6145,7 @@ static int intel_crtc_page_flip(struct d
29187 /* Block clients from rendering to the new back buffer until
29188 * the flip occurs and the object is no longer visible.
29189 */
29190- atomic_add(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
29191+ atomic_add_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
29192
29193 switch (INTEL_INFO(dev)->gen) {
29194 case 2:
29195diff -urNp linux-2.6.39.1/drivers/gpu/drm/mga/mga_drv.h linux-2.6.39.1/drivers/gpu/drm/mga/mga_drv.h
29196--- linux-2.6.39.1/drivers/gpu/drm/mga/mga_drv.h 2011-05-19 00:06:34.000000000 -0400
29197+++ linux-2.6.39.1/drivers/gpu/drm/mga/mga_drv.h 2011-05-22 19:36:31.000000000 -0400
29198@@ -120,9 +120,9 @@ typedef struct drm_mga_private {
29199 u32 clear_cmd;
29200 u32 maccess;
29201
29202- atomic_t vbl_received; /**< Number of vblanks received. */
29203+ atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
29204 wait_queue_head_t fence_queue;
29205- atomic_t last_fence_retired;
29206+ atomic_unchecked_t last_fence_retired;
29207 u32 next_fence_to_post;
29208
29209 unsigned int fb_cpp;
29210diff -urNp linux-2.6.39.1/drivers/gpu/drm/mga/mga_irq.c linux-2.6.39.1/drivers/gpu/drm/mga/mga_irq.c
29211--- linux-2.6.39.1/drivers/gpu/drm/mga/mga_irq.c 2011-05-19 00:06:34.000000000 -0400
29212+++ linux-2.6.39.1/drivers/gpu/drm/mga/mga_irq.c 2011-05-22 19:36:31.000000000 -0400
29213@@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_de
29214 if (crtc != 0)
29215 return 0;
29216
29217- return atomic_read(&dev_priv->vbl_received);
29218+ return atomic_read_unchecked(&dev_priv->vbl_received);
29219 }
29220
29221
29222@@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
29223 /* VBLANK interrupt */
29224 if (status & MGA_VLINEPEN) {
29225 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
29226- atomic_inc(&dev_priv->vbl_received);
29227+ atomic_inc_unchecked(&dev_priv->vbl_received);
29228 drm_handle_vblank(dev, 0);
29229 handled = 1;
29230 }
29231@@ -79,7 +79,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
29232 if ((prim_start & ~0x03) != (prim_end & ~0x03))
29233 MGA_WRITE(MGA_PRIMEND, prim_end);
29234
29235- atomic_inc(&dev_priv->last_fence_retired);
29236+ atomic_inc_unchecked(&dev_priv->last_fence_retired);
29237 DRM_WAKEUP(&dev_priv->fence_queue);
29238 handled = 1;
29239 }
29240@@ -130,7 +130,7 @@ int mga_driver_fence_wait(struct drm_dev
29241 * using fences.
29242 */
29243 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
29244- (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
29245+ (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
29246 - *sequence) <= (1 << 23)));
29247
29248 *sequence = cur_fence;
29249diff -urNp linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_acpi.c linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_acpi.c
29250--- linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_acpi.c 2011-05-19 00:06:34.000000000 -0400
29251+++ linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_acpi.c 2011-05-22 19:36:31.000000000 -0400
29252@@ -141,7 +141,7 @@ static int nouveau_dsm_get_client_id(str
29253 return VGA_SWITCHEROO_DIS;
29254 }
29255
29256-static struct vga_switcheroo_handler nouveau_dsm_handler = {
29257+static const struct vga_switcheroo_handler nouveau_dsm_handler = {
29258 .switchto = nouveau_dsm_switchto,
29259 .power_state = nouveau_dsm_power_state,
29260 .init = nouveau_dsm_init,
29261diff -urNp linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_drv.h linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_drv.h
29262--- linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-05-19 00:06:34.000000000 -0400
29263+++ linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-05-23 17:07:00.000000000 -0400
29264@@ -228,7 +228,7 @@ struct nouveau_channel {
29265 struct list_head pending;
29266 uint32_t sequence;
29267 uint32_t sequence_ack;
29268- atomic_t last_sequence_irq;
29269+ atomic_unchecked_t last_sequence_irq;
29270 } fence;
29271
29272 /* DMA push buffer */
29273@@ -520,8 +520,8 @@ struct nouveau_vram_engine {
29274
29275 struct nouveau_engine {
29276 struct nouveau_instmem_engine instmem;
29277- struct nouveau_mc_engine mc;
29278- struct nouveau_timer_engine timer;
29279+ struct nouveau_mc_engine mc;
29280+ struct nouveau_timer_engine timer;
29281 struct nouveau_fb_engine fb;
29282 struct nouveau_pgraph_engine graph;
29283 struct nouveau_fifo_engine fifo;
29284@@ -529,7 +529,7 @@ struct nouveau_engine {
29285 struct nouveau_gpio_engine gpio;
29286 struct nouveau_pm_engine pm;
29287 struct nouveau_crypt_engine crypt;
29288- struct nouveau_vram_engine vram;
29289+ struct nouveau_vram_engine vram;
29290 };
29291
29292 struct nouveau_pll_vals {
29293@@ -662,7 +662,7 @@ struct drm_nouveau_private {
29294 struct drm_global_reference mem_global_ref;
29295 struct ttm_bo_global_ref bo_global_ref;
29296 struct ttm_bo_device bdev;
29297- atomic_t validate_sequence;
29298+ atomic_unchecked_t validate_sequence;
29299 } ttm;
29300
29301 struct {
29302diff -urNp linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_fence.c linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_fence.c
29303--- linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_fence.c 2011-05-19 00:06:34.000000000 -0400
29304+++ linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_fence.c 2011-05-22 19:36:31.000000000 -0400
29305@@ -85,7 +85,7 @@ nouveau_fence_update(struct nouveau_chan
29306 if (USE_REFCNT(dev))
29307 sequence = nvchan_rd32(chan, 0x48);
29308 else
29309- sequence = atomic_read(&chan->fence.last_sequence_irq);
29310+ sequence = atomic_read_unchecked(&chan->fence.last_sequence_irq);
29311
29312 if (chan->fence.sequence_ack == sequence)
29313 goto out;
29314@@ -553,7 +553,7 @@ nouveau_fence_channel_init(struct nouvea
29315 out_initialised:
29316 INIT_LIST_HEAD(&chan->fence.pending);
29317 spin_lock_init(&chan->fence.lock);
29318- atomic_set(&chan->fence.last_sequence_irq, 0);
29319+ atomic_set_unchecked(&chan->fence.last_sequence_irq, 0);
29320 return 0;
29321 }
29322
29323diff -urNp linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_gem.c linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_gem.c
29324--- linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_gem.c 2011-05-19 00:06:34.000000000 -0400
29325+++ linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_gem.c 2011-05-22 19:36:31.000000000 -0400
29326@@ -249,7 +249,7 @@ validate_init(struct nouveau_channel *ch
29327 int trycnt = 0;
29328 int ret, i;
29329
29330- sequence = atomic_add_return(1, &dev_priv->ttm.validate_sequence);
29331+ sequence = atomic_add_return_unchecked(1, &dev_priv->ttm.validate_sequence);
29332 retry:
29333 if (++trycnt > 100000) {
29334 NV_ERROR(dev, "%s failed and gave up.\n", __func__);
29335diff -urNp linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_state.c linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_state.c
29336--- linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_state.c 2011-05-19 00:06:34.000000000 -0400
29337+++ linux-2.6.39.1/drivers/gpu/drm/nouveau/nouveau_state.c 2011-05-22 19:36:31.000000000 -0400
29338@@ -583,7 +583,7 @@ static bool nouveau_switcheroo_can_switc
29339 bool can_switch;
29340
29341 spin_lock(&dev->count_lock);
29342- can_switch = (dev->open_count == 0);
29343+ can_switch = (local_read(&dev->open_count) == 0);
29344 spin_unlock(&dev->count_lock);
29345 return can_switch;
29346 }
29347diff -urNp linux-2.6.39.1/drivers/gpu/drm/nouveau/nv04_graph.c linux-2.6.39.1/drivers/gpu/drm/nouveau/nv04_graph.c
29348--- linux-2.6.39.1/drivers/gpu/drm/nouveau/nv04_graph.c 2011-05-19 00:06:34.000000000 -0400
29349+++ linux-2.6.39.1/drivers/gpu/drm/nouveau/nv04_graph.c 2011-05-22 19:36:31.000000000 -0400
29350@@ -552,7 +552,7 @@ static int
29351 nv04_graph_mthd_set_ref(struct nouveau_channel *chan,
29352 u32 class, u32 mthd, u32 data)
29353 {
29354- atomic_set(&chan->fence.last_sequence_irq, data);
29355+ atomic_set_unchecked(&chan->fence.last_sequence_irq, data);
29356 return 0;
29357 }
29358
29359diff -urNp linux-2.6.39.1/drivers/gpu/drm/r128/r128_cce.c linux-2.6.39.1/drivers/gpu/drm/r128/r128_cce.c
29360--- linux-2.6.39.1/drivers/gpu/drm/r128/r128_cce.c 2011-05-19 00:06:34.000000000 -0400
29361+++ linux-2.6.39.1/drivers/gpu/drm/r128/r128_cce.c 2011-05-22 19:36:31.000000000 -0400
29362@@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_d
29363
29364 /* GH: Simple idle check.
29365 */
29366- atomic_set(&dev_priv->idle_count, 0);
29367+ atomic_set_unchecked(&dev_priv->idle_count, 0);
29368
29369 /* We don't support anything other than bus-mastering ring mode,
29370 * but the ring can be in either AGP or PCI space for the ring
29371diff -urNp linux-2.6.39.1/drivers/gpu/drm/r128/r128_drv.h linux-2.6.39.1/drivers/gpu/drm/r128/r128_drv.h
29372--- linux-2.6.39.1/drivers/gpu/drm/r128/r128_drv.h 2011-05-19 00:06:34.000000000 -0400
29373+++ linux-2.6.39.1/drivers/gpu/drm/r128/r128_drv.h 2011-05-22 19:36:31.000000000 -0400
29374@@ -90,14 +90,14 @@ typedef struct drm_r128_private {
29375 int is_pci;
29376 unsigned long cce_buffers_offset;
29377
29378- atomic_t idle_count;
29379+ atomic_unchecked_t idle_count;
29380
29381 int page_flipping;
29382 int current_page;
29383 u32 crtc_offset;
29384 u32 crtc_offset_cntl;
29385
29386- atomic_t vbl_received;
29387+ atomic_unchecked_t vbl_received;
29388
29389 u32 color_fmt;
29390 unsigned int front_offset;
29391diff -urNp linux-2.6.39.1/drivers/gpu/drm/r128/r128_irq.c linux-2.6.39.1/drivers/gpu/drm/r128/r128_irq.c
29392--- linux-2.6.39.1/drivers/gpu/drm/r128/r128_irq.c 2011-05-19 00:06:34.000000000 -0400
29393+++ linux-2.6.39.1/drivers/gpu/drm/r128/r128_irq.c 2011-05-22 19:36:31.000000000 -0400
29394@@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_d
29395 if (crtc != 0)
29396 return 0;
29397
29398- return atomic_read(&dev_priv->vbl_received);
29399+ return atomic_read_unchecked(&dev_priv->vbl_received);
29400 }
29401
29402 irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
29403@@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_
29404 /* VBLANK interrupt */
29405 if (status & R128_CRTC_VBLANK_INT) {
29406 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
29407- atomic_inc(&dev_priv->vbl_received);
29408+ atomic_inc_unchecked(&dev_priv->vbl_received);
29409 drm_handle_vblank(dev, 0);
29410 return IRQ_HANDLED;
29411 }
29412diff -urNp linux-2.6.39.1/drivers/gpu/drm/r128/r128_state.c linux-2.6.39.1/drivers/gpu/drm/r128/r128_state.c
29413--- linux-2.6.39.1/drivers/gpu/drm/r128/r128_state.c 2011-05-19 00:06:34.000000000 -0400
29414+++ linux-2.6.39.1/drivers/gpu/drm/r128/r128_state.c 2011-05-22 19:36:31.000000000 -0400
29415@@ -321,10 +321,10 @@ static void r128_clear_box(drm_r128_priv
29416
29417 static void r128_cce_performance_boxes(drm_r128_private_t *dev_priv)
29418 {
29419- if (atomic_read(&dev_priv->idle_count) == 0)
29420+ if (atomic_read_unchecked(&dev_priv->idle_count) == 0)
29421 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
29422 else
29423- atomic_set(&dev_priv->idle_count, 0);
29424+ atomic_set_unchecked(&dev_priv->idle_count, 0);
29425 }
29426
29427 #endif
29428diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/atom.c linux-2.6.39.1/drivers/gpu/drm/radeon/atom.c
29429--- linux-2.6.39.1/drivers/gpu/drm/radeon/atom.c 2011-05-19 00:06:34.000000000 -0400
29430+++ linux-2.6.39.1/drivers/gpu/drm/radeon/atom.c 2011-05-22 19:36:31.000000000 -0400
29431@@ -1245,6 +1245,8 @@ struct atom_context *atom_parse(struct c
29432 char name[512];
29433 int i;
29434
29435+ pax_track_stack();
29436+
29437 ctx->card = card;
29438 ctx->bios = bios;
29439
29440diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.39.1/drivers/gpu/drm/radeon/mkregtable.c
29441--- linux-2.6.39.1/drivers/gpu/drm/radeon/mkregtable.c 2011-05-19 00:06:34.000000000 -0400
29442+++ linux-2.6.39.1/drivers/gpu/drm/radeon/mkregtable.c 2011-05-22 19:36:31.000000000 -0400
29443@@ -637,14 +637,14 @@ static int parser_auth(struct table *t,
29444 regex_t mask_rex;
29445 regmatch_t match[4];
29446 char buf[1024];
29447- size_t end;
29448+ long end;
29449 int len;
29450 int done = 0;
29451 int r;
29452 unsigned o;
29453 struct offset *offset;
29454 char last_reg_s[10];
29455- int last_reg;
29456+ unsigned long last_reg;
29457
29458 if (regcomp
29459 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
29460diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_atombios.c
29461--- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_atombios.c 2011-05-19 00:06:34.000000000 -0400
29462+++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_atombios.c 2011-05-22 19:36:31.000000000 -0400
29463@@ -545,6 +545,8 @@ bool radeon_get_atom_connector_info_from
29464 struct radeon_gpio_rec gpio;
29465 struct radeon_hpd hpd;
29466
29467+ pax_track_stack();
29468+
29469 if (!atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset))
29470 return false;
29471
29472diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_atpx_handler.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_atpx_handler.c
29473--- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_atpx_handler.c 2011-05-19 00:06:34.000000000 -0400
29474+++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_atpx_handler.c 2011-05-22 19:36:31.000000000 -0400
29475@@ -234,7 +234,7 @@ static int radeon_atpx_get_client_id(str
29476 return VGA_SWITCHEROO_DIS;
29477 }
29478
29479-static struct vga_switcheroo_handler radeon_atpx_handler = {
29480+static const struct vga_switcheroo_handler radeon_atpx_handler = {
29481 .switchto = radeon_atpx_switchto,
29482 .power_state = radeon_atpx_power_state,
29483 .init = radeon_atpx_init,
29484diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_device.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_device.c
29485--- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_device.c 2011-05-19 00:06:34.000000000 -0400
29486+++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_device.c 2011-05-22 19:36:31.000000000 -0400
29487@@ -674,7 +674,7 @@ static bool radeon_switcheroo_can_switch
29488 bool can_switch;
29489
29490 spin_lock(&dev->count_lock);
29491- can_switch = (dev->open_count == 0);
29492+ can_switch = (local_read(&dev->open_count) == 0);
29493 spin_unlock(&dev->count_lock);
29494 return can_switch;
29495 }
29496diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_display.c
29497--- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_display.c 2011-05-19 00:06:34.000000000 -0400
29498+++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_display.c 2011-05-22 19:36:31.000000000 -0400
29499@@ -934,6 +934,8 @@ void radeon_compute_pll_legacy(struct ra
29500 uint32_t post_div;
29501 u32 pll_out_min, pll_out_max;
29502
29503+ pax_track_stack();
29504+
29505 DRM_DEBUG_KMS("PLL freq %llu %u %u\n", freq, pll->min_ref_div, pll->max_ref_div);
29506 freq = freq * 1000;
29507
29508diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_drv.h linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_drv.h
29509--- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_drv.h 2011-05-19 00:06:34.000000000 -0400
29510+++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_drv.h 2011-05-22 19:36:31.000000000 -0400
29511@@ -255,7 +255,7 @@ typedef struct drm_radeon_private {
29512
29513 /* SW interrupt */
29514 wait_queue_head_t swi_queue;
29515- atomic_t swi_emitted;
29516+ atomic_unchecked_t swi_emitted;
29517 int vblank_crtc;
29518 uint32_t irq_enable_reg;
29519 uint32_t r500_disp_irq_reg;
29520diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_fence.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_fence.c
29521--- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_fence.c 2011-05-19 00:06:34.000000000 -0400
29522+++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_fence.c 2011-05-22 19:36:31.000000000 -0400
29523@@ -49,7 +49,7 @@ int radeon_fence_emit(struct radeon_devi
29524 write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
29525 return 0;
29526 }
29527- fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
29528+ fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
29529 if (!rdev->cp.ready) {
29530 /* FIXME: cp is not running assume everythings is done right
29531 * away
29532@@ -352,7 +352,7 @@ int radeon_fence_driver_init(struct rade
29533 return r;
29534 }
29535 WREG32(rdev->fence_drv.scratch_reg, 0);
29536- atomic_set(&rdev->fence_drv.seq, 0);
29537+ atomic_set_unchecked(&rdev->fence_drv.seq, 0);
29538 INIT_LIST_HEAD(&rdev->fence_drv.created);
29539 INIT_LIST_HEAD(&rdev->fence_drv.emited);
29540 INIT_LIST_HEAD(&rdev->fence_drv.signaled);
29541diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon.h linux-2.6.39.1/drivers/gpu/drm/radeon/radeon.h
29542--- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon.h 2011-05-19 00:06:34.000000000 -0400
29543+++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon.h 2011-05-22 19:36:31.000000000 -0400
29544@@ -189,7 +189,7 @@ extern int sumo_get_temp(struct radeon_d
29545 */
29546 struct radeon_fence_driver {
29547 uint32_t scratch_reg;
29548- atomic_t seq;
29549+ atomic_unchecked_t seq;
29550 uint32_t last_seq;
29551 unsigned long last_jiffies;
29552 unsigned long last_timeout;
29553diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_ioc32.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_ioc32.c
29554--- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-05-19 00:06:34.000000000 -0400
29555+++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-05-22 19:36:31.000000000 -0400
29556@@ -359,7 +359,7 @@ static int compat_radeon_cp_setparam(str
29557 request = compat_alloc_user_space(sizeof(*request));
29558 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
29559 || __put_user(req32.param, &request->param)
29560- || __put_user((void __user *)(unsigned long)req32.value,
29561+ || __put_user((unsigned long)req32.value,
29562 &request->value))
29563 return -EFAULT;
29564
29565diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_irq.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_irq.c
29566--- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_irq.c 2011-05-19 00:06:34.000000000 -0400
29567+++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_irq.c 2011-05-22 19:36:31.000000000 -0400
29568@@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_de
29569 unsigned int ret;
29570 RING_LOCALS;
29571
29572- atomic_inc(&dev_priv->swi_emitted);
29573- ret = atomic_read(&dev_priv->swi_emitted);
29574+ atomic_inc_unchecked(&dev_priv->swi_emitted);
29575+ ret = atomic_read_unchecked(&dev_priv->swi_emitted);
29576
29577 BEGIN_RING(4);
29578 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
29579@@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct
29580 drm_radeon_private_t *dev_priv =
29581 (drm_radeon_private_t *) dev->dev_private;
29582
29583- atomic_set(&dev_priv->swi_emitted, 0);
29584+ atomic_set_unchecked(&dev_priv->swi_emitted, 0);
29585 DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
29586
29587 dev->max_vblank_count = 0x001fffff;
29588diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_state.c
29589--- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_state.c 2011-05-19 00:06:34.000000000 -0400
29590+++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_state.c 2011-05-22 19:36:31.000000000 -0400
29591@@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_de
29592 if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS)
29593 sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS;
29594
29595- if (DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
29596+ if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS || DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
29597 sarea_priv->nbox * sizeof(depth_boxes[0])))
29598 return -EFAULT;
29599
29600@@ -3031,7 +3031,7 @@ static int radeon_cp_getparam(struct drm
29601 {
29602 drm_radeon_private_t *dev_priv = dev->dev_private;
29603 drm_radeon_getparam_t *param = data;
29604- int value;
29605+ int value = 0;
29606
29607 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
29608
29609diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_ttm.c
29610--- linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_ttm.c 2011-05-19 00:06:34.000000000 -0400
29611+++ linux-2.6.39.1/drivers/gpu/drm/radeon/radeon_ttm.c 2011-05-22 19:36:31.000000000 -0400
29612@@ -603,8 +603,9 @@ void radeon_ttm_set_active_vram_size(str
29613 man->size = size >> PAGE_SHIFT;
29614 }
29615
29616-static struct vm_operations_struct radeon_ttm_vm_ops;
29617-static const struct vm_operations_struct *ttm_vm_ops = NULL;
29618+extern int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf);
29619+extern void ttm_bo_vm_open(struct vm_area_struct *vma);
29620+extern void ttm_bo_vm_close(struct vm_area_struct *vma);
29621
29622 static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
29623 {
29624@@ -612,17 +613,22 @@ static int radeon_ttm_fault(struct vm_ar
29625 struct radeon_device *rdev;
29626 int r;
29627
29628- bo = (struct ttm_buffer_object *)vma->vm_private_data;
29629- if (bo == NULL) {
29630+ bo = (struct ttm_buffer_object *)vma->vm_private_data;
29631+ if (!bo)
29632 return VM_FAULT_NOPAGE;
29633- }
29634 rdev = radeon_get_rdev(bo->bdev);
29635 mutex_lock(&rdev->vram_mutex);
29636- r = ttm_vm_ops->fault(vma, vmf);
29637+ r = ttm_bo_vm_fault(vma, vmf);
29638 mutex_unlock(&rdev->vram_mutex);
29639 return r;
29640 }
29641
29642+static const struct vm_operations_struct radeon_ttm_vm_ops = {
29643+ .fault = radeon_ttm_fault,
29644+ .open = ttm_bo_vm_open,
29645+ .close = ttm_bo_vm_close
29646+};
29647+
29648 int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
29649 {
29650 struct drm_file *file_priv;
29651@@ -635,18 +641,11 @@ int radeon_mmap(struct file *filp, struc
29652
29653 file_priv = filp->private_data;
29654 rdev = file_priv->minor->dev->dev_private;
29655- if (rdev == NULL) {
29656+ if (!rdev)
29657 return -EINVAL;
29658- }
29659 r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
29660- if (unlikely(r != 0)) {
29661+ if (r)
29662 return r;
29663- }
29664- if (unlikely(ttm_vm_ops == NULL)) {
29665- ttm_vm_ops = vma->vm_ops;
29666- radeon_ttm_vm_ops = *ttm_vm_ops;
29667- radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
29668- }
29669 vma->vm_ops = &radeon_ttm_vm_ops;
29670 return 0;
29671 }
29672diff -urNp linux-2.6.39.1/drivers/gpu/drm/radeon/rs690.c linux-2.6.39.1/drivers/gpu/drm/radeon/rs690.c
29673--- linux-2.6.39.1/drivers/gpu/drm/radeon/rs690.c 2011-05-19 00:06:34.000000000 -0400
29674+++ linux-2.6.39.1/drivers/gpu/drm/radeon/rs690.c 2011-05-22 19:36:31.000000000 -0400
29675@@ -304,9 +304,11 @@ void rs690_crtc_bandwidth_compute(struct
29676 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
29677 rdev->pm.sideport_bandwidth.full)
29678 rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
29679- read_delay_latency.full = dfixed_const(370 * 800 * 1000);
29680+ read_delay_latency.full = dfixed_const(800 * 1000);
29681 read_delay_latency.full = dfixed_div(read_delay_latency,
29682 rdev->pm.igp_sideport_mclk);
29683+ a.full = dfixed_const(370);
29684+ read_delay_latency.full = dfixed_mul(read_delay_latency, a);
29685 } else {
29686 if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
29687 rdev->pm.k8_bandwidth.full)
29688diff -urNp linux-2.6.39.1/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.39.1/drivers/gpu/drm/ttm/ttm_bo_vm.c
29689--- linux-2.6.39.1/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-05-19 00:06:34.000000000 -0400
29690+++ linux-2.6.39.1/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-05-22 19:36:31.000000000 -0400
29691@@ -69,11 +69,11 @@ static struct ttm_buffer_object *ttm_bo_
29692 return best_bo;
29693 }
29694
29695-static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
29696+int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
29697 {
29698 struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
29699 vma->vm_private_data;
29700- struct ttm_bo_device *bdev = bo->bdev;
29701+ struct ttm_bo_device *bdev;
29702 unsigned long page_offset;
29703 unsigned long page_last;
29704 unsigned long pfn;
29705@@ -83,8 +83,12 @@ static int ttm_bo_vm_fault(struct vm_are
29706 int i;
29707 unsigned long address = (unsigned long)vmf->virtual_address;
29708 int retval = VM_FAULT_NOPAGE;
29709- struct ttm_mem_type_manager *man =
29710- &bdev->man[bo->mem.mem_type];
29711+ struct ttm_mem_type_manager *man;
29712+
29713+ if (!bo)
29714+ return VM_FAULT_NOPAGE;
29715+ bdev = bo->bdev;
29716+ man = &bdev->man[bo->mem.mem_type];
29717
29718 /*
29719 * Work around locking order reversal in fault / nopfn
29720@@ -219,22 +223,25 @@ out_unlock:
29721 ttm_bo_unreserve(bo);
29722 return retval;
29723 }
29724+EXPORT_SYMBOL(ttm_bo_vm_fault);
29725
29726-static void ttm_bo_vm_open(struct vm_area_struct *vma)
29727+void ttm_bo_vm_open(struct vm_area_struct *vma)
29728 {
29729 struct ttm_buffer_object *bo =
29730 (struct ttm_buffer_object *)vma->vm_private_data;
29731
29732 (void)ttm_bo_reference(bo);
29733 }
29734+EXPORT_SYMBOL(ttm_bo_vm_open);
29735
29736-static void ttm_bo_vm_close(struct vm_area_struct *vma)
29737+void ttm_bo_vm_close(struct vm_area_struct *vma)
29738 {
29739 struct ttm_buffer_object *bo = (struct ttm_buffer_object *)vma->vm_private_data;
29740
29741 ttm_bo_unref(&bo);
29742 vma->vm_private_data = NULL;
29743 }
29744+EXPORT_SYMBOL(ttm_bo_vm_close);
29745
29746 static const struct vm_operations_struct ttm_bo_vm_ops = {
29747 .fault = ttm_bo_vm_fault,
29748diff -urNp linux-2.6.39.1/drivers/gpu/drm/ttm/ttm_page_alloc.c linux-2.6.39.1/drivers/gpu/drm/ttm/ttm_page_alloc.c
29749--- linux-2.6.39.1/drivers/gpu/drm/ttm/ttm_page_alloc.c 2011-05-19 00:06:34.000000000 -0400
29750+++ linux-2.6.39.1/drivers/gpu/drm/ttm/ttm_page_alloc.c 2011-05-22 19:36:31.000000000 -0400
29751@@ -397,9 +397,9 @@ static int ttm_pool_get_num_unused_pages
29752 */
29753 static int ttm_pool_mm_shrink(struct shrinker *shrink, int shrink_pages, gfp_t gfp_mask)
29754 {
29755- static atomic_t start_pool = ATOMIC_INIT(0);
29756+ static atomic_unchecked_t start_pool = ATOMIC_INIT(0);
29757 unsigned i;
29758- unsigned pool_offset = atomic_add_return(1, &start_pool);
29759+ unsigned pool_offset = atomic_add_return_unchecked(1, &start_pool);
29760 struct ttm_page_pool *pool;
29761
29762 pool_offset = pool_offset % NUM_POOLS;
29763diff -urNp linux-2.6.39.1/drivers/gpu/drm/via/via_drv.h linux-2.6.39.1/drivers/gpu/drm/via/via_drv.h
29764--- linux-2.6.39.1/drivers/gpu/drm/via/via_drv.h 2011-05-19 00:06:34.000000000 -0400
29765+++ linux-2.6.39.1/drivers/gpu/drm/via/via_drv.h 2011-05-22 19:36:31.000000000 -0400
29766@@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
29767 typedef uint32_t maskarray_t[5];
29768
29769 typedef struct drm_via_irq {
29770- atomic_t irq_received;
29771+ atomic_unchecked_t irq_received;
29772 uint32_t pending_mask;
29773 uint32_t enable_mask;
29774 wait_queue_head_t irq_queue;
29775@@ -75,7 +75,7 @@ typedef struct drm_via_private {
29776 struct timeval last_vblank;
29777 int last_vblank_valid;
29778 unsigned usec_per_vblank;
29779- atomic_t vbl_received;
29780+ atomic_unchecked_t vbl_received;
29781 drm_via_state_t hc_state;
29782 char pci_buf[VIA_PCI_BUF_SIZE];
29783 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
29784diff -urNp linux-2.6.39.1/drivers/gpu/drm/via/via_irq.c linux-2.6.39.1/drivers/gpu/drm/via/via_irq.c
29785--- linux-2.6.39.1/drivers/gpu/drm/via/via_irq.c 2011-05-19 00:06:34.000000000 -0400
29786+++ linux-2.6.39.1/drivers/gpu/drm/via/via_irq.c 2011-05-22 19:36:31.000000000 -0400
29787@@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_de
29788 if (crtc != 0)
29789 return 0;
29790
29791- return atomic_read(&dev_priv->vbl_received);
29792+ return atomic_read_unchecked(&dev_priv->vbl_received);
29793 }
29794
29795 irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
29796@@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_I
29797
29798 status = VIA_READ(VIA_REG_INTERRUPT);
29799 if (status & VIA_IRQ_VBLANK_PENDING) {
29800- atomic_inc(&dev_priv->vbl_received);
29801- if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
29802+ atomic_inc_unchecked(&dev_priv->vbl_received);
29803+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
29804 do_gettimeofday(&cur_vblank);
29805 if (dev_priv->last_vblank_valid) {
29806 dev_priv->usec_per_vblank =
29807@@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
29808 dev_priv->last_vblank = cur_vblank;
29809 dev_priv->last_vblank_valid = 1;
29810 }
29811- if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
29812+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
29813 DRM_DEBUG("US per vblank is: %u\n",
29814 dev_priv->usec_per_vblank);
29815 }
29816@@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
29817
29818 for (i = 0; i < dev_priv->num_irqs; ++i) {
29819 if (status & cur_irq->pending_mask) {
29820- atomic_inc(&cur_irq->irq_received);
29821+ atomic_inc_unchecked(&cur_irq->irq_received);
29822 DRM_WAKEUP(&cur_irq->irq_queue);
29823 handled = 1;
29824 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i)
29825@@ -243,11 +243,11 @@ via_driver_irq_wait(struct drm_device *d
29826 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
29827 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
29828 masks[irq][4]));
29829- cur_irq_sequence = atomic_read(&cur_irq->irq_received);
29830+ cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
29831 } else {
29832 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
29833 (((cur_irq_sequence =
29834- atomic_read(&cur_irq->irq_received)) -
29835+ atomic_read_unchecked(&cur_irq->irq_received)) -
29836 *sequence) <= (1 << 23)));
29837 }
29838 *sequence = cur_irq_sequence;
29839@@ -285,7 +285,7 @@ void via_driver_irq_preinstall(struct dr
29840 }
29841
29842 for (i = 0; i < dev_priv->num_irqs; ++i) {
29843- atomic_set(&cur_irq->irq_received, 0);
29844+ atomic_set_unchecked(&cur_irq->irq_received, 0);
29845 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
29846 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
29847 DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
29848@@ -367,7 +367,7 @@ int via_wait_irq(struct drm_device *dev,
29849 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
29850 case VIA_IRQ_RELATIVE:
29851 irqwait->request.sequence +=
29852- atomic_read(&cur_irq->irq_received);
29853+ atomic_read_unchecked(&cur_irq->irq_received);
29854 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
29855 case VIA_IRQ_ABSOLUTE:
29856 break;
29857diff -urNp linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
29858--- linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 2011-05-19 00:06:34.000000000 -0400
29859+++ linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 2011-05-22 19:36:31.000000000 -0400
29860@@ -240,7 +240,7 @@ struct vmw_private {
29861 * Fencing and IRQs.
29862 */
29863
29864- atomic_t fence_seq;
29865+ atomic_unchecked_t fence_seq;
29866 wait_queue_head_t fence_queue;
29867 wait_queue_head_t fifo_queue;
29868 atomic_t fence_queue_waiters;
29869diff -urNp linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
29870--- linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-05-19 00:06:34.000000000 -0400
29871+++ linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-05-22 19:36:31.000000000 -0400
29872@@ -151,7 +151,7 @@ int vmw_wait_lag(struct vmw_private *dev
29873 while (!vmw_lag_lt(queue, us)) {
29874 spin_lock(&queue->lock);
29875 if (list_empty(&queue->head))
29876- sequence = atomic_read(&dev_priv->fence_seq);
29877+ sequence = atomic_read_unchecked(&dev_priv->fence_seq);
29878 else {
29879 fence = list_first_entry(&queue->head,
29880 struct vmw_fence, head);
29881diff -urNp linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
29882--- linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-05-19 00:06:34.000000000 -0400
29883+++ linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-05-22 19:36:31.000000000 -0400
29884@@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *de
29885 (unsigned int) min,
29886 (unsigned int) fifo->capabilities);
29887
29888- atomic_set(&dev_priv->fence_seq, dev_priv->last_read_sequence);
29889+ atomic_set_unchecked(&dev_priv->fence_seq, dev_priv->last_read_sequence);
29890 iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE);
29891 vmw_fence_queue_init(&fifo->fence_queue);
29892 return vmw_fifo_send_fence(dev_priv, &dummy);
29893@@ -476,7 +476,7 @@ int vmw_fifo_send_fence(struct vmw_priva
29894
29895 fm = vmw_fifo_reserve(dev_priv, bytes);
29896 if (unlikely(fm == NULL)) {
29897- *sequence = atomic_read(&dev_priv->fence_seq);
29898+ *sequence = atomic_read_unchecked(&dev_priv->fence_seq);
29899 ret = -ENOMEM;
29900 (void)vmw_fallback_wait(dev_priv, false, true, *sequence,
29901 false, 3*HZ);
29902@@ -484,7 +484,7 @@ int vmw_fifo_send_fence(struct vmw_priva
29903 }
29904
29905 do {
29906- *sequence = atomic_add_return(1, &dev_priv->fence_seq);
29907+ *sequence = atomic_add_return_unchecked(1, &dev_priv->fence_seq);
29908 } while (*sequence == 0);
29909
29910 if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
29911@@ -534,7 +534,7 @@ static int vmw_fifo_vm_fault(struct vm_a
29912 return VM_FAULT_SIGBUS;
29913 }
29914
29915-static struct vm_operations_struct vmw_fifo_vm_ops = {
29916+static const struct vm_operations_struct vmw_fifo_vm_ops = {
29917 .fault = vmw_fifo_vm_fault,
29918 .open = NULL,
29919 .close = NULL
29920diff -urNp linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
29921--- linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c 2011-05-19 00:06:34.000000000 -0400
29922+++ linux-2.6.39.1/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c 2011-05-22 19:36:31.000000000 -0400
29923@@ -100,7 +100,7 @@ bool vmw_fence_signaled(struct vmw_priva
29924 * emitted. Then the fence is stale and signaled.
29925 */
29926
29927- ret = ((atomic_read(&dev_priv->fence_seq) - sequence)
29928+ ret = ((atomic_read_unchecked(&dev_priv->fence_seq) - sequence)
29929 > VMW_FENCE_WRAP);
29930
29931 return ret;
29932@@ -131,7 +131,7 @@ int vmw_fallback_wait(struct vmw_private
29933
29934 if (fifo_idle)
29935 down_read(&fifo_state->rwsem);
29936- signal_seq = atomic_read(&dev_priv->fence_seq);
29937+ signal_seq = atomic_read_unchecked(&dev_priv->fence_seq);
29938 ret = 0;
29939
29940 for (;;) {
29941diff -urNp linux-2.6.39.1/drivers/gpu/vga/vga_switcheroo.c linux-2.6.39.1/drivers/gpu/vga/vga_switcheroo.c
29942--- linux-2.6.39.1/drivers/gpu/vga/vga_switcheroo.c 2011-05-19 00:06:34.000000000 -0400
29943+++ linux-2.6.39.1/drivers/gpu/vga/vga_switcheroo.c 2011-05-22 19:36:31.000000000 -0400
29944@@ -53,7 +53,7 @@ struct vgasr_priv {
29945 int registered_clients;
29946 struct vga_switcheroo_client clients[VGA_SWITCHEROO_MAX_CLIENTS];
29947
29948- struct vga_switcheroo_handler *handler;
29949+ const struct vga_switcheroo_handler *handler;
29950 };
29951
29952 static int vga_switcheroo_debugfs_init(struct vgasr_priv *priv);
29953@@ -62,7 +62,7 @@ static void vga_switcheroo_debugfs_fini(
29954 /* only one switcheroo per system */
29955 static struct vgasr_priv vgasr_priv;
29956
29957-int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler)
29958+int vga_switcheroo_register_handler(const struct vga_switcheroo_handler *handler)
29959 {
29960 mutex_lock(&vgasr_mutex);
29961 if (vgasr_priv.handler) {
29962diff -urNp linux-2.6.39.1/drivers/hid/hid-core.c linux-2.6.39.1/drivers/hid/hid-core.c
29963--- linux-2.6.39.1/drivers/hid/hid-core.c 2011-05-19 00:06:34.000000000 -0400
29964+++ linux-2.6.39.1/drivers/hid/hid-core.c 2011-05-22 19:36:31.000000000 -0400
29965@@ -1888,7 +1888,7 @@ static bool hid_ignore(struct hid_device
29966
29967 int hid_add_device(struct hid_device *hdev)
29968 {
29969- static atomic_t id = ATOMIC_INIT(0);
29970+ static atomic_unchecked_t id = ATOMIC_INIT(0);
29971 int ret;
29972
29973 if (WARN_ON(hdev->status & HID_STAT_ADDED))
29974@@ -1903,7 +1903,7 @@ int hid_add_device(struct hid_device *hd
29975 /* XXX hack, any other cleaner solution after the driver core
29976 * is converted to allow more than 20 bytes as the device name? */
29977 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
29978- hdev->vendor, hdev->product, atomic_inc_return(&id));
29979+ hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
29980
29981 hid_debug_register(hdev, dev_name(&hdev->dev));
29982 ret = device_add(&hdev->dev);
29983diff -urNp linux-2.6.39.1/drivers/hid/hid-picolcd.c linux-2.6.39.1/drivers/hid/hid-picolcd.c
29984--- linux-2.6.39.1/drivers/hid/hid-picolcd.c 2011-05-19 00:06:34.000000000 -0400
29985+++ linux-2.6.39.1/drivers/hid/hid-picolcd.c 2011-05-22 19:36:31.000000000 -0400
29986@@ -1037,7 +1037,7 @@ static int picolcd_check_lcd_fb(struct l
29987 return fb && fb == picolcd_fbinfo((struct picolcd_data *)lcd_get_data(ldev));
29988 }
29989
29990-static struct lcd_ops picolcd_lcdops = {
29991+static const struct lcd_ops picolcd_lcdops = {
29992 .get_contrast = picolcd_get_contrast,
29993 .set_contrast = picolcd_set_contrast,
29994 .check_fb = picolcd_check_lcd_fb,
29995diff -urNp linux-2.6.39.1/drivers/hid/usbhid/hiddev.c linux-2.6.39.1/drivers/hid/usbhid/hiddev.c
29996--- linux-2.6.39.1/drivers/hid/usbhid/hiddev.c 2011-05-19 00:06:34.000000000 -0400
29997+++ linux-2.6.39.1/drivers/hid/usbhid/hiddev.c 2011-05-22 19:36:31.000000000 -0400
29998@@ -613,7 +613,7 @@ static long hiddev_ioctl(struct file *fi
29999 break;
30000
30001 case HIDIOCAPPLICATION:
30002- if (arg < 0 || arg >= hid->maxapplication)
30003+ if (arg >= hid->maxapplication)
30004 break;
30005
30006 for (i = 0; i < hid->maxcollection; i++)
30007diff -urNp linux-2.6.39.1/drivers/hwmon/ibmaem.c linux-2.6.39.1/drivers/hwmon/ibmaem.c
30008--- linux-2.6.39.1/drivers/hwmon/ibmaem.c 2011-05-19 00:06:34.000000000 -0400
30009+++ linux-2.6.39.1/drivers/hwmon/ibmaem.c 2011-05-22 19:36:31.000000000 -0400
30010@@ -238,7 +238,7 @@ struct aem_read_sensor_resp {
30011 struct aem_driver_data {
30012 struct list_head aem_devices;
30013 struct ipmi_smi_watcher bmc_events;
30014- struct ipmi_user_hndl ipmi_hndlrs;
30015+ const struct ipmi_user_hndl ipmi_hndlrs;
30016 };
30017
30018 static void aem_register_bmc(int iface, struct device *dev);
30019diff -urNp linux-2.6.39.1/drivers/hwmon/ibmpex.c linux-2.6.39.1/drivers/hwmon/ibmpex.c
30020--- linux-2.6.39.1/drivers/hwmon/ibmpex.c 2011-05-19 00:06:34.000000000 -0400
30021+++ linux-2.6.39.1/drivers/hwmon/ibmpex.c 2011-05-22 19:36:31.000000000 -0400
30022@@ -110,7 +110,7 @@ struct ibmpex_bmc_data {
30023 struct ibmpex_driver_data {
30024 struct list_head bmc_data;
30025 struct ipmi_smi_watcher bmc_events;
30026- struct ipmi_user_hndl ipmi_hndlrs;
30027+ const struct ipmi_user_hndl ipmi_hndlrs;
30028 };
30029
30030 static struct ibmpex_driver_data driver_data = {
30031diff -urNp linux-2.6.39.1/drivers/hwmon/sht15.c linux-2.6.39.1/drivers/hwmon/sht15.c
30032--- linux-2.6.39.1/drivers/hwmon/sht15.c 2011-05-19 00:06:34.000000000 -0400
30033+++ linux-2.6.39.1/drivers/hwmon/sht15.c 2011-05-22 19:36:31.000000000 -0400
30034@@ -113,7 +113,7 @@ struct sht15_data {
30035 int supply_uV;
30036 int supply_uV_valid;
30037 struct work_struct update_supply_work;
30038- atomic_t interrupt_handled;
30039+ atomic_unchecked_t interrupt_handled;
30040 };
30041
30042 /**
30043@@ -246,13 +246,13 @@ static inline int sht15_update_single_va
30044 return ret;
30045
30046 gpio_direction_input(data->pdata->gpio_data);
30047- atomic_set(&data->interrupt_handled, 0);
30048+ atomic_set_unchecked(&data->interrupt_handled, 0);
30049
30050 enable_irq(gpio_to_irq(data->pdata->gpio_data));
30051 if (gpio_get_value(data->pdata->gpio_data) == 0) {
30052 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
30053 /* Only relevant if the interrupt hasn't occurred. */
30054- if (!atomic_read(&data->interrupt_handled))
30055+ if (!atomic_read_unchecked(&data->interrupt_handled))
30056 schedule_work(&data->read_work);
30057 }
30058 ret = wait_event_timeout(data->wait_queue,
30059@@ -399,7 +399,7 @@ static irqreturn_t sht15_interrupt_fired
30060 struct sht15_data *data = d;
30061 /* First disable the interrupt */
30062 disable_irq_nosync(irq);
30063- atomic_inc(&data->interrupt_handled);
30064+ atomic_inc_unchecked(&data->interrupt_handled);
30065 /* Then schedule a reading work struct */
30066 if (data->flag != SHT15_READING_NOTHING)
30067 schedule_work(&data->read_work);
30068@@ -450,11 +450,11 @@ static void sht15_bh_read_data(struct wo
30069 here as could have gone low in meantime so verify
30070 it hasn't!
30071 */
30072- atomic_set(&data->interrupt_handled, 0);
30073+ atomic_set_unchecked(&data->interrupt_handled, 0);
30074 enable_irq(gpio_to_irq(data->pdata->gpio_data));
30075 /* If still not occurred or another handler has been scheduled */
30076 if (gpio_get_value(data->pdata->gpio_data)
30077- || atomic_read(&data->interrupt_handled))
30078+ || atomic_read_unchecked(&data->interrupt_handled))
30079 return;
30080 }
30081 /* Read the data back from the device */
30082diff -urNp linux-2.6.39.1/drivers/hwmon/w83791d.c linux-2.6.39.1/drivers/hwmon/w83791d.c
30083--- linux-2.6.39.1/drivers/hwmon/w83791d.c 2011-05-19 00:06:34.000000000 -0400
30084+++ linux-2.6.39.1/drivers/hwmon/w83791d.c 2011-05-22 19:36:31.000000000 -0400
30085@@ -329,8 +329,8 @@ static int w83791d_detect(struct i2c_cli
30086 struct i2c_board_info *info);
30087 static int w83791d_remove(struct i2c_client *client);
30088
30089-static int w83791d_read(struct i2c_client *client, u8 register);
30090-static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
30091+static int w83791d_read(struct i2c_client *client, u8 reg);
30092+static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
30093 static struct w83791d_data *w83791d_update_device(struct device *dev);
30094
30095 #ifdef DEBUG
30096diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-at91.c linux-2.6.39.1/drivers/i2c/busses/i2c-at91.c
30097--- linux-2.6.39.1/drivers/i2c/busses/i2c-at91.c 2011-05-19 00:06:34.000000000 -0400
30098+++ linux-2.6.39.1/drivers/i2c/busses/i2c-at91.c 2011-05-22 19:36:31.000000000 -0400
30099@@ -181,7 +181,7 @@ static u32 at91_func(struct i2c_adapter
30100 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30101 }
30102
30103-static struct i2c_algorithm at91_algorithm = {
30104+static const struct i2c_algorithm at91_algorithm = {
30105 .master_xfer = at91_xfer,
30106 .functionality = at91_func,
30107 };
30108diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-bfin-twi.c linux-2.6.39.1/drivers/i2c/busses/i2c-bfin-twi.c
30109--- linux-2.6.39.1/drivers/i2c/busses/i2c-bfin-twi.c 2011-05-19 00:06:34.000000000 -0400
30110+++ linux-2.6.39.1/drivers/i2c/busses/i2c-bfin-twi.c 2011-05-22 19:36:31.000000000 -0400
30111@@ -599,7 +599,7 @@ static u32 bfin_twi_functionality(struct
30112 I2C_FUNC_I2C | I2C_FUNC_SMBUS_I2C_BLOCK;
30113 }
30114
30115-static struct i2c_algorithm bfin_twi_algorithm = {
30116+static const struct i2c_algorithm bfin_twi_algorithm = {
30117 .master_xfer = bfin_twi_master_xfer,
30118 .smbus_xfer = bfin_twi_smbus_xfer,
30119 .functionality = bfin_twi_functionality,
30120diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-davinci.c linux-2.6.39.1/drivers/i2c/busses/i2c-davinci.c
30121--- linux-2.6.39.1/drivers/i2c/busses/i2c-davinci.c 2011-05-19 00:06:34.000000000 -0400
30122+++ linux-2.6.39.1/drivers/i2c/busses/i2c-davinci.c 2011-05-22 19:36:31.000000000 -0400
30123@@ -630,7 +630,7 @@ static inline void i2c_davinci_cpufreq_d
30124 }
30125 #endif
30126
30127-static struct i2c_algorithm i2c_davinci_algo = {
30128+static const struct i2c_algorithm i2c_davinci_algo = {
30129 .master_xfer = i2c_davinci_xfer,
30130 .functionality = i2c_davinci_func,
30131 };
30132diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-designware.c linux-2.6.39.1/drivers/i2c/busses/i2c-designware.c
30133--- linux-2.6.39.1/drivers/i2c/busses/i2c-designware.c 2011-05-19 00:06:34.000000000 -0400
30134+++ linux-2.6.39.1/drivers/i2c/busses/i2c-designware.c 2011-05-22 19:36:31.000000000 -0400
30135@@ -689,7 +689,7 @@ tx_aborted:
30136 return IRQ_HANDLED;
30137 }
30138
30139-static struct i2c_algorithm i2c_dw_algo = {
30140+static const struct i2c_algorithm i2c_dw_algo = {
30141 .master_xfer = i2c_dw_xfer,
30142 .functionality = i2c_dw_func,
30143 };
30144diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-eg20t.c linux-2.6.39.1/drivers/i2c/busses/i2c-eg20t.c
30145--- linux-2.6.39.1/drivers/i2c/busses/i2c-eg20t.c 2011-05-19 00:06:34.000000000 -0400
30146+++ linux-2.6.39.1/drivers/i2c/busses/i2c-eg20t.c 2011-05-22 19:36:31.000000000 -0400
30147@@ -708,7 +708,7 @@ static u32 pch_i2c_func(struct i2c_adapt
30148 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL | I2C_FUNC_10BIT_ADDR;
30149 }
30150
30151-static struct i2c_algorithm pch_algorithm = {
30152+static const struct i2c_algorithm pch_algorithm = {
30153 .master_xfer = pch_i2c_xfer,
30154 .functionality = pch_i2c_func
30155 };
30156diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-imx.c linux-2.6.39.1/drivers/i2c/busses/i2c-imx.c
30157--- linux-2.6.39.1/drivers/i2c/busses/i2c-imx.c 2011-05-19 00:06:34.000000000 -0400
30158+++ linux-2.6.39.1/drivers/i2c/busses/i2c-imx.c 2011-05-22 19:36:31.000000000 -0400
30159@@ -457,7 +457,7 @@ static u32 i2c_imx_func(struct i2c_adapt
30160 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30161 }
30162
30163-static struct i2c_algorithm i2c_imx_algo = {
30164+static const struct i2c_algorithm i2c_imx_algo = {
30165 .master_xfer = i2c_imx_xfer,
30166 .functionality = i2c_imx_func,
30167 };
30168diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-intel-mid.c linux-2.6.39.1/drivers/i2c/busses/i2c-intel-mid.c
30169--- linux-2.6.39.1/drivers/i2c/busses/i2c-intel-mid.c 2011-05-19 00:06:34.000000000 -0400
30170+++ linux-2.6.39.1/drivers/i2c/busses/i2c-intel-mid.c 2011-05-22 19:36:31.000000000 -0400
30171@@ -917,7 +917,7 @@ err:
30172 return IRQ_HANDLED;
30173 }
30174
30175-static struct i2c_algorithm intel_mid_i2c_algorithm = {
30176+static const struct i2c_algorithm intel_mid_i2c_algorithm = {
30177 .master_xfer = intel_mid_i2c_xfer,
30178 .functionality = intel_mid_i2c_func,
30179 };
30180diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-nforce2.c linux-2.6.39.1/drivers/i2c/busses/i2c-nforce2.c
30181--- linux-2.6.39.1/drivers/i2c/busses/i2c-nforce2.c 2011-05-19 00:06:34.000000000 -0400
30182+++ linux-2.6.39.1/drivers/i2c/busses/i2c-nforce2.c 2011-05-22 19:36:31.000000000 -0400
30183@@ -303,7 +303,7 @@ static u32 nforce2_func(struct i2c_adapt
30184 I2C_FUNC_SMBUS_BLOCK_DATA : 0);
30185 }
30186
30187-static struct i2c_algorithm smbus_algorithm = {
30188+static const struct i2c_algorithm smbus_algorithm = {
30189 .smbus_xfer = nforce2_access,
30190 .functionality = nforce2_func,
30191 };
30192diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-pmcmsp.c linux-2.6.39.1/drivers/i2c/busses/i2c-pmcmsp.c
30193--- linux-2.6.39.1/drivers/i2c/busses/i2c-pmcmsp.c 2011-05-19 00:06:34.000000000 -0400
30194+++ linux-2.6.39.1/drivers/i2c/busses/i2c-pmcmsp.c 2011-05-22 19:36:31.000000000 -0400
30195@@ -615,7 +615,7 @@ static u32 pmcmsptwi_i2c_func(struct i2c
30196
30197 /* -- Initialization -- */
30198
30199-static struct i2c_algorithm pmcmsptwi_algo = {
30200+static const struct i2c_algorithm pmcmsptwi_algo = {
30201 .master_xfer = pmcmsptwi_master_xfer,
30202 .functionality = pmcmsptwi_i2c_func,
30203 };
30204diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-pnx.c linux-2.6.39.1/drivers/i2c/busses/i2c-pnx.c
30205--- linux-2.6.39.1/drivers/i2c/busses/i2c-pnx.c 2011-05-19 00:06:34.000000000 -0400
30206+++ linux-2.6.39.1/drivers/i2c/busses/i2c-pnx.c 2011-05-22 19:36:31.000000000 -0400
30207@@ -535,7 +535,7 @@ static u32 i2c_pnx_func(struct i2c_adapt
30208 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30209 }
30210
30211-static struct i2c_algorithm pnx_algorithm = {
30212+static const struct i2c_algorithm pnx_algorithm = {
30213 .master_xfer = i2c_pnx_xfer,
30214 .functionality = i2c_pnx_func,
30215 };
30216diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-puv3.c linux-2.6.39.1/drivers/i2c/busses/i2c-puv3.c
30217--- linux-2.6.39.1/drivers/i2c/busses/i2c-puv3.c 2011-05-19 00:06:34.000000000 -0400
30218+++ linux-2.6.39.1/drivers/i2c/busses/i2c-puv3.c 2011-05-22 19:36:31.000000000 -0400
30219@@ -176,7 +176,7 @@ static u32 puv3_i2c_func(struct i2c_adap
30220 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30221 }
30222
30223-static struct i2c_algorithm puv3_i2c_algorithm = {
30224+static const struct i2c_algorithm puv3_i2c_algorithm = {
30225 .master_xfer = puv3_i2c_xfer,
30226 .functionality = puv3_i2c_func,
30227 };
30228diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-s6000.c linux-2.6.39.1/drivers/i2c/busses/i2c-s6000.c
30229--- linux-2.6.39.1/drivers/i2c/busses/i2c-s6000.c 2011-05-19 00:06:34.000000000 -0400
30230+++ linux-2.6.39.1/drivers/i2c/busses/i2c-s6000.c 2011-05-22 19:36:31.000000000 -0400
30231@@ -243,7 +243,7 @@ static u32 s6i2c_functionality(struct i2
30232 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30233 }
30234
30235-static struct i2c_algorithm s6i2c_algorithm = {
30236+static const struct i2c_algorithm s6i2c_algorithm = {
30237 .master_xfer = s6i2c_master_xfer,
30238 .functionality = s6i2c_functionality,
30239 };
30240diff -urNp linux-2.6.39.1/drivers/i2c/busses/i2c-sh_mobile.c linux-2.6.39.1/drivers/i2c/busses/i2c-sh_mobile.c
30241--- linux-2.6.39.1/drivers/i2c/busses/i2c-sh_mobile.c 2011-05-19 00:06:34.000000000 -0400
30242+++ linux-2.6.39.1/drivers/i2c/busses/i2c-sh_mobile.c 2011-05-22 19:36:31.000000000 -0400
30243@@ -529,7 +529,7 @@ static u32 sh_mobile_i2c_func(struct i2c
30244 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30245 }
30246
30247-static struct i2c_algorithm sh_mobile_i2c_algorithm = {
30248+static const struct i2c_algorithm sh_mobile_i2c_algorithm = {
30249 .functionality = sh_mobile_i2c_func,
30250 .master_xfer = sh_mobile_i2c_xfer,
30251 };
30252diff -urNp linux-2.6.39.1/drivers/ide/ide-cd.c linux-2.6.39.1/drivers/ide/ide-cd.c
30253--- linux-2.6.39.1/drivers/ide/ide-cd.c 2011-06-03 00:04:14.000000000 -0400
30254+++ linux-2.6.39.1/drivers/ide/ide-cd.c 2011-06-03 00:32:05.000000000 -0400
30255@@ -769,7 +769,7 @@ static void cdrom_do_block_pc(ide_drive_
30256 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
30257 if ((unsigned long)buf & alignment
30258 || blk_rq_bytes(rq) & q->dma_pad_mask
30259- || object_is_on_stack(buf))
30260+ || object_starts_on_stack(buf))
30261 drive->dma = 0;
30262 }
30263 }
30264diff -urNp linux-2.6.39.1/drivers/ide/ide-floppy.c linux-2.6.39.1/drivers/ide/ide-floppy.c
30265--- linux-2.6.39.1/drivers/ide/ide-floppy.c 2011-05-19 00:06:34.000000000 -0400
30266+++ linux-2.6.39.1/drivers/ide/ide-floppy.c 2011-05-22 19:36:31.000000000 -0400
30267@@ -379,6 +379,8 @@ static int ide_floppy_get_capacity(ide_d
30268 u8 pc_buf[256], header_len, desc_cnt;
30269 int i, rc = 1, blocks, length;
30270
30271+ pax_track_stack();
30272+
30273 ide_debug_log(IDE_DBG_FUNC, "enter");
30274
30275 drive->bios_cyl = 0;
30276diff -urNp linux-2.6.39.1/drivers/ide/it821x.c linux-2.6.39.1/drivers/ide/it821x.c
30277--- linux-2.6.39.1/drivers/ide/it821x.c 2011-05-19 00:06:34.000000000 -0400
30278+++ linux-2.6.39.1/drivers/ide/it821x.c 2011-05-22 19:36:31.000000000 -0400
30279@@ -508,7 +508,7 @@ static void it821x_quirkproc(ide_drive_t
30280
30281 }
30282
30283-static struct ide_dma_ops it821x_pass_through_dma_ops = {
30284+static const struct ide_dma_ops it821x_pass_through_dma_ops = {
30285 .dma_host_set = ide_dma_host_set,
30286 .dma_setup = ide_dma_setup,
30287 .dma_start = it821x_dma_start,
30288diff -urNp linux-2.6.39.1/drivers/ide/setup-pci.c linux-2.6.39.1/drivers/ide/setup-pci.c
30289--- linux-2.6.39.1/drivers/ide/setup-pci.c 2011-05-19 00:06:34.000000000 -0400
30290+++ linux-2.6.39.1/drivers/ide/setup-pci.c 2011-05-22 19:36:31.000000000 -0400
30291@@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev
30292 int ret, i, n_ports = dev2 ? 4 : 2;
30293 struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
30294
30295+ pax_track_stack();
30296+
30297 for (i = 0; i < n_ports / 2; i++) {
30298 ret = ide_setup_pci_controller(pdev[i], d, !i);
30299 if (ret < 0)
30300diff -urNp linux-2.6.39.1/drivers/ide/trm290.c linux-2.6.39.1/drivers/ide/trm290.c
30301--- linux-2.6.39.1/drivers/ide/trm290.c 2011-05-19 00:06:34.000000000 -0400
30302+++ linux-2.6.39.1/drivers/ide/trm290.c 2011-05-22 19:36:31.000000000 -0400
30303@@ -314,7 +314,7 @@ static const struct ide_tp_ops trm290_tp
30304 .output_data = ide_output_data,
30305 };
30306
30307-static struct ide_dma_ops trm290_dma_ops = {
30308+static const struct ide_dma_ops trm290_dma_ops = {
30309 .dma_host_set = trm290_dma_host_set,
30310 .dma_setup = trm290_dma_setup,
30311 .dma_start = trm290_dma_start,
30312diff -urNp linux-2.6.39.1/drivers/infiniband/core/cm.c linux-2.6.39.1/drivers/infiniband/core/cm.c
30313--- linux-2.6.39.1/drivers/infiniband/core/cm.c 2011-05-19 00:06:34.000000000 -0400
30314+++ linux-2.6.39.1/drivers/infiniband/core/cm.c 2011-05-22 19:36:31.000000000 -0400
30315@@ -113,7 +113,7 @@ static char const counter_group_names[CM
30316
30317 struct cm_counter_group {
30318 struct kobject obj;
30319- atomic_long_t counter[CM_ATTR_COUNT];
30320+ atomic_long_unchecked_t counter[CM_ATTR_COUNT];
30321 };
30322
30323 struct cm_counter_attribute {
30324@@ -1387,7 +1387,7 @@ static void cm_dup_req_handler(struct cm
30325 struct ib_mad_send_buf *msg = NULL;
30326 int ret;
30327
30328- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30329+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30330 counter[CM_REQ_COUNTER]);
30331
30332 /* Quick state check to discard duplicate REQs. */
30333@@ -1765,7 +1765,7 @@ static void cm_dup_rep_handler(struct cm
30334 if (!cm_id_priv)
30335 return;
30336
30337- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30338+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30339 counter[CM_REP_COUNTER]);
30340 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
30341 if (ret)
30342@@ -1932,7 +1932,7 @@ static int cm_rtu_handler(struct cm_work
30343 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
30344 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
30345 spin_unlock_irq(&cm_id_priv->lock);
30346- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30347+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30348 counter[CM_RTU_COUNTER]);
30349 goto out;
30350 }
30351@@ -2115,7 +2115,7 @@ static int cm_dreq_handler(struct cm_wor
30352 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
30353 dreq_msg->local_comm_id);
30354 if (!cm_id_priv) {
30355- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30356+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30357 counter[CM_DREQ_COUNTER]);
30358 cm_issue_drep(work->port, work->mad_recv_wc);
30359 return -EINVAL;
30360@@ -2140,7 +2140,7 @@ static int cm_dreq_handler(struct cm_wor
30361 case IB_CM_MRA_REP_RCVD:
30362 break;
30363 case IB_CM_TIMEWAIT:
30364- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30365+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30366 counter[CM_DREQ_COUNTER]);
30367 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
30368 goto unlock;
30369@@ -2154,7 +2154,7 @@ static int cm_dreq_handler(struct cm_wor
30370 cm_free_msg(msg);
30371 goto deref;
30372 case IB_CM_DREQ_RCVD:
30373- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30374+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30375 counter[CM_DREQ_COUNTER]);
30376 goto unlock;
30377 default:
30378@@ -2521,7 +2521,7 @@ static int cm_mra_handler(struct cm_work
30379 ib_modify_mad(cm_id_priv->av.port->mad_agent,
30380 cm_id_priv->msg, timeout)) {
30381 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
30382- atomic_long_inc(&work->port->
30383+ atomic_long_inc_unchecked(&work->port->
30384 counter_group[CM_RECV_DUPLICATES].
30385 counter[CM_MRA_COUNTER]);
30386 goto out;
30387@@ -2530,7 +2530,7 @@ static int cm_mra_handler(struct cm_work
30388 break;
30389 case IB_CM_MRA_REQ_RCVD:
30390 case IB_CM_MRA_REP_RCVD:
30391- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30392+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30393 counter[CM_MRA_COUNTER]);
30394 /* fall through */
30395 default:
30396@@ -2692,7 +2692,7 @@ static int cm_lap_handler(struct cm_work
30397 case IB_CM_LAP_IDLE:
30398 break;
30399 case IB_CM_MRA_LAP_SENT:
30400- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30401+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30402 counter[CM_LAP_COUNTER]);
30403 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
30404 goto unlock;
30405@@ -2708,7 +2708,7 @@ static int cm_lap_handler(struct cm_work
30406 cm_free_msg(msg);
30407 goto deref;
30408 case IB_CM_LAP_RCVD:
30409- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30410+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30411 counter[CM_LAP_COUNTER]);
30412 goto unlock;
30413 default:
30414@@ -2992,7 +2992,7 @@ static int cm_sidr_req_handler(struct cm
30415 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
30416 if (cur_cm_id_priv) {
30417 spin_unlock_irq(&cm.lock);
30418- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30419+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30420 counter[CM_SIDR_REQ_COUNTER]);
30421 goto out; /* Duplicate message. */
30422 }
30423@@ -3204,10 +3204,10 @@ static void cm_send_handler(struct ib_ma
30424 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
30425 msg->retries = 1;
30426
30427- atomic_long_add(1 + msg->retries,
30428+ atomic_long_add_unchecked(1 + msg->retries,
30429 &port->counter_group[CM_XMIT].counter[attr_index]);
30430 if (msg->retries)
30431- atomic_long_add(msg->retries,
30432+ atomic_long_add_unchecked(msg->retries,
30433 &port->counter_group[CM_XMIT_RETRIES].
30434 counter[attr_index]);
30435
30436@@ -3417,7 +3417,7 @@ static void cm_recv_handler(struct ib_ma
30437 }
30438
30439 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
30440- atomic_long_inc(&port->counter_group[CM_RECV].
30441+ atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
30442 counter[attr_id - CM_ATTR_ID_OFFSET]);
30443
30444 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
30445@@ -3615,7 +3615,7 @@ static ssize_t cm_show_counter(struct ko
30446 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
30447
30448 return sprintf(buf, "%ld\n",
30449- atomic_long_read(&group->counter[cm_attr->index]));
30450+ atomic_long_read_unchecked(&group->counter[cm_attr->index]));
30451 }
30452
30453 static const struct sysfs_ops cm_counter_ops = {
30454diff -urNp linux-2.6.39.1/drivers/infiniband/core/fmr_pool.c linux-2.6.39.1/drivers/infiniband/core/fmr_pool.c
30455--- linux-2.6.39.1/drivers/infiniband/core/fmr_pool.c 2011-05-19 00:06:34.000000000 -0400
30456+++ linux-2.6.39.1/drivers/infiniband/core/fmr_pool.c 2011-05-22 19:36:31.000000000 -0400
30457@@ -97,8 +97,8 @@ struct ib_fmr_pool {
30458
30459 struct task_struct *thread;
30460
30461- atomic_t req_ser;
30462- atomic_t flush_ser;
30463+ atomic_unchecked_t req_ser;
30464+ atomic_unchecked_t flush_ser;
30465
30466 wait_queue_head_t force_wait;
30467 };
30468@@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *p
30469 struct ib_fmr_pool *pool = pool_ptr;
30470
30471 do {
30472- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
30473+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
30474 ib_fmr_batch_release(pool);
30475
30476- atomic_inc(&pool->flush_ser);
30477+ atomic_inc_unchecked(&pool->flush_ser);
30478 wake_up_interruptible(&pool->force_wait);
30479
30480 if (pool->flush_function)
30481@@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *p
30482 }
30483
30484 set_current_state(TASK_INTERRUPTIBLE);
30485- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
30486+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
30487 !kthread_should_stop())
30488 schedule();
30489 __set_current_state(TASK_RUNNING);
30490@@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(s
30491 pool->dirty_watermark = params->dirty_watermark;
30492 pool->dirty_len = 0;
30493 spin_lock_init(&pool->pool_lock);
30494- atomic_set(&pool->req_ser, 0);
30495- atomic_set(&pool->flush_ser, 0);
30496+ atomic_set_unchecked(&pool->req_ser, 0);
30497+ atomic_set_unchecked(&pool->flush_ser, 0);
30498 init_waitqueue_head(&pool->force_wait);
30499
30500 pool->thread = kthread_run(ib_fmr_cleanup_thread,
30501@@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool
30502 }
30503 spin_unlock_irq(&pool->pool_lock);
30504
30505- serial = atomic_inc_return(&pool->req_ser);
30506+ serial = atomic_inc_return_unchecked(&pool->req_ser);
30507 wake_up_process(pool->thread);
30508
30509 if (wait_event_interruptible(pool->force_wait,
30510- atomic_read(&pool->flush_ser) - serial >= 0))
30511+ atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
30512 return -EINTR;
30513
30514 return 0;
30515@@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr
30516 } else {
30517 list_add_tail(&fmr->list, &pool->dirty_list);
30518 if (++pool->dirty_len >= pool->dirty_watermark) {
30519- atomic_inc(&pool->req_ser);
30520+ atomic_inc_unchecked(&pool->req_ser);
30521 wake_up_process(pool->thread);
30522 }
30523 }
30524diff -urNp linux-2.6.39.1/drivers/infiniband/hw/cxgb4/mem.c linux-2.6.39.1/drivers/infiniband/hw/cxgb4/mem.c
30525--- linux-2.6.39.1/drivers/infiniband/hw/cxgb4/mem.c 2011-05-19 00:06:34.000000000 -0400
30526+++ linux-2.6.39.1/drivers/infiniband/hw/cxgb4/mem.c 2011-05-22 19:36:31.000000000 -0400
30527@@ -122,7 +122,7 @@ static int write_tpt_entry(struct c4iw_r
30528 int err;
30529 struct fw_ri_tpte tpt;
30530 u32 stag_idx;
30531- static atomic_t key;
30532+ static atomic_unchecked_t key;
30533
30534 if (c4iw_fatal_error(rdev))
30535 return -EIO;
30536@@ -135,7 +135,7 @@ static int write_tpt_entry(struct c4iw_r
30537 &rdev->resource.tpt_fifo_lock);
30538 if (!stag_idx)
30539 return -ENOMEM;
30540- *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
30541+ *stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff);
30542 }
30543 PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
30544 __func__, stag_state, type, pdid, stag_idx);
30545diff -urNp linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_dma.c linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_dma.c
30546--- linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_dma.c 2011-05-19 00:06:34.000000000 -0400
30547+++ linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_dma.c 2011-05-22 19:36:31.000000000 -0400
30548@@ -175,7 +175,7 @@ static void ipath_dma_free_coherent(stru
30549 free_pages((unsigned long) cpu_addr, get_order(size));
30550 }
30551
30552-struct ib_dma_mapping_ops ipath_dma_mapping_ops = {
30553+const struct ib_dma_mapping_ops ipath_dma_mapping_ops = {
30554 ipath_mapping_error,
30555 ipath_dma_map_single,
30556 ipath_dma_unmap_single,
30557diff -urNp linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_fs.c linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_fs.c
30558--- linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_fs.c 2011-05-19 00:06:34.000000000 -0400
30559+++ linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_fs.c 2011-05-22 19:36:31.000000000 -0400
30560@@ -113,6 +113,8 @@ static ssize_t atomic_counters_read(stru
30561 struct infinipath_counters counters;
30562 struct ipath_devdata *dd;
30563
30564+ pax_track_stack();
30565+
30566 dd = file->f_path.dentry->d_inode->i_private;
30567 dd->ipath_f_read_counters(dd, &counters);
30568
30569diff -urNp linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_rc.c linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_rc.c
30570--- linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_rc.c 2011-05-19 00:06:34.000000000 -0400
30571+++ linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_rc.c 2011-05-22 19:36:31.000000000 -0400
30572@@ -1868,7 +1868,7 @@ void ipath_rc_rcv(struct ipath_ibdev *de
30573 struct ib_atomic_eth *ateth;
30574 struct ipath_ack_entry *e;
30575 u64 vaddr;
30576- atomic64_t *maddr;
30577+ atomic64_unchecked_t *maddr;
30578 u64 sdata;
30579 u32 rkey;
30580 u8 next;
30581@@ -1903,11 +1903,11 @@ void ipath_rc_rcv(struct ipath_ibdev *de
30582 IB_ACCESS_REMOTE_ATOMIC)))
30583 goto nack_acc_unlck;
30584 /* Perform atomic OP and save result. */
30585- maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30586+ maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30587 sdata = be64_to_cpu(ateth->swap_data);
30588 e = &qp->s_ack_queue[qp->r_head_ack_queue];
30589 e->atomic_data = (opcode == OP(FETCH_ADD)) ?
30590- (u64) atomic64_add_return(sdata, maddr) - sdata :
30591+ (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30592 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30593 be64_to_cpu(ateth->compare_data),
30594 sdata);
30595diff -urNp linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_ruc.c linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_ruc.c
30596--- linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_ruc.c 2011-05-19 00:06:34.000000000 -0400
30597+++ linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_ruc.c 2011-05-22 19:36:31.000000000 -0400
30598@@ -266,7 +266,7 @@ static void ipath_ruc_loopback(struct ip
30599 unsigned long flags;
30600 struct ib_wc wc;
30601 u64 sdata;
30602- atomic64_t *maddr;
30603+ atomic64_unchecked_t *maddr;
30604 enum ib_wc_status send_status;
30605
30606 /*
30607@@ -382,11 +382,11 @@ again:
30608 IB_ACCESS_REMOTE_ATOMIC)))
30609 goto acc_err;
30610 /* Perform atomic OP and save result. */
30611- maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30612+ maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30613 sdata = wqe->wr.wr.atomic.compare_add;
30614 *(u64 *) sqp->s_sge.sge.vaddr =
30615 (wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ?
30616- (u64) atomic64_add_return(sdata, maddr) - sdata :
30617+ (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30618 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30619 sdata, wqe->wr.wr.atomic.swap);
30620 goto send_comp;
30621diff -urNp linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_verbs.h linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_verbs.h
30622--- linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_verbs.h 2011-05-19 00:06:34.000000000 -0400
30623+++ linux-2.6.39.1/drivers/infiniband/hw/ipath/ipath_verbs.h 2011-05-22 19:36:31.000000000 -0400
30624@@ -931,6 +931,6 @@ extern unsigned int ib_ipath_max_srq_wrs
30625
30626 extern const u32 ib_ipath_rnr_table[];
30627
30628-extern struct ib_dma_mapping_ops ipath_dma_mapping_ops;
30629+extern const struct ib_dma_mapping_ops ipath_dma_mapping_ops;
30630
30631 #endif /* IPATH_VERBS_H */
30632diff -urNp linux-2.6.39.1/drivers/infiniband/hw/nes/nes.c linux-2.6.39.1/drivers/infiniband/hw/nes/nes.c
30633--- linux-2.6.39.1/drivers/infiniband/hw/nes/nes.c 2011-05-19 00:06:34.000000000 -0400
30634+++ linux-2.6.39.1/drivers/infiniband/hw/nes/nes.c 2011-05-22 19:36:31.000000000 -0400
30635@@ -103,7 +103,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limi
30636 LIST_HEAD(nes_adapter_list);
30637 static LIST_HEAD(nes_dev_list);
30638
30639-atomic_t qps_destroyed;
30640+atomic_unchecked_t qps_destroyed;
30641
30642 static unsigned int ee_flsh_adapter;
30643 static unsigned int sysfs_nonidx_addr;
30644@@ -275,7 +275,7 @@ static void nes_cqp_rem_ref_callback(str
30645 struct nes_qp *nesqp = cqp_request->cqp_callback_pointer;
30646 struct nes_adapter *nesadapter = nesdev->nesadapter;
30647
30648- atomic_inc(&qps_destroyed);
30649+ atomic_inc_unchecked(&qps_destroyed);
30650
30651 /* Free the control structures */
30652
30653diff -urNp linux-2.6.39.1/drivers/infiniband/hw/nes/nes_cm.c linux-2.6.39.1/drivers/infiniband/hw/nes/nes_cm.c
30654--- linux-2.6.39.1/drivers/infiniband/hw/nes/nes_cm.c 2011-05-19 00:06:34.000000000 -0400
30655+++ linux-2.6.39.1/drivers/infiniband/hw/nes/nes_cm.c 2011-05-22 19:36:31.000000000 -0400
30656@@ -68,14 +68,14 @@ u32 cm_packets_dropped;
30657 u32 cm_packets_retrans;
30658 u32 cm_packets_created;
30659 u32 cm_packets_received;
30660-atomic_t cm_listens_created;
30661-atomic_t cm_listens_destroyed;
30662+atomic_unchecked_t cm_listens_created;
30663+atomic_unchecked_t cm_listens_destroyed;
30664 u32 cm_backlog_drops;
30665-atomic_t cm_loopbacks;
30666-atomic_t cm_nodes_created;
30667-atomic_t cm_nodes_destroyed;
30668-atomic_t cm_accel_dropped_pkts;
30669-atomic_t cm_resets_recvd;
30670+atomic_unchecked_t cm_loopbacks;
30671+atomic_unchecked_t cm_nodes_created;
30672+atomic_unchecked_t cm_nodes_destroyed;
30673+atomic_unchecked_t cm_accel_dropped_pkts;
30674+atomic_unchecked_t cm_resets_recvd;
30675
30676 static inline int mini_cm_accelerated(struct nes_cm_core *,
30677 struct nes_cm_node *);
30678@@ -151,13 +151,13 @@ static struct nes_cm_ops nes_cm_api = {
30679
30680 static struct nes_cm_core *g_cm_core;
30681
30682-atomic_t cm_connects;
30683-atomic_t cm_accepts;
30684-atomic_t cm_disconnects;
30685-atomic_t cm_closes;
30686-atomic_t cm_connecteds;
30687-atomic_t cm_connect_reqs;
30688-atomic_t cm_rejects;
30689+atomic_unchecked_t cm_connects;
30690+atomic_unchecked_t cm_accepts;
30691+atomic_unchecked_t cm_disconnects;
30692+atomic_unchecked_t cm_closes;
30693+atomic_unchecked_t cm_connecteds;
30694+atomic_unchecked_t cm_connect_reqs;
30695+atomic_unchecked_t cm_rejects;
30696
30697
30698 /**
30699@@ -1045,7 +1045,7 @@ static int mini_cm_dec_refcnt_listen(str
30700 kfree(listener);
30701 listener = NULL;
30702 ret = 0;
30703- atomic_inc(&cm_listens_destroyed);
30704+ atomic_inc_unchecked(&cm_listens_destroyed);
30705 } else {
30706 spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
30707 }
30708@@ -1240,7 +1240,7 @@ static struct nes_cm_node *make_cm_node(
30709 cm_node->rem_mac);
30710
30711 add_hte_node(cm_core, cm_node);
30712- atomic_inc(&cm_nodes_created);
30713+ atomic_inc_unchecked(&cm_nodes_created);
30714
30715 return cm_node;
30716 }
30717@@ -1298,7 +1298,7 @@ static int rem_ref_cm_node(struct nes_cm
30718 }
30719
30720 atomic_dec(&cm_core->node_cnt);
30721- atomic_inc(&cm_nodes_destroyed);
30722+ atomic_inc_unchecked(&cm_nodes_destroyed);
30723 nesqp = cm_node->nesqp;
30724 if (nesqp) {
30725 nesqp->cm_node = NULL;
30726@@ -1365,7 +1365,7 @@ static int process_options(struct nes_cm
30727
30728 static void drop_packet(struct sk_buff *skb)
30729 {
30730- atomic_inc(&cm_accel_dropped_pkts);
30731+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
30732 dev_kfree_skb_any(skb);
30733 }
30734
30735@@ -1428,7 +1428,7 @@ static void handle_rst_pkt(struct nes_cm
30736 {
30737
30738 int reset = 0; /* whether to send reset in case of err.. */
30739- atomic_inc(&cm_resets_recvd);
30740+ atomic_inc_unchecked(&cm_resets_recvd);
30741 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
30742 " refcnt=%d\n", cm_node, cm_node->state,
30743 atomic_read(&cm_node->ref_count));
30744@@ -2057,7 +2057,7 @@ static struct nes_cm_node *mini_cm_conne
30745 rem_ref_cm_node(cm_node->cm_core, cm_node);
30746 return NULL;
30747 }
30748- atomic_inc(&cm_loopbacks);
30749+ atomic_inc_unchecked(&cm_loopbacks);
30750 loopbackremotenode->loopbackpartner = cm_node;
30751 loopbackremotenode->tcp_cntxt.rcv_wscale =
30752 NES_CM_DEFAULT_RCV_WND_SCALE;
30753@@ -2332,7 +2332,7 @@ static int mini_cm_recv_pkt(struct nes_c
30754 add_ref_cm_node(cm_node);
30755 } else if (cm_node->state == NES_CM_STATE_TSA) {
30756 rem_ref_cm_node(cm_core, cm_node);
30757- atomic_inc(&cm_accel_dropped_pkts);
30758+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
30759 dev_kfree_skb_any(skb);
30760 break;
30761 }
30762@@ -2638,7 +2638,7 @@ static int nes_cm_disconn_true(struct ne
30763
30764 if ((cm_id) && (cm_id->event_handler)) {
30765 if (issue_disconn) {
30766- atomic_inc(&cm_disconnects);
30767+ atomic_inc_unchecked(&cm_disconnects);
30768 cm_event.event = IW_CM_EVENT_DISCONNECT;
30769 cm_event.status = disconn_status;
30770 cm_event.local_addr = cm_id->local_addr;
30771@@ -2660,7 +2660,7 @@ static int nes_cm_disconn_true(struct ne
30772 }
30773
30774 if (issue_close) {
30775- atomic_inc(&cm_closes);
30776+ atomic_inc_unchecked(&cm_closes);
30777 nes_disconnect(nesqp, 1);
30778
30779 cm_id->provider_data = nesqp;
30780@@ -2791,7 +2791,7 @@ int nes_accept(struct iw_cm_id *cm_id, s
30781
30782 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
30783 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
30784- atomic_inc(&cm_accepts);
30785+ atomic_inc_unchecked(&cm_accepts);
30786
30787 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
30788 netdev_refcnt_read(nesvnic->netdev));
30789@@ -3001,7 +3001,7 @@ int nes_reject(struct iw_cm_id *cm_id, c
30790
30791 struct nes_cm_core *cm_core;
30792
30793- atomic_inc(&cm_rejects);
30794+ atomic_inc_unchecked(&cm_rejects);
30795 cm_node = (struct nes_cm_node *) cm_id->provider_data;
30796 loopback = cm_node->loopbackpartner;
30797 cm_core = cm_node->cm_core;
30798@@ -3067,7 +3067,7 @@ int nes_connect(struct iw_cm_id *cm_id,
30799 ntohl(cm_id->local_addr.sin_addr.s_addr),
30800 ntohs(cm_id->local_addr.sin_port));
30801
30802- atomic_inc(&cm_connects);
30803+ atomic_inc_unchecked(&cm_connects);
30804 nesqp->active_conn = 1;
30805
30806 /* cache the cm_id in the qp */
30807@@ -3173,7 +3173,7 @@ int nes_create_listen(struct iw_cm_id *c
30808 g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node);
30809 return err;
30810 }
30811- atomic_inc(&cm_listens_created);
30812+ atomic_inc_unchecked(&cm_listens_created);
30813 }
30814
30815 cm_id->add_ref(cm_id);
30816@@ -3278,7 +3278,7 @@ static void cm_event_connected(struct ne
30817 if (nesqp->destroyed) {
30818 return;
30819 }
30820- atomic_inc(&cm_connecteds);
30821+ atomic_inc_unchecked(&cm_connecteds);
30822 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
30823 " local port 0x%04X. jiffies = %lu.\n",
30824 nesqp->hwqp.qp_id,
30825@@ -3493,7 +3493,7 @@ static void cm_event_reset(struct nes_cm
30826
30827 cm_id->add_ref(cm_id);
30828 ret = cm_id->event_handler(cm_id, &cm_event);
30829- atomic_inc(&cm_closes);
30830+ atomic_inc_unchecked(&cm_closes);
30831 cm_event.event = IW_CM_EVENT_CLOSE;
30832 cm_event.status = IW_CM_EVENT_STATUS_OK;
30833 cm_event.provider_data = cm_id->provider_data;
30834@@ -3529,7 +3529,7 @@ static void cm_event_mpa_req(struct nes_
30835 return;
30836 cm_id = cm_node->cm_id;
30837
30838- atomic_inc(&cm_connect_reqs);
30839+ atomic_inc_unchecked(&cm_connect_reqs);
30840 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
30841 cm_node, cm_id, jiffies);
30842
30843@@ -3567,7 +3567,7 @@ static void cm_event_mpa_reject(struct n
30844 return;
30845 cm_id = cm_node->cm_id;
30846
30847- atomic_inc(&cm_connect_reqs);
30848+ atomic_inc_unchecked(&cm_connect_reqs);
30849 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
30850 cm_node, cm_id, jiffies);
30851
30852diff -urNp linux-2.6.39.1/drivers/infiniband/hw/nes/nes.h linux-2.6.39.1/drivers/infiniband/hw/nes/nes.h
30853--- linux-2.6.39.1/drivers/infiniband/hw/nes/nes.h 2011-05-19 00:06:34.000000000 -0400
30854+++ linux-2.6.39.1/drivers/infiniband/hw/nes/nes.h 2011-05-22 19:36:31.000000000 -0400
30855@@ -175,17 +175,17 @@ extern unsigned int nes_debug_level;
30856 extern unsigned int wqm_quanta;
30857 extern struct list_head nes_adapter_list;
30858
30859-extern atomic_t cm_connects;
30860-extern atomic_t cm_accepts;
30861-extern atomic_t cm_disconnects;
30862-extern atomic_t cm_closes;
30863-extern atomic_t cm_connecteds;
30864-extern atomic_t cm_connect_reqs;
30865-extern atomic_t cm_rejects;
30866-extern atomic_t mod_qp_timouts;
30867-extern atomic_t qps_created;
30868-extern atomic_t qps_destroyed;
30869-extern atomic_t sw_qps_destroyed;
30870+extern atomic_unchecked_t cm_connects;
30871+extern atomic_unchecked_t cm_accepts;
30872+extern atomic_unchecked_t cm_disconnects;
30873+extern atomic_unchecked_t cm_closes;
30874+extern atomic_unchecked_t cm_connecteds;
30875+extern atomic_unchecked_t cm_connect_reqs;
30876+extern atomic_unchecked_t cm_rejects;
30877+extern atomic_unchecked_t mod_qp_timouts;
30878+extern atomic_unchecked_t qps_created;
30879+extern atomic_unchecked_t qps_destroyed;
30880+extern atomic_unchecked_t sw_qps_destroyed;
30881 extern u32 mh_detected;
30882 extern u32 mh_pauses_sent;
30883 extern u32 cm_packets_sent;
30884@@ -194,14 +194,14 @@ extern u32 cm_packets_created;
30885 extern u32 cm_packets_received;
30886 extern u32 cm_packets_dropped;
30887 extern u32 cm_packets_retrans;
30888-extern atomic_t cm_listens_created;
30889-extern atomic_t cm_listens_destroyed;
30890+extern atomic_unchecked_t cm_listens_created;
30891+extern atomic_unchecked_t cm_listens_destroyed;
30892 extern u32 cm_backlog_drops;
30893-extern atomic_t cm_loopbacks;
30894-extern atomic_t cm_nodes_created;
30895-extern atomic_t cm_nodes_destroyed;
30896-extern atomic_t cm_accel_dropped_pkts;
30897-extern atomic_t cm_resets_recvd;
30898+extern atomic_unchecked_t cm_loopbacks;
30899+extern atomic_unchecked_t cm_nodes_created;
30900+extern atomic_unchecked_t cm_nodes_destroyed;
30901+extern atomic_unchecked_t cm_accel_dropped_pkts;
30902+extern atomic_unchecked_t cm_resets_recvd;
30903
30904 extern u32 int_mod_timer_init;
30905 extern u32 int_mod_cq_depth_256;
30906diff -urNp linux-2.6.39.1/drivers/infiniband/hw/nes/nes_nic.c linux-2.6.39.1/drivers/infiniband/hw/nes/nes_nic.c
30907--- linux-2.6.39.1/drivers/infiniband/hw/nes/nes_nic.c 2011-05-19 00:06:34.000000000 -0400
30908+++ linux-2.6.39.1/drivers/infiniband/hw/nes/nes_nic.c 2011-05-22 19:36:31.000000000 -0400
30909@@ -1302,31 +1302,31 @@ static void nes_netdev_get_ethtool_stats
30910 target_stat_values[++index] = mh_detected;
30911 target_stat_values[++index] = mh_pauses_sent;
30912 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
30913- target_stat_values[++index] = atomic_read(&cm_connects);
30914- target_stat_values[++index] = atomic_read(&cm_accepts);
30915- target_stat_values[++index] = atomic_read(&cm_disconnects);
30916- target_stat_values[++index] = atomic_read(&cm_connecteds);
30917- target_stat_values[++index] = atomic_read(&cm_connect_reqs);
30918- target_stat_values[++index] = atomic_read(&cm_rejects);
30919- target_stat_values[++index] = atomic_read(&mod_qp_timouts);
30920- target_stat_values[++index] = atomic_read(&qps_created);
30921- target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
30922- target_stat_values[++index] = atomic_read(&qps_destroyed);
30923- target_stat_values[++index] = atomic_read(&cm_closes);
30924+ target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
30925+ target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
30926+ target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
30927+ target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
30928+ target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
30929+ target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
30930+ target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
30931+ target_stat_values[++index] = atomic_read_unchecked(&qps_created);
30932+ target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
30933+ target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
30934+ target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
30935 target_stat_values[++index] = cm_packets_sent;
30936 target_stat_values[++index] = cm_packets_bounced;
30937 target_stat_values[++index] = cm_packets_created;
30938 target_stat_values[++index] = cm_packets_received;
30939 target_stat_values[++index] = cm_packets_dropped;
30940 target_stat_values[++index] = cm_packets_retrans;
30941- target_stat_values[++index] = atomic_read(&cm_listens_created);
30942- target_stat_values[++index] = atomic_read(&cm_listens_destroyed);
30943+ target_stat_values[++index] = atomic_read_unchecked(&cm_listens_created);
30944+ target_stat_values[++index] = atomic_read_unchecked(&cm_listens_destroyed);
30945 target_stat_values[++index] = cm_backlog_drops;
30946- target_stat_values[++index] = atomic_read(&cm_loopbacks);
30947- target_stat_values[++index] = atomic_read(&cm_nodes_created);
30948- target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
30949- target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
30950- target_stat_values[++index] = atomic_read(&cm_resets_recvd);
30951+ target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
30952+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
30953+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
30954+ target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
30955+ target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
30956 target_stat_values[++index] = nesadapter->free_4kpbl;
30957 target_stat_values[++index] = nesadapter->free_256pbl;
30958 target_stat_values[++index] = int_mod_timer_init;
30959diff -urNp linux-2.6.39.1/drivers/infiniband/hw/nes/nes_verbs.c linux-2.6.39.1/drivers/infiniband/hw/nes/nes_verbs.c
30960--- linux-2.6.39.1/drivers/infiniband/hw/nes/nes_verbs.c 2011-05-19 00:06:34.000000000 -0400
30961+++ linux-2.6.39.1/drivers/infiniband/hw/nes/nes_verbs.c 2011-05-22 19:36:31.000000000 -0400
30962@@ -46,9 +46,9 @@
30963
30964 #include <rdma/ib_umem.h>
30965
30966-atomic_t mod_qp_timouts;
30967-atomic_t qps_created;
30968-atomic_t sw_qps_destroyed;
30969+atomic_unchecked_t mod_qp_timouts;
30970+atomic_unchecked_t qps_created;
30971+atomic_unchecked_t sw_qps_destroyed;
30972
30973 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
30974
30975@@ -1141,7 +1141,7 @@ static struct ib_qp *nes_create_qp(struc
30976 if (init_attr->create_flags)
30977 return ERR_PTR(-EINVAL);
30978
30979- atomic_inc(&qps_created);
30980+ atomic_inc_unchecked(&qps_created);
30981 switch (init_attr->qp_type) {
30982 case IB_QPT_RC:
30983 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
30984@@ -1470,7 +1470,7 @@ static int nes_destroy_qp(struct ib_qp *
30985 struct iw_cm_event cm_event;
30986 int ret;
30987
30988- atomic_inc(&sw_qps_destroyed);
30989+ atomic_inc_unchecked(&sw_qps_destroyed);
30990 nesqp->destroyed = 1;
30991
30992 /* Blow away the connection if it exists. */
30993diff -urNp linux-2.6.39.1/drivers/infiniband/hw/qib/qib.h linux-2.6.39.1/drivers/infiniband/hw/qib/qib.h
30994--- linux-2.6.39.1/drivers/infiniband/hw/qib/qib.h 2011-05-19 00:06:34.000000000 -0400
30995+++ linux-2.6.39.1/drivers/infiniband/hw/qib/qib.h 2011-05-22 19:36:31.000000000 -0400
30996@@ -51,6 +51,7 @@
30997 #include <linux/completion.h>
30998 #include <linux/kref.h>
30999 #include <linux/sched.h>
31000+#include <linux/slab.h>
31001
31002 #include "qib_common.h"
31003 #include "qib_verbs.h"
31004@@ -87,7 +88,7 @@ struct qlogic_ib_stats {
31005 };
31006
31007 extern struct qlogic_ib_stats qib_stats;
31008-extern struct pci_error_handlers qib_pci_err_handler;
31009+extern const struct pci_error_handlers qib_pci_err_handler;
31010 extern struct pci_driver qib_driver;
31011
31012 #define QIB_CHIP_SWVERSION QIB_CHIP_VERS_MAJ
31013diff -urNp linux-2.6.39.1/drivers/infiniband/hw/qib/qib_mmap.c linux-2.6.39.1/drivers/infiniband/hw/qib/qib_mmap.c
31014--- linux-2.6.39.1/drivers/infiniband/hw/qib/qib_mmap.c 2011-05-19 00:06:34.000000000 -0400
31015+++ linux-2.6.39.1/drivers/infiniband/hw/qib/qib_mmap.c 2011-05-22 19:36:31.000000000 -0400
31016@@ -75,7 +75,7 @@ static void qib_vma_close(struct vm_area
31017 kref_put(&ip->ref, qib_release_mmap_info);
31018 }
31019
31020-static struct vm_operations_struct qib_vm_ops = {
31021+static const struct vm_operations_struct qib_vm_ops = {
31022 .open = qib_vma_open,
31023 .close = qib_vma_close,
31024 };
31025diff -urNp linux-2.6.39.1/drivers/infiniband/hw/qib/qib_pcie.c linux-2.6.39.1/drivers/infiniband/hw/qib/qib_pcie.c
31026--- linux-2.6.39.1/drivers/infiniband/hw/qib/qib_pcie.c 2011-05-19 00:06:34.000000000 -0400
31027+++ linux-2.6.39.1/drivers/infiniband/hw/qib/qib_pcie.c 2011-05-22 19:36:31.000000000 -0400
31028@@ -735,7 +735,7 @@ qib_pci_resume(struct pci_dev *pdev)
31029 qib_init(dd, 1); /* same as re-init after reset */
31030 }
31031
31032-struct pci_error_handlers qib_pci_err_handler = {
31033+const struct pci_error_handlers qib_pci_err_handler = {
31034 .error_detected = qib_pci_error_detected,
31035 .mmio_enabled = qib_pci_mmio_enabled,
31036 .link_reset = qib_pci_link_reset,
31037diff -urNp linux-2.6.39.1/drivers/input/gameport/gameport.c linux-2.6.39.1/drivers/input/gameport/gameport.c
31038--- linux-2.6.39.1/drivers/input/gameport/gameport.c 2011-05-19 00:06:34.000000000 -0400
31039+++ linux-2.6.39.1/drivers/input/gameport/gameport.c 2011-05-22 19:36:31.000000000 -0400
31040@@ -488,14 +488,14 @@ EXPORT_SYMBOL(gameport_set_phys);
31041 */
31042 static void gameport_init_port(struct gameport *gameport)
31043 {
31044- static atomic_t gameport_no = ATOMIC_INIT(0);
31045+ static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
31046
31047 __module_get(THIS_MODULE);
31048
31049 mutex_init(&gameport->drv_mutex);
31050 device_initialize(&gameport->dev);
31051 dev_set_name(&gameport->dev, "gameport%lu",
31052- (unsigned long)atomic_inc_return(&gameport_no) - 1);
31053+ (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
31054 gameport->dev.bus = &gameport_bus;
31055 gameport->dev.release = gameport_release_port;
31056 if (gameport->parent)
31057diff -urNp linux-2.6.39.1/drivers/input/input.c linux-2.6.39.1/drivers/input/input.c
31058--- linux-2.6.39.1/drivers/input/input.c 2011-05-19 00:06:34.000000000 -0400
31059+++ linux-2.6.39.1/drivers/input/input.c 2011-05-22 19:36:31.000000000 -0400
31060@@ -1815,7 +1815,7 @@ static void input_cleanse_bitmasks(struc
31061 */
31062 int input_register_device(struct input_dev *dev)
31063 {
31064- static atomic_t input_no = ATOMIC_INIT(0);
31065+ static atomic_unchecked_t input_no = ATOMIC_INIT(0);
31066 struct input_handler *handler;
31067 const char *path;
31068 int error;
31069@@ -1852,7 +1852,7 @@ int input_register_device(struct input_d
31070 dev->setkeycode = input_default_setkeycode;
31071
31072 dev_set_name(&dev->dev, "input%ld",
31073- (unsigned long) atomic_inc_return(&input_no) - 1);
31074+ (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
31075
31076 error = device_add(&dev->dev);
31077 if (error)
31078diff -urNp linux-2.6.39.1/drivers/input/joystick/sidewinder.c linux-2.6.39.1/drivers/input/joystick/sidewinder.c
31079--- linux-2.6.39.1/drivers/input/joystick/sidewinder.c 2011-05-19 00:06:34.000000000 -0400
31080+++ linux-2.6.39.1/drivers/input/joystick/sidewinder.c 2011-05-22 19:36:31.000000000 -0400
31081@@ -30,6 +30,7 @@
31082 #include <linux/kernel.h>
31083 #include <linux/module.h>
31084 #include <linux/slab.h>
31085+#include <linux/sched.h>
31086 #include <linux/init.h>
31087 #include <linux/input.h>
31088 #include <linux/gameport.h>
31089@@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
31090 unsigned char buf[SW_LENGTH];
31091 int i;
31092
31093+ pax_track_stack();
31094+
31095 i = sw_read_packet(sw->gameport, buf, sw->length, 0);
31096
31097 if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
31098diff -urNp linux-2.6.39.1/drivers/input/joystick/xpad.c linux-2.6.39.1/drivers/input/joystick/xpad.c
31099--- linux-2.6.39.1/drivers/input/joystick/xpad.c 2011-05-19 00:06:34.000000000 -0400
31100+++ linux-2.6.39.1/drivers/input/joystick/xpad.c 2011-05-22 19:36:31.000000000 -0400
31101@@ -689,7 +689,7 @@ static void xpad_led_set(struct led_clas
31102
31103 static int xpad_led_probe(struct usb_xpad *xpad)
31104 {
31105- static atomic_t led_seq = ATOMIC_INIT(0);
31106+ static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
31107 long led_no;
31108 struct xpad_led *led;
31109 struct led_classdev *led_cdev;
31110@@ -702,7 +702,7 @@ static int xpad_led_probe(struct usb_xpa
31111 if (!led)
31112 return -ENOMEM;
31113
31114- led_no = (long)atomic_inc_return(&led_seq) - 1;
31115+ led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
31116
31117 snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
31118 led->xpad = xpad;
31119diff -urNp linux-2.6.39.1/drivers/input/mousedev.c linux-2.6.39.1/drivers/input/mousedev.c
31120--- linux-2.6.39.1/drivers/input/mousedev.c 2011-05-19 00:06:34.000000000 -0400
31121+++ linux-2.6.39.1/drivers/input/mousedev.c 2011-05-22 19:36:31.000000000 -0400
31122@@ -764,7 +764,7 @@ static ssize_t mousedev_read(struct file
31123
31124 spin_unlock_irq(&client->packet_lock);
31125
31126- if (copy_to_user(buffer, data, count))
31127+ if (count > sizeof(data) || copy_to_user(buffer, data, count))
31128 return -EFAULT;
31129
31130 return count;
31131diff -urNp linux-2.6.39.1/drivers/input/serio/serio.c linux-2.6.39.1/drivers/input/serio/serio.c
31132--- linux-2.6.39.1/drivers/input/serio/serio.c 2011-05-19 00:06:34.000000000 -0400
31133+++ linux-2.6.39.1/drivers/input/serio/serio.c 2011-05-22 19:36:31.000000000 -0400
31134@@ -497,7 +497,7 @@ static void serio_release_port(struct de
31135 */
31136 static void serio_init_port(struct serio *serio)
31137 {
31138- static atomic_t serio_no = ATOMIC_INIT(0);
31139+ static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
31140
31141 __module_get(THIS_MODULE);
31142
31143@@ -508,7 +508,7 @@ static void serio_init_port(struct serio
31144 mutex_init(&serio->drv_mutex);
31145 device_initialize(&serio->dev);
31146 dev_set_name(&serio->dev, "serio%ld",
31147- (long)atomic_inc_return(&serio_no) - 1);
31148+ (long)atomic_inc_return_unchecked(&serio_no) - 1);
31149 serio->dev.bus = &serio_bus;
31150 serio->dev.release = serio_release_port;
31151 serio->dev.groups = serio_device_attr_groups;
31152diff -urNp linux-2.6.39.1/drivers/isdn/capi/capi.c linux-2.6.39.1/drivers/isdn/capi/capi.c
31153--- linux-2.6.39.1/drivers/isdn/capi/capi.c 2011-05-19 00:06:34.000000000 -0400
31154+++ linux-2.6.39.1/drivers/isdn/capi/capi.c 2011-05-22 19:36:31.000000000 -0400
31155@@ -89,8 +89,8 @@ struct capiminor {
31156
31157 struct capi20_appl *ap;
31158 u32 ncci;
31159- atomic_t datahandle;
31160- atomic_t msgid;
31161+ atomic_unchecked_t datahandle;
31162+ atomic_unchecked_t msgid;
31163
31164 struct tty_port port;
31165 int ttyinstop;
31166@@ -414,7 +414,7 @@ gen_data_b3_resp_for(struct capiminor *m
31167 capimsg_setu16(s, 2, mp->ap->applid);
31168 capimsg_setu8 (s, 4, CAPI_DATA_B3);
31169 capimsg_setu8 (s, 5, CAPI_RESP);
31170- capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid));
31171+ capimsg_setu16(s, 6, atomic_inc_return_unchecked(&mp->msgid));
31172 capimsg_setu32(s, 8, mp->ncci);
31173 capimsg_setu16(s, 12, datahandle);
31174 }
31175@@ -547,14 +547,14 @@ static void handle_minor_send(struct cap
31176 mp->outbytes -= len;
31177 spin_unlock_bh(&mp->outlock);
31178
31179- datahandle = atomic_inc_return(&mp->datahandle);
31180+ datahandle = atomic_inc_return_unchecked(&mp->datahandle);
31181 skb_push(skb, CAPI_DATA_B3_REQ_LEN);
31182 memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
31183 capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
31184 capimsg_setu16(skb->data, 2, mp->ap->applid);
31185 capimsg_setu8 (skb->data, 4, CAPI_DATA_B3);
31186 capimsg_setu8 (skb->data, 5, CAPI_REQ);
31187- capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid));
31188+ capimsg_setu16(skb->data, 6, atomic_inc_return_unchecked(&mp->msgid));
31189 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */
31190 capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
31191 capimsg_setu16(skb->data, 16, len); /* Data length */
31192diff -urNp linux-2.6.39.1/drivers/isdn/gigaset/common.c linux-2.6.39.1/drivers/isdn/gigaset/common.c
31193--- linux-2.6.39.1/drivers/isdn/gigaset/common.c 2011-05-19 00:06:34.000000000 -0400
31194+++ linux-2.6.39.1/drivers/isdn/gigaset/common.c 2011-05-22 19:36:31.000000000 -0400
31195@@ -723,7 +723,7 @@ struct cardstate *gigaset_initcs(struct
31196 cs->commands_pending = 0;
31197 cs->cur_at_seq = 0;
31198 cs->gotfwver = -1;
31199- cs->open_count = 0;
31200+ local_set(&cs->open_count, 0);
31201 cs->dev = NULL;
31202 cs->tty = NULL;
31203 cs->tty_dev = NULL;
31204diff -urNp linux-2.6.39.1/drivers/isdn/gigaset/gigaset.h linux-2.6.39.1/drivers/isdn/gigaset/gigaset.h
31205--- linux-2.6.39.1/drivers/isdn/gigaset/gigaset.h 2011-05-19 00:06:34.000000000 -0400
31206+++ linux-2.6.39.1/drivers/isdn/gigaset/gigaset.h 2011-05-22 19:36:31.000000000 -0400
31207@@ -35,6 +35,7 @@
31208 #include <linux/tty_driver.h>
31209 #include <linux/list.h>
31210 #include <asm/atomic.h>
31211+#include <asm/local.h>
31212
31213 #define GIG_VERSION {0, 5, 0, 0}
31214 #define GIG_COMPAT {0, 4, 0, 0}
31215@@ -433,7 +434,7 @@ struct cardstate {
31216 spinlock_t cmdlock;
31217 unsigned curlen, cmdbytes;
31218
31219- unsigned open_count;
31220+ local_t open_count;
31221 struct tty_struct *tty;
31222 struct tasklet_struct if_wake_tasklet;
31223 unsigned control_state;
31224diff -urNp linux-2.6.39.1/drivers/isdn/gigaset/interface.c linux-2.6.39.1/drivers/isdn/gigaset/interface.c
31225--- linux-2.6.39.1/drivers/isdn/gigaset/interface.c 2011-05-19 00:06:34.000000000 -0400
31226+++ linux-2.6.39.1/drivers/isdn/gigaset/interface.c 2011-05-22 19:36:31.000000000 -0400
31227@@ -160,9 +160,7 @@ static int if_open(struct tty_struct *tt
31228 return -ERESTARTSYS;
31229 tty->driver_data = cs;
31230
31231- ++cs->open_count;
31232-
31233- if (cs->open_count == 1) {
31234+ if (local_inc_return(&cs->open_count) == 1) {
31235 spin_lock_irqsave(&cs->lock, flags);
31236 cs->tty = tty;
31237 spin_unlock_irqrestore(&cs->lock, flags);
31238@@ -190,10 +188,10 @@ static void if_close(struct tty_struct *
31239
31240 if (!cs->connected)
31241 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31242- else if (!cs->open_count)
31243+ else if (!local_read(&cs->open_count))
31244 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31245 else {
31246- if (!--cs->open_count) {
31247+ if (!local_dec_return(&cs->open_count)) {
31248 spin_lock_irqsave(&cs->lock, flags);
31249 cs->tty = NULL;
31250 spin_unlock_irqrestore(&cs->lock, flags);
31251@@ -228,7 +226,7 @@ static int if_ioctl(struct tty_struct *t
31252 if (!cs->connected) {
31253 gig_dbg(DEBUG_IF, "not connected");
31254 retval = -ENODEV;
31255- } else if (!cs->open_count)
31256+ } else if (!local_read(&cs->open_count))
31257 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31258 else {
31259 retval = 0;
31260@@ -358,7 +356,7 @@ static int if_write(struct tty_struct *t
31261 retval = -ENODEV;
31262 goto done;
31263 }
31264- if (!cs->open_count) {
31265+ if (!local_read(&cs->open_count)) {
31266 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31267 retval = -ENODEV;
31268 goto done;
31269@@ -411,7 +409,7 @@ static int if_write_room(struct tty_stru
31270 if (!cs->connected) {
31271 gig_dbg(DEBUG_IF, "not connected");
31272 retval = -ENODEV;
31273- } else if (!cs->open_count)
31274+ } else if (!local_read(&cs->open_count))
31275 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31276 else if (cs->mstate != MS_LOCKED) {
31277 dev_warn(cs->dev, "can't write to unlocked device\n");
31278@@ -441,7 +439,7 @@ static int if_chars_in_buffer(struct tty
31279
31280 if (!cs->connected)
31281 gig_dbg(DEBUG_IF, "not connected");
31282- else if (!cs->open_count)
31283+ else if (!local_read(&cs->open_count))
31284 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31285 else if (cs->mstate != MS_LOCKED)
31286 dev_warn(cs->dev, "can't write to unlocked device\n");
31287@@ -469,7 +467,7 @@ static void if_throttle(struct tty_struc
31288
31289 if (!cs->connected)
31290 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31291- else if (!cs->open_count)
31292+ else if (!local_read(&cs->open_count))
31293 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31294 else
31295 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
31296@@ -493,7 +491,7 @@ static void if_unthrottle(struct tty_str
31297
31298 if (!cs->connected)
31299 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31300- else if (!cs->open_count)
31301+ else if (!local_read(&cs->open_count))
31302 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31303 else
31304 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
31305@@ -524,7 +522,7 @@ static void if_set_termios(struct tty_st
31306 goto out;
31307 }
31308
31309- if (!cs->open_count) {
31310+ if (!local_read(&cs->open_count)) {
31311 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31312 goto out;
31313 }
31314diff -urNp linux-2.6.39.1/drivers/isdn/hardware/avm/b1.c linux-2.6.39.1/drivers/isdn/hardware/avm/b1.c
31315--- linux-2.6.39.1/drivers/isdn/hardware/avm/b1.c 2011-05-19 00:06:34.000000000 -0400
31316+++ linux-2.6.39.1/drivers/isdn/hardware/avm/b1.c 2011-05-22 19:36:31.000000000 -0400
31317@@ -176,7 +176,7 @@ int b1_load_t4file(avmcard *card, capilo
31318 }
31319 if (left) {
31320 if (t4file->user) {
31321- if (copy_from_user(buf, dp, left))
31322+ if (left > sizeof buf || copy_from_user(buf, dp, left))
31323 return -EFAULT;
31324 } else {
31325 memcpy(buf, dp, left);
31326@@ -224,7 +224,7 @@ int b1_load_config(avmcard *card, capilo
31327 }
31328 if (left) {
31329 if (config->user) {
31330- if (copy_from_user(buf, dp, left))
31331+ if (left > sizeof buf || copy_from_user(buf, dp, left))
31332 return -EFAULT;
31333 } else {
31334 memcpy(buf, dp, left);
31335diff -urNp linux-2.6.39.1/drivers/isdn/hardware/eicon/capidtmf.c linux-2.6.39.1/drivers/isdn/hardware/eicon/capidtmf.c
31336--- linux-2.6.39.1/drivers/isdn/hardware/eicon/capidtmf.c 2011-05-19 00:06:34.000000000 -0400
31337+++ linux-2.6.39.1/drivers/isdn/hardware/eicon/capidtmf.c 2011-05-22 19:36:31.000000000 -0400
31338@@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_sta
31339 byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
31340 short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
31341
31342+ pax_track_stack();
31343
31344 if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
31345 {
31346diff -urNp linux-2.6.39.1/drivers/isdn/hardware/eicon/capifunc.c linux-2.6.39.1/drivers/isdn/hardware/eicon/capifunc.c
31347--- linux-2.6.39.1/drivers/isdn/hardware/eicon/capifunc.c 2011-05-19 00:06:34.000000000 -0400
31348+++ linux-2.6.39.1/drivers/isdn/hardware/eicon/capifunc.c 2011-05-22 19:36:31.000000000 -0400
31349@@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
31350 IDI_SYNC_REQ req;
31351 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31352
31353+ pax_track_stack();
31354+
31355 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31356
31357 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31358diff -urNp linux-2.6.39.1/drivers/isdn/hardware/eicon/diddfunc.c linux-2.6.39.1/drivers/isdn/hardware/eicon/diddfunc.c
31359--- linux-2.6.39.1/drivers/isdn/hardware/eicon/diddfunc.c 2011-05-19 00:06:34.000000000 -0400
31360+++ linux-2.6.39.1/drivers/isdn/hardware/eicon/diddfunc.c 2011-05-22 19:36:31.000000000 -0400
31361@@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_di
31362 IDI_SYNC_REQ req;
31363 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31364
31365+ pax_track_stack();
31366+
31367 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31368
31369 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31370diff -urNp linux-2.6.39.1/drivers/isdn/hardware/eicon/divasfunc.c linux-2.6.39.1/drivers/isdn/hardware/eicon/divasfunc.c
31371--- linux-2.6.39.1/drivers/isdn/hardware/eicon/divasfunc.c 2011-05-19 00:06:34.000000000 -0400
31372+++ linux-2.6.39.1/drivers/isdn/hardware/eicon/divasfunc.c 2011-05-22 19:36:31.000000000 -0400
31373@@ -161,6 +161,8 @@ static int DIVA_INIT_FUNCTION connect_di
31374 IDI_SYNC_REQ req;
31375 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31376
31377+ pax_track_stack();
31378+
31379 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31380
31381 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31382diff -urNp linux-2.6.39.1/drivers/isdn/hardware/eicon/idifunc.c linux-2.6.39.1/drivers/isdn/hardware/eicon/idifunc.c
31383--- linux-2.6.39.1/drivers/isdn/hardware/eicon/idifunc.c 2011-05-19 00:06:34.000000000 -0400
31384+++ linux-2.6.39.1/drivers/isdn/hardware/eicon/idifunc.c 2011-05-22 19:36:31.000000000 -0400
31385@@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_di
31386 IDI_SYNC_REQ req;
31387 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31388
31389+ pax_track_stack();
31390+
31391 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31392
31393 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31394diff -urNp linux-2.6.39.1/drivers/isdn/hardware/eicon/message.c linux-2.6.39.1/drivers/isdn/hardware/eicon/message.c
31395--- linux-2.6.39.1/drivers/isdn/hardware/eicon/message.c 2011-05-19 00:06:34.000000000 -0400
31396+++ linux-2.6.39.1/drivers/isdn/hardware/eicon/message.c 2011-05-22 19:36:31.000000000 -0400
31397@@ -4889,6 +4889,8 @@ static void sig_ind(PLCI *plci)
31398 dword d;
31399 word w;
31400
31401+ pax_track_stack();
31402+
31403 a = plci->adapter;
31404 Id = ((word)plci->Id<<8)|a->Id;
31405 PUT_WORD(&SS_Ind[4],0x0000);
31406@@ -7484,6 +7486,8 @@ static word add_b1(PLCI *plci, API_PARSE
31407 word j, n, w;
31408 dword d;
31409
31410+ pax_track_stack();
31411+
31412
31413 for(i=0;i<8;i++) bp_parms[i].length = 0;
31414 for(i=0;i<2;i++) global_config[i].length = 0;
31415@@ -7958,6 +7962,8 @@ static word add_b23(PLCI *plci, API_PARS
31416 const byte llc3[] = {4,3,2,2,6,6,0};
31417 const byte header[] = {0,2,3,3,0,0,0};
31418
31419+ pax_track_stack();
31420+
31421 for(i=0;i<8;i++) bp_parms[i].length = 0;
31422 for(i=0;i<6;i++) b2_config_parms[i].length = 0;
31423 for(i=0;i<5;i++) b3_config_parms[i].length = 0;
31424@@ -14760,6 +14766,8 @@ static void group_optimization(DIVA_CAPI
31425 word appl_number_group_type[MAX_APPL];
31426 PLCI *auxplci;
31427
31428+ pax_track_stack();
31429+
31430 set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
31431
31432 if(!a->group_optimization_enabled)
31433diff -urNp linux-2.6.39.1/drivers/isdn/hardware/eicon/mntfunc.c linux-2.6.39.1/drivers/isdn/hardware/eicon/mntfunc.c
31434--- linux-2.6.39.1/drivers/isdn/hardware/eicon/mntfunc.c 2011-05-19 00:06:34.000000000 -0400
31435+++ linux-2.6.39.1/drivers/isdn/hardware/eicon/mntfunc.c 2011-05-22 19:36:31.000000000 -0400
31436@@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_di
31437 IDI_SYNC_REQ req;
31438 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31439
31440+ pax_track_stack();
31441+
31442 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31443
31444 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31445diff -urNp linux-2.6.39.1/drivers/isdn/i4l/isdn_common.c linux-2.6.39.1/drivers/isdn/i4l/isdn_common.c
31446--- linux-2.6.39.1/drivers/isdn/i4l/isdn_common.c 2011-05-19 00:06:34.000000000 -0400
31447+++ linux-2.6.39.1/drivers/isdn/i4l/isdn_common.c 2011-05-22 19:36:31.000000000 -0400
31448@@ -1292,6 +1292,8 @@ isdn_ioctl(struct file *file, uint cmd,
31449 } iocpar;
31450 void __user *argp = (void __user *)arg;
31451
31452+ pax_track_stack();
31453+
31454 #define name iocpar.name
31455 #define bname iocpar.bname
31456 #define iocts iocpar.iocts
31457diff -urNp linux-2.6.39.1/drivers/isdn/i4l/isdn_net.c linux-2.6.39.1/drivers/isdn/i4l/isdn_net.c
31458--- linux-2.6.39.1/drivers/isdn/i4l/isdn_net.c 2011-05-19 00:06:34.000000000 -0400
31459+++ linux-2.6.39.1/drivers/isdn/i4l/isdn_net.c 2011-05-22 19:36:31.000000000 -0400
31460@@ -400,7 +400,7 @@ isdn_net_stat_callback(int idx, isdn_ctr
31461 isdn_net_local *lp = p->local;
31462 #ifdef CONFIG_ISDN_X25
31463 struct concap_proto *cprot = lp->netdev->cprot;
31464- struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31465+ const struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31466 #endif
31467 switch (cmd) {
31468 case ISDN_STAT_BSENT:
31469@@ -831,7 +831,7 @@ isdn_net_hangup(struct net_device *d)
31470 isdn_ctrl cmd;
31471 #ifdef CONFIG_ISDN_X25
31472 struct concap_proto *cprot = lp->netdev->cprot;
31473- struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31474+ const struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31475 #endif
31476
31477 if (lp->flags & ISDN_NET_CONNECTED) {
31478diff -urNp linux-2.6.39.1/drivers/isdn/i4l/isdn_x25iface.c linux-2.6.39.1/drivers/isdn/i4l/isdn_x25iface.c
31479--- linux-2.6.39.1/drivers/isdn/i4l/isdn_x25iface.c 2011-05-19 00:06:34.000000000 -0400
31480+++ linux-2.6.39.1/drivers/isdn/i4l/isdn_x25iface.c 2011-05-22 19:36:31.000000000 -0400
31481@@ -52,7 +52,7 @@ static int isdn_x25iface_connect_ind( st
31482 static int isdn_x25iface_disconn_ind( struct concap_proto * );
31483
31484
31485-static struct concap_proto_ops ix25_pops = {
31486+static const struct concap_proto_ops ix25_pops = {
31487 &isdn_x25iface_proto_new,
31488 &isdn_x25iface_proto_del,
31489 &isdn_x25iface_proto_restart,
31490diff -urNp linux-2.6.39.1/drivers/isdn/i4l/isdn_x25iface.h linux-2.6.39.1/drivers/isdn/i4l/isdn_x25iface.h
31491--- linux-2.6.39.1/drivers/isdn/i4l/isdn_x25iface.h 2011-05-19 00:06:34.000000000 -0400
31492+++ linux-2.6.39.1/drivers/isdn/i4l/isdn_x25iface.h 2011-05-22 19:36:31.000000000 -0400
31493@@ -23,7 +23,7 @@
31494 #include <linux/isdn.h>
31495 #include <linux/concap.h>
31496
31497-extern struct concap_proto_ops * isdn_x25iface_concap_proto_ops_pt;
31498+extern const struct concap_proto_ops *isdn_x25iface_concap_proto_ops_pt;
31499 extern struct concap_proto * isdn_x25iface_proto_new(void);
31500
31501
31502diff -urNp linux-2.6.39.1/drivers/isdn/icn/icn.c linux-2.6.39.1/drivers/isdn/icn/icn.c
31503--- linux-2.6.39.1/drivers/isdn/icn/icn.c 2011-05-19 00:06:34.000000000 -0400
31504+++ linux-2.6.39.1/drivers/isdn/icn/icn.c 2011-05-22 19:36:31.000000000 -0400
31505@@ -1045,7 +1045,7 @@ icn_writecmd(const u_char * buf, int len
31506 if (count > len)
31507 count = len;
31508 if (user) {
31509- if (copy_from_user(msg, buf, count))
31510+ if (count > sizeof msg || copy_from_user(msg, buf, count))
31511 return -EFAULT;
31512 } else
31513 memcpy(msg, buf, count);
31514diff -urNp linux-2.6.39.1/drivers/lguest/core.c linux-2.6.39.1/drivers/lguest/core.c
31515--- linux-2.6.39.1/drivers/lguest/core.c 2011-05-19 00:06:34.000000000 -0400
31516+++ linux-2.6.39.1/drivers/lguest/core.c 2011-05-22 19:36:31.000000000 -0400
31517@@ -92,9 +92,17 @@ static __init int map_switcher(void)
31518 * it's worked so far. The end address needs +1 because __get_vm_area
31519 * allocates an extra guard page, so we need space for that.
31520 */
31521+
31522+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
31523+ switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31524+ VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
31525+ + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31526+#else
31527 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31528 VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
31529 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31530+#endif
31531+
31532 if (!switcher_vma) {
31533 err = -ENOMEM;
31534 printk("lguest: could not map switcher pages high\n");
31535@@ -119,7 +127,7 @@ static __init int map_switcher(void)
31536 * Now the Switcher is mapped at the right address, we can't fail!
31537 * Copy in the compiled-in Switcher code (from <arch>_switcher.S).
31538 */
31539- memcpy(switcher_vma->addr, start_switcher_text,
31540+ memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
31541 end_switcher_text - start_switcher_text);
31542
31543 printk(KERN_INFO "lguest: mapped switcher at %p\n",
31544diff -urNp linux-2.6.39.1/drivers/lguest/lguest_device.c linux-2.6.39.1/drivers/lguest/lguest_device.c
31545--- linux-2.6.39.1/drivers/lguest/lguest_device.c 2011-05-19 00:06:34.000000000 -0400
31546+++ linux-2.6.39.1/drivers/lguest/lguest_device.c 2011-05-22 19:36:31.000000000 -0400
31547@@ -374,7 +374,7 @@ error:
31548 }
31549
31550 /* The ops structure which hooks everything together. */
31551-static struct virtio_config_ops lguest_config_ops = {
31552+static const struct virtio_config_ops lguest_config_ops = {
31553 .get_features = lg_get_features,
31554 .finalize_features = lg_finalize_features,
31555 .get = lg_get,
31556diff -urNp linux-2.6.39.1/drivers/lguest/x86/core.c linux-2.6.39.1/drivers/lguest/x86/core.c
31557--- linux-2.6.39.1/drivers/lguest/x86/core.c 2011-05-19 00:06:34.000000000 -0400
31558+++ linux-2.6.39.1/drivers/lguest/x86/core.c 2011-05-22 19:36:31.000000000 -0400
31559@@ -59,7 +59,7 @@ static struct {
31560 /* Offset from where switcher.S was compiled to where we've copied it */
31561 static unsigned long switcher_offset(void)
31562 {
31563- return SWITCHER_ADDR - (unsigned long)start_switcher_text;
31564+ return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
31565 }
31566
31567 /* This cpu's struct lguest_pages. */
31568@@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg
31569 * These copies are pretty cheap, so we do them unconditionally: */
31570 /* Save the current Host top-level page directory.
31571 */
31572+
31573+#ifdef CONFIG_PAX_PER_CPU_PGD
31574+ pages->state.host_cr3 = read_cr3();
31575+#else
31576 pages->state.host_cr3 = __pa(current->mm->pgd);
31577+#endif
31578+
31579 /*
31580 * Set up the Guest's page tables to see this CPU's pages (and no
31581 * other CPU's pages).
31582@@ -547,7 +553,7 @@ void __init lguest_arch_host_init(void)
31583 * compiled-in switcher code and the high-mapped copy we just made.
31584 */
31585 for (i = 0; i < IDT_ENTRIES; i++)
31586- default_idt_entries[i] += switcher_offset();
31587+ default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
31588
31589 /*
31590 * Set up the Switcher's per-cpu areas.
31591@@ -630,7 +636,7 @@ void __init lguest_arch_host_init(void)
31592 * it will be undisturbed when we switch. To change %cs and jump we
31593 * need this structure to feed to Intel's "lcall" instruction.
31594 */
31595- lguest_entry.offset = (long)switch_to_guest + switcher_offset();
31596+ lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
31597 lguest_entry.segment = LGUEST_CS;
31598
31599 /*
31600diff -urNp linux-2.6.39.1/drivers/lguest/x86/switcher_32.S linux-2.6.39.1/drivers/lguest/x86/switcher_32.S
31601--- linux-2.6.39.1/drivers/lguest/x86/switcher_32.S 2011-05-19 00:06:34.000000000 -0400
31602+++ linux-2.6.39.1/drivers/lguest/x86/switcher_32.S 2011-05-22 19:36:31.000000000 -0400
31603@@ -87,6 +87,7 @@
31604 #include <asm/page.h>
31605 #include <asm/segment.h>
31606 #include <asm/lguest.h>
31607+#include <asm/processor-flags.h>
31608
31609 // We mark the start of the code to copy
31610 // It's placed in .text tho it's never run here
31611@@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
31612 // Changes type when we load it: damn Intel!
31613 // For after we switch over our page tables
31614 // That entry will be read-only: we'd crash.
31615+
31616+#ifdef CONFIG_PAX_KERNEXEC
31617+ mov %cr0, %edx
31618+ xor $X86_CR0_WP, %edx
31619+ mov %edx, %cr0
31620+#endif
31621+
31622 movl $(GDT_ENTRY_TSS*8), %edx
31623 ltr %dx
31624
31625@@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
31626 // Let's clear it again for our return.
31627 // The GDT descriptor of the Host
31628 // Points to the table after two "size" bytes
31629- movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
31630+ movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
31631 // Clear "used" from type field (byte 5, bit 2)
31632- andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
31633+ andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
31634+
31635+#ifdef CONFIG_PAX_KERNEXEC
31636+ mov %cr0, %eax
31637+ xor $X86_CR0_WP, %eax
31638+ mov %eax, %cr0
31639+#endif
31640
31641 // Once our page table's switched, the Guest is live!
31642 // The Host fades as we run this final step.
31643@@ -295,13 +309,12 @@ deliver_to_host:
31644 // I consulted gcc, and it gave
31645 // These instructions, which I gladly credit:
31646 leal (%edx,%ebx,8), %eax
31647- movzwl (%eax),%edx
31648- movl 4(%eax), %eax
31649- xorw %ax, %ax
31650- orl %eax, %edx
31651+ movl 4(%eax), %edx
31652+ movw (%eax), %dx
31653 // Now the address of the handler's in %edx
31654 // We call it now: its "iret" drops us home.
31655- jmp *%edx
31656+ ljmp $__KERNEL_CS, $1f
31657+1: jmp *%edx
31658
31659 // Every interrupt can come to us here
31660 // But we must truly tell each apart.
31661diff -urNp linux-2.6.39.1/drivers/md/dm.c linux-2.6.39.1/drivers/md/dm.c
31662--- linux-2.6.39.1/drivers/md/dm.c 2011-05-19 00:06:34.000000000 -0400
31663+++ linux-2.6.39.1/drivers/md/dm.c 2011-05-22 19:36:31.000000000 -0400
31664@@ -162,9 +162,9 @@ struct mapped_device {
31665 /*
31666 * Event handling.
31667 */
31668- atomic_t event_nr;
31669+ atomic_unchecked_t event_nr;
31670 wait_queue_head_t eventq;
31671- atomic_t uevent_seq;
31672+ atomic_unchecked_t uevent_seq;
31673 struct list_head uevent_list;
31674 spinlock_t uevent_lock; /* Protect access to uevent_list */
31675
31676@@ -1836,8 +1836,8 @@ static struct mapped_device *alloc_dev(i
31677 rwlock_init(&md->map_lock);
31678 atomic_set(&md->holders, 1);
31679 atomic_set(&md->open_count, 0);
31680- atomic_set(&md->event_nr, 0);
31681- atomic_set(&md->uevent_seq, 0);
31682+ atomic_set_unchecked(&md->event_nr, 0);
31683+ atomic_set_unchecked(&md->uevent_seq, 0);
31684 INIT_LIST_HEAD(&md->uevent_list);
31685 spin_lock_init(&md->uevent_lock);
31686
31687@@ -1971,7 +1971,7 @@ static void event_callback(void *context
31688
31689 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
31690
31691- atomic_inc(&md->event_nr);
31692+ atomic_inc_unchecked(&md->event_nr);
31693 wake_up(&md->eventq);
31694 }
31695
31696@@ -2547,18 +2547,18 @@ int dm_kobject_uevent(struct mapped_devi
31697
31698 uint32_t dm_next_uevent_seq(struct mapped_device *md)
31699 {
31700- return atomic_add_return(1, &md->uevent_seq);
31701+ return atomic_add_return_unchecked(1, &md->uevent_seq);
31702 }
31703
31704 uint32_t dm_get_event_nr(struct mapped_device *md)
31705 {
31706- return atomic_read(&md->event_nr);
31707+ return atomic_read_unchecked(&md->event_nr);
31708 }
31709
31710 int dm_wait_event(struct mapped_device *md, int event_nr)
31711 {
31712 return wait_event_interruptible(md->eventq,
31713- (event_nr != atomic_read(&md->event_nr)));
31714+ (event_nr != atomic_read_unchecked(&md->event_nr)));
31715 }
31716
31717 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
31718diff -urNp linux-2.6.39.1/drivers/md/dm-crypt.c linux-2.6.39.1/drivers/md/dm-crypt.c
31719--- linux-2.6.39.1/drivers/md/dm-crypt.c 2011-05-19 00:06:34.000000000 -0400
31720+++ linux-2.6.39.1/drivers/md/dm-crypt.c 2011-05-22 19:36:31.000000000 -0400
31721@@ -138,7 +138,7 @@ struct crypt_config {
31722 char *cipher;
31723 char *cipher_string;
31724
31725- struct crypt_iv_operations *iv_gen_ops;
31726+ const struct crypt_iv_operations *iv_gen_ops;
31727 union {
31728 struct iv_essiv_private essiv;
31729 struct iv_benbi_private benbi;
31730@@ -620,15 +620,15 @@ static int crypt_iv_lmk_post(struct cryp
31731 return r;
31732 }
31733
31734-static struct crypt_iv_operations crypt_iv_plain_ops = {
31735+static const struct crypt_iv_operations crypt_iv_plain_ops = {
31736 .generator = crypt_iv_plain_gen
31737 };
31738
31739-static struct crypt_iv_operations crypt_iv_plain64_ops = {
31740+static const struct crypt_iv_operations crypt_iv_plain64_ops = {
31741 .generator = crypt_iv_plain64_gen
31742 };
31743
31744-static struct crypt_iv_operations crypt_iv_essiv_ops = {
31745+static const struct crypt_iv_operations crypt_iv_essiv_ops = {
31746 .ctr = crypt_iv_essiv_ctr,
31747 .dtr = crypt_iv_essiv_dtr,
31748 .init = crypt_iv_essiv_init,
31749@@ -636,17 +636,17 @@ static struct crypt_iv_operations crypt_
31750 .generator = crypt_iv_essiv_gen
31751 };
31752
31753-static struct crypt_iv_operations crypt_iv_benbi_ops = {
31754+static const struct crypt_iv_operations crypt_iv_benbi_ops = {
31755 .ctr = crypt_iv_benbi_ctr,
31756 .dtr = crypt_iv_benbi_dtr,
31757 .generator = crypt_iv_benbi_gen
31758 };
31759
31760-static struct crypt_iv_operations crypt_iv_null_ops = {
31761+static const struct crypt_iv_operations crypt_iv_null_ops = {
31762 .generator = crypt_iv_null_gen
31763 };
31764
31765-static struct crypt_iv_operations crypt_iv_lmk_ops = {
31766+static const struct crypt_iv_operations crypt_iv_lmk_ops = {
31767 .ctr = crypt_iv_lmk_ctr,
31768 .dtr = crypt_iv_lmk_dtr,
31769 .init = crypt_iv_lmk_init,
31770diff -urNp linux-2.6.39.1/drivers/md/dm-ioctl.c linux-2.6.39.1/drivers/md/dm-ioctl.c
31771--- linux-2.6.39.1/drivers/md/dm-ioctl.c 2011-05-19 00:06:34.000000000 -0400
31772+++ linux-2.6.39.1/drivers/md/dm-ioctl.c 2011-05-22 19:36:31.000000000 -0400
31773@@ -1551,7 +1551,7 @@ static int validate_params(uint cmd, str
31774 cmd == DM_LIST_VERSIONS_CMD)
31775 return 0;
31776
31777- if ((cmd == DM_DEV_CREATE_CMD)) {
31778+ if (cmd == DM_DEV_CREATE_CMD) {
31779 if (!*param->name) {
31780 DMWARN("name not supplied when creating device");
31781 return -EINVAL;
31782diff -urNp linux-2.6.39.1/drivers/md/dm-raid1.c linux-2.6.39.1/drivers/md/dm-raid1.c
31783--- linux-2.6.39.1/drivers/md/dm-raid1.c 2011-05-19 00:06:34.000000000 -0400
31784+++ linux-2.6.39.1/drivers/md/dm-raid1.c 2011-05-22 19:36:31.000000000 -0400
31785@@ -42,7 +42,7 @@ enum dm_raid1_error {
31786
31787 struct mirror {
31788 struct mirror_set *ms;
31789- atomic_t error_count;
31790+ atomic_unchecked_t error_count;
31791 unsigned long error_type;
31792 struct dm_dev *dev;
31793 sector_t offset;
31794@@ -187,7 +187,7 @@ static struct mirror *get_valid_mirror(s
31795 struct mirror *m;
31796
31797 for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
31798- if (!atomic_read(&m->error_count))
31799+ if (!atomic_read_unchecked(&m->error_count))
31800 return m;
31801
31802 return NULL;
31803@@ -219,7 +219,7 @@ static void fail_mirror(struct mirror *m
31804 * simple way to tell if a device has encountered
31805 * errors.
31806 */
31807- atomic_inc(&m->error_count);
31808+ atomic_inc_unchecked(&m->error_count);
31809
31810 if (test_and_set_bit(error_type, &m->error_type))
31811 return;
31812@@ -410,7 +410,7 @@ static struct mirror *choose_mirror(stru
31813 struct mirror *m = get_default_mirror(ms);
31814
31815 do {
31816- if (likely(!atomic_read(&m->error_count)))
31817+ if (likely(!atomic_read_unchecked(&m->error_count)))
31818 return m;
31819
31820 if (m-- == ms->mirror)
31821@@ -424,7 +424,7 @@ static int default_ok(struct mirror *m)
31822 {
31823 struct mirror *default_mirror = get_default_mirror(m->ms);
31824
31825- return !atomic_read(&default_mirror->error_count);
31826+ return !atomic_read_unchecked(&default_mirror->error_count);
31827 }
31828
31829 static int mirror_available(struct mirror_set *ms, struct bio *bio)
31830@@ -561,7 +561,7 @@ static void do_reads(struct mirror_set *
31831 */
31832 if (likely(region_in_sync(ms, region, 1)))
31833 m = choose_mirror(ms, bio->bi_sector);
31834- else if (m && atomic_read(&m->error_count))
31835+ else if (m && atomic_read_unchecked(&m->error_count))
31836 m = NULL;
31837
31838 if (likely(m))
31839@@ -939,7 +939,7 @@ static int get_mirror(struct mirror_set
31840 }
31841
31842 ms->mirror[mirror].ms = ms;
31843- atomic_set(&(ms->mirror[mirror].error_count), 0);
31844+ atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
31845 ms->mirror[mirror].error_type = 0;
31846 ms->mirror[mirror].offset = offset;
31847
31848@@ -1347,7 +1347,7 @@ static void mirror_resume(struct dm_targ
31849 */
31850 static char device_status_char(struct mirror *m)
31851 {
31852- if (!atomic_read(&(m->error_count)))
31853+ if (!atomic_read_unchecked(&(m->error_count)))
31854 return 'A';
31855
31856 return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
31857diff -urNp linux-2.6.39.1/drivers/md/dm-stripe.c linux-2.6.39.1/drivers/md/dm-stripe.c
31858--- linux-2.6.39.1/drivers/md/dm-stripe.c 2011-05-19 00:06:34.000000000 -0400
31859+++ linux-2.6.39.1/drivers/md/dm-stripe.c 2011-05-22 19:36:31.000000000 -0400
31860@@ -20,7 +20,7 @@ struct stripe {
31861 struct dm_dev *dev;
31862 sector_t physical_start;
31863
31864- atomic_t error_count;
31865+ atomic_unchecked_t error_count;
31866 };
31867
31868 struct stripe_c {
31869@@ -192,7 +192,7 @@ static int stripe_ctr(struct dm_target *
31870 kfree(sc);
31871 return r;
31872 }
31873- atomic_set(&(sc->stripe[i].error_count), 0);
31874+ atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
31875 }
31876
31877 ti->private = sc;
31878@@ -314,7 +314,7 @@ static int stripe_status(struct dm_targe
31879 DMEMIT("%d ", sc->stripes);
31880 for (i = 0; i < sc->stripes; i++) {
31881 DMEMIT("%s ", sc->stripe[i].dev->name);
31882- buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
31883+ buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
31884 'D' : 'A';
31885 }
31886 buffer[i] = '\0';
31887@@ -361,8 +361,8 @@ static int stripe_end_io(struct dm_targe
31888 */
31889 for (i = 0; i < sc->stripes; i++)
31890 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
31891- atomic_inc(&(sc->stripe[i].error_count));
31892- if (atomic_read(&(sc->stripe[i].error_count)) <
31893+ atomic_inc_unchecked(&(sc->stripe[i].error_count));
31894+ if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
31895 DM_IO_ERROR_THRESHOLD)
31896 schedule_work(&sc->trigger_event);
31897 }
31898diff -urNp linux-2.6.39.1/drivers/md/dm-table.c linux-2.6.39.1/drivers/md/dm-table.c
31899--- linux-2.6.39.1/drivers/md/dm-table.c 2011-06-03 00:04:14.000000000 -0400
31900+++ linux-2.6.39.1/drivers/md/dm-table.c 2011-06-03 00:32:05.000000000 -0400
31901@@ -390,7 +390,7 @@ static int device_area_is_invalid(struct
31902 if (!dev_size)
31903 return 0;
31904
31905- if ((start >= dev_size) || (start + len > dev_size)) {
31906+ if ((start >= dev_size) || (len > dev_size - start)) {
31907 DMWARN("%s: %s too small for target: "
31908 "start=%llu, len=%llu, dev_size=%llu",
31909 dm_device_name(ti->table->md), bdevname(bdev, b),
31910diff -urNp linux-2.6.39.1/drivers/md/md.c linux-2.6.39.1/drivers/md/md.c
31911--- linux-2.6.39.1/drivers/md/md.c 2011-06-03 00:04:14.000000000 -0400
31912+++ linux-2.6.39.1/drivers/md/md.c 2011-06-03 00:32:05.000000000 -0400
31913@@ -226,10 +226,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev);
31914 * start build, activate spare
31915 */
31916 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
31917-static atomic_t md_event_count;
31918+static atomic_unchecked_t md_event_count;
31919 void md_new_event(mddev_t *mddev)
31920 {
31921- atomic_inc(&md_event_count);
31922+ atomic_inc_unchecked(&md_event_count);
31923 wake_up(&md_event_waiters);
31924 }
31925 EXPORT_SYMBOL_GPL(md_new_event);
31926@@ -239,7 +239,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
31927 */
31928 static void md_new_event_inintr(mddev_t *mddev)
31929 {
31930- atomic_inc(&md_event_count);
31931+ atomic_inc_unchecked(&md_event_count);
31932 wake_up(&md_event_waiters);
31933 }
31934
31935@@ -1454,7 +1454,7 @@ static int super_1_load(mdk_rdev_t *rdev
31936
31937 rdev->preferred_minor = 0xffff;
31938 rdev->data_offset = le64_to_cpu(sb->data_offset);
31939- atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
31940+ atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
31941
31942 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
31943 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
31944@@ -1632,7 +1632,7 @@ static void super_1_sync(mddev_t *mddev,
31945 else
31946 sb->resync_offset = cpu_to_le64(0);
31947
31948- sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
31949+ sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
31950
31951 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
31952 sb->size = cpu_to_le64(mddev->dev_sectors);
31953@@ -2414,7 +2414,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_sho
31954 static ssize_t
31955 errors_show(mdk_rdev_t *rdev, char *page)
31956 {
31957- return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
31958+ return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
31959 }
31960
31961 static ssize_t
31962@@ -2423,7 +2423,7 @@ errors_store(mdk_rdev_t *rdev, const cha
31963 char *e;
31964 unsigned long n = simple_strtoul(buf, &e, 10);
31965 if (*buf && (*e == 0 || *e == '\n')) {
31966- atomic_set(&rdev->corrected_errors, n);
31967+ atomic_set_unchecked(&rdev->corrected_errors, n);
31968 return len;
31969 }
31970 return -EINVAL;
31971@@ -2779,8 +2779,8 @@ void md_rdev_init(mdk_rdev_t *rdev)
31972 rdev->last_read_error.tv_sec = 0;
31973 rdev->last_read_error.tv_nsec = 0;
31974 atomic_set(&rdev->nr_pending, 0);
31975- atomic_set(&rdev->read_errors, 0);
31976- atomic_set(&rdev->corrected_errors, 0);
31977+ atomic_set_unchecked(&rdev->read_errors, 0);
31978+ atomic_set_unchecked(&rdev->corrected_errors, 0);
31979
31980 INIT_LIST_HEAD(&rdev->same_set);
31981 init_waitqueue_head(&rdev->blocked_wait);
31982@@ -6388,7 +6388,7 @@ static int md_seq_show(struct seq_file *
31983
31984 spin_unlock(&pers_lock);
31985 seq_printf(seq, "\n");
31986- mi->event = atomic_read(&md_event_count);
31987+ mi->event = atomic_read_unchecked(&md_event_count);
31988 return 0;
31989 }
31990 if (v == (void*)2) {
31991@@ -6477,7 +6477,7 @@ static int md_seq_show(struct seq_file *
31992 chunk_kb ? "KB" : "B");
31993 if (bitmap->file) {
31994 seq_printf(seq, ", file: ");
31995- seq_path(seq, &bitmap->file->f_path, " \t\n");
31996+ seq_path(seq, &bitmap->file->f_path, " \t\n\\");
31997 }
31998
31999 seq_printf(seq, "\n");
32000@@ -6511,7 +6511,7 @@ static int md_seq_open(struct inode *ino
32001 else {
32002 struct seq_file *p = file->private_data;
32003 p->private = mi;
32004- mi->event = atomic_read(&md_event_count);
32005+ mi->event = atomic_read_unchecked(&md_event_count);
32006 }
32007 return error;
32008 }
32009@@ -6527,7 +6527,7 @@ static unsigned int mdstat_poll(struct f
32010 /* always allow read */
32011 mask = POLLIN | POLLRDNORM;
32012
32013- if (mi->event != atomic_read(&md_event_count))
32014+ if (mi->event != atomic_read_unchecked(&md_event_count))
32015 mask |= POLLERR | POLLPRI;
32016 return mask;
32017 }
32018@@ -6571,7 +6571,7 @@ static int is_mddev_idle(mddev_t *mddev,
32019 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
32020 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
32021 (int)part_stat_read(&disk->part0, sectors[1]) -
32022- atomic_read(&disk->sync_io);
32023+ atomic_read_unchecked(&disk->sync_io);
32024 /* sync IO will cause sync_io to increase before the disk_stats
32025 * as sync_io is counted when a request starts, and
32026 * disk_stats is counted when it completes.
32027diff -urNp linux-2.6.39.1/drivers/md/md.h linux-2.6.39.1/drivers/md/md.h
32028--- linux-2.6.39.1/drivers/md/md.h 2011-05-19 00:06:34.000000000 -0400
32029+++ linux-2.6.39.1/drivers/md/md.h 2011-05-22 19:36:31.000000000 -0400
32030@@ -97,13 +97,13 @@ struct mdk_rdev_s
32031 * only maintained for arrays that
32032 * support hot removal
32033 */
32034- atomic_t read_errors; /* number of consecutive read errors that
32035+ atomic_unchecked_t read_errors; /* number of consecutive read errors that
32036 * we have tried to ignore.
32037 */
32038 struct timespec last_read_error; /* monotonic time since our
32039 * last read error
32040 */
32041- atomic_t corrected_errors; /* number of corrected read errors,
32042+ atomic_unchecked_t corrected_errors; /* number of corrected read errors,
32043 * for reporting to userspace and storing
32044 * in superblock.
32045 */
32046@@ -342,7 +342,7 @@ static inline void rdev_dec_pending(mdk_
32047
32048 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
32049 {
32050- atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
32051+ atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
32052 }
32053
32054 struct mdk_personality
32055diff -urNp linux-2.6.39.1/drivers/md/raid10.c linux-2.6.39.1/drivers/md/raid10.c
32056--- linux-2.6.39.1/drivers/md/raid10.c 2011-05-19 00:06:34.000000000 -0400
32057+++ linux-2.6.39.1/drivers/md/raid10.c 2011-05-22 19:36:31.000000000 -0400
32058@@ -1209,7 +1209,7 @@ static void end_sync_read(struct bio *bi
32059 if (test_bit(BIO_UPTODATE, &bio->bi_flags))
32060 set_bit(R10BIO_Uptodate, &r10_bio->state);
32061 else {
32062- atomic_add(r10_bio->sectors,
32063+ atomic_add_unchecked(r10_bio->sectors,
32064 &conf->mirrors[d].rdev->corrected_errors);
32065 if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery))
32066 md_error(r10_bio->mddev,
32067@@ -1417,7 +1417,7 @@ static void check_decay_read_errors(mdde
32068 {
32069 struct timespec cur_time_mon;
32070 unsigned long hours_since_last;
32071- unsigned int read_errors = atomic_read(&rdev->read_errors);
32072+ unsigned int read_errors = atomic_read_unchecked(&rdev->read_errors);
32073
32074 ktime_get_ts(&cur_time_mon);
32075
32076@@ -1439,9 +1439,9 @@ static void check_decay_read_errors(mdde
32077 * overflowing the shift of read_errors by hours_since_last.
32078 */
32079 if (hours_since_last >= 8 * sizeof(read_errors))
32080- atomic_set(&rdev->read_errors, 0);
32081+ atomic_set_unchecked(&rdev->read_errors, 0);
32082 else
32083- atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
32084+ atomic_set_unchecked(&rdev->read_errors, read_errors >> hours_since_last);
32085 }
32086
32087 /*
32088@@ -1476,8 +1476,8 @@ static void fix_read_error(conf_t *conf,
32089 }
32090
32091 check_decay_read_errors(mddev, rdev);
32092- atomic_inc(&rdev->read_errors);
32093- cur_read_error_count = atomic_read(&rdev->read_errors);
32094+ atomic_inc_unchecked(&rdev->read_errors);
32095+ cur_read_error_count = atomic_read_unchecked(&rdev->read_errors);
32096 if (cur_read_error_count > max_read_errors) {
32097 rcu_read_unlock();
32098 printk(KERN_NOTICE
32099@@ -1550,7 +1550,7 @@ static void fix_read_error(conf_t *conf,
32100 test_bit(In_sync, &rdev->flags)) {
32101 atomic_inc(&rdev->nr_pending);
32102 rcu_read_unlock();
32103- atomic_add(s, &rdev->corrected_errors);
32104+ atomic_add_unchecked(s, &rdev->corrected_errors);
32105 if (sync_page_io(rdev,
32106 r10_bio->devs[sl].addr +
32107 sect,
32108diff -urNp linux-2.6.39.1/drivers/md/raid1.c linux-2.6.39.1/drivers/md/raid1.c
32109--- linux-2.6.39.1/drivers/md/raid1.c 2011-05-19 00:06:34.000000000 -0400
32110+++ linux-2.6.39.1/drivers/md/raid1.c 2011-05-22 19:36:31.000000000 -0400
32111@@ -1342,7 +1342,7 @@ static void sync_request_write(mddev_t *
32112 if (r1_bio->bios[d]->bi_end_io != end_sync_read)
32113 continue;
32114 rdev = conf->mirrors[d].rdev;
32115- atomic_add(s, &rdev->corrected_errors);
32116+ atomic_add_unchecked(s, &rdev->corrected_errors);
32117 if (sync_page_io(rdev,
32118 sect,
32119 s<<9,
32120@@ -1488,7 +1488,7 @@ static void fix_read_error(conf_t *conf,
32121 /* Well, this device is dead */
32122 md_error(mddev, rdev);
32123 else {
32124- atomic_add(s, &rdev->corrected_errors);
32125+ atomic_add_unchecked(s, &rdev->corrected_errors);
32126 printk(KERN_INFO
32127 "md/raid1:%s: read error corrected "
32128 "(%d sectors at %llu on %s)\n",
32129diff -urNp linux-2.6.39.1/drivers/md/raid5.c linux-2.6.39.1/drivers/md/raid5.c
32130--- linux-2.6.39.1/drivers/md/raid5.c 2011-05-19 00:06:34.000000000 -0400
32131+++ linux-2.6.39.1/drivers/md/raid5.c 2011-05-22 19:36:31.000000000 -0400
32132@@ -550,7 +550,7 @@ static void ops_run_io(struct stripe_hea
32133 bi->bi_next = NULL;
32134 if (rw == WRITE &&
32135 test_bit(R5_ReWrite, &sh->dev[i].flags))
32136- atomic_add(STRIPE_SECTORS,
32137+ atomic_add_unchecked(STRIPE_SECTORS,
32138 &rdev->corrected_errors);
32139 generic_make_request(bi);
32140 } else {
32141@@ -1596,15 +1596,15 @@ static void raid5_end_read_request(struc
32142 clear_bit(R5_ReadError, &sh->dev[i].flags);
32143 clear_bit(R5_ReWrite, &sh->dev[i].flags);
32144 }
32145- if (atomic_read(&conf->disks[i].rdev->read_errors))
32146- atomic_set(&conf->disks[i].rdev->read_errors, 0);
32147+ if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
32148+ atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
32149 } else {
32150 const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
32151 int retry = 0;
32152 rdev = conf->disks[i].rdev;
32153
32154 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
32155- atomic_inc(&rdev->read_errors);
32156+ atomic_inc_unchecked(&rdev->read_errors);
32157 if (conf->mddev->degraded >= conf->max_degraded)
32158 printk_rl(KERN_WARNING
32159 "md/raid:%s: read error not correctable "
32160@@ -1622,7 +1622,7 @@ static void raid5_end_read_request(struc
32161 (unsigned long long)(sh->sector
32162 + rdev->data_offset),
32163 bdn);
32164- else if (atomic_read(&rdev->read_errors)
32165+ else if (atomic_read_unchecked(&rdev->read_errors)
32166 > conf->max_nr_stripes)
32167 printk(KERN_WARNING
32168 "md/raid:%s: Too many read errors, failing device %s.\n",
32169@@ -1947,6 +1947,7 @@ static sector_t compute_blocknr(struct s
32170 sector_t r_sector;
32171 struct stripe_head sh2;
32172
32173+ pax_track_stack();
32174
32175 chunk_offset = sector_div(new_sector, sectors_per_chunk);
32176 stripe = new_sector;
32177diff -urNp linux-2.6.39.1/drivers/media/common/saa7146_hlp.c linux-2.6.39.1/drivers/media/common/saa7146_hlp.c
32178--- linux-2.6.39.1/drivers/media/common/saa7146_hlp.c 2011-05-19 00:06:34.000000000 -0400
32179+++ linux-2.6.39.1/drivers/media/common/saa7146_hlp.c 2011-05-22 19:36:31.000000000 -0400
32180@@ -353,6 +353,8 @@ static void calculate_clipping_registers
32181
32182 int x[32], y[32], w[32], h[32];
32183
32184+ pax_track_stack();
32185+
32186 /* clear out memory */
32187 memset(&line_list[0], 0x00, sizeof(u32)*32);
32188 memset(&pixel_list[0], 0x00, sizeof(u32)*32);
32189diff -urNp linux-2.6.39.1/drivers/media/common/saa7146_vbi.c linux-2.6.39.1/drivers/media/common/saa7146_vbi.c
32190--- linux-2.6.39.1/drivers/media/common/saa7146_vbi.c 2011-05-19 00:06:34.000000000 -0400
32191+++ linux-2.6.39.1/drivers/media/common/saa7146_vbi.c 2011-05-22 19:36:31.000000000 -0400
32192@@ -501,7 +501,7 @@ static ssize_t vbi_read(struct file *fil
32193 return ret;
32194 }
32195
32196-struct saa7146_use_ops saa7146_vbi_uops = {
32197+const struct saa7146_use_ops saa7146_vbi_uops = {
32198 .init = vbi_init,
32199 .open = vbi_open,
32200 .release = vbi_close,
32201diff -urNp linux-2.6.39.1/drivers/media/common/saa7146_video.c linux-2.6.39.1/drivers/media/common/saa7146_video.c
32202--- linux-2.6.39.1/drivers/media/common/saa7146_video.c 2011-05-19 00:06:34.000000000 -0400
32203+++ linux-2.6.39.1/drivers/media/common/saa7146_video.c 2011-05-22 19:36:31.000000000 -0400
32204@@ -1420,7 +1420,7 @@ out:
32205 return ret;
32206 }
32207
32208-struct saa7146_use_ops saa7146_video_uops = {
32209+const struct saa7146_use_ops saa7146_video_uops = {
32210 .init = video_init,
32211 .open = video_open,
32212 .release = video_close,
32213diff -urNp linux-2.6.39.1/drivers/media/dvb/dm1105/dm1105.c linux-2.6.39.1/drivers/media/dvb/dm1105/dm1105.c
32214--- linux-2.6.39.1/drivers/media/dvb/dm1105/dm1105.c 2011-05-19 00:06:34.000000000 -0400
32215+++ linux-2.6.39.1/drivers/media/dvb/dm1105/dm1105.c 2011-05-22 19:36:31.000000000 -0400
32216@@ -418,7 +418,7 @@ static u32 functionality(struct i2c_adap
32217 return I2C_FUNC_I2C;
32218 }
32219
32220-static struct i2c_algorithm dm1105_algo = {
32221+static const struct i2c_algorithm dm1105_algo = {
32222 .master_xfer = dm1105_i2c_xfer,
32223 .functionality = functionality,
32224 };
32225diff -urNp linux-2.6.39.1/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-2.6.39.1/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
32226--- linux-2.6.39.1/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-05-19 00:06:34.000000000 -0400
32227+++ linux-2.6.39.1/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-05-22 19:36:31.000000000 -0400
32228@@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(stru
32229 u8 buf[HOST_LINK_BUF_SIZE];
32230 int i;
32231
32232+ pax_track_stack();
32233+
32234 dprintk("%s\n", __func__);
32235
32236 /* check if we have space for a link buf in the rx_buffer */
32237@@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(s
32238 unsigned long timeout;
32239 int written;
32240
32241+ pax_track_stack();
32242+
32243 dprintk("%s\n", __func__);
32244
32245 /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
32246diff -urNp linux-2.6.39.1/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.39.1/drivers/media/dvb/dvb-core/dvbdev.c
32247--- linux-2.6.39.1/drivers/media/dvb/dvb-core/dvbdev.c 2011-05-19 00:06:34.000000000 -0400
32248+++ linux-2.6.39.1/drivers/media/dvb/dvb-core/dvbdev.c 2011-05-22 19:36:31.000000000 -0400
32249@@ -192,7 +192,7 @@ int dvb_register_device(struct dvb_adapt
32250 const struct dvb_device *template, void *priv, int type)
32251 {
32252 struct dvb_device *dvbdev;
32253- struct file_operations *dvbdevfops;
32254+ struct file_operations *dvbdevfops; /* cannot be const, see this function */
32255 struct device *clsdev;
32256 int minor;
32257 int id;
32258diff -urNp linux-2.6.39.1/drivers/media/dvb/dvb-usb/dib0700_core.c linux-2.6.39.1/drivers/media/dvb/dvb-usb/dib0700_core.c
32259--- linux-2.6.39.1/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-05-19 00:06:34.000000000 -0400
32260+++ linux-2.6.39.1/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-05-22 19:36:31.000000000 -0400
32261@@ -391,6 +391,8 @@ int dib0700_download_firmware(struct usb
32262
32263 u8 buf[260];
32264
32265+ pax_track_stack();
32266+
32267 while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
32268 deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",
32269 hx.addr, hx.len, hx.chk);
32270diff -urNp linux-2.6.39.1/drivers/media/dvb/dvb-usb/lmedm04.c linux-2.6.39.1/drivers/media/dvb/dvb-usb/lmedm04.c
32271--- linux-2.6.39.1/drivers/media/dvb/dvb-usb/lmedm04.c 2011-05-19 00:06:34.000000000 -0400
32272+++ linux-2.6.39.1/drivers/media/dvb/dvb-usb/lmedm04.c 2011-05-22 19:36:31.000000000 -0400
32273@@ -663,6 +663,7 @@ static int lme2510_download_firmware(str
32274 packet_size = 0x31;
32275 len_in = 1;
32276
32277+ pax_track_stack();
32278
32279 info("FRM Starting Firmware Download");
32280
32281@@ -715,6 +716,8 @@ static void lme_coldreset(struct usb_dev
32282 int ret = 0, len_in;
32283 u8 data[512] = {0};
32284
32285+ pax_track_stack();
32286+
32287 data[0] = 0x0a;
32288 len_in = 1;
32289 info("FRM Firmware Cold Reset");
32290diff -urNp linux-2.6.39.1/drivers/media/dvb/frontends/dib7000p.c linux-2.6.39.1/drivers/media/dvb/frontends/dib7000p.c
32291--- linux-2.6.39.1/drivers/media/dvb/frontends/dib7000p.c 2011-06-03 00:04:14.000000000 -0400
32292+++ linux-2.6.39.1/drivers/media/dvb/frontends/dib7000p.c 2011-06-03 00:32:05.000000000 -0400
32293@@ -1945,7 +1945,7 @@ static u32 dib7000p_i2c_func(struct i2c_
32294 return I2C_FUNC_I2C;
32295 }
32296
32297-static struct i2c_algorithm dib7090_tuner_xfer_algo = {
32298+static const struct i2c_algorithm dib7090_tuner_xfer_algo = {
32299 .master_xfer = dib7090_tuner_xfer,
32300 .functionality = dib7000p_i2c_func,
32301 };
32302diff -urNp linux-2.6.39.1/drivers/media/dvb/frontends/dib9000.c linux-2.6.39.1/drivers/media/dvb/frontends/dib9000.c
32303--- linux-2.6.39.1/drivers/media/dvb/frontends/dib9000.c 2011-06-03 00:04:14.000000000 -0400
32304+++ linux-2.6.39.1/drivers/media/dvb/frontends/dib9000.c 2011-06-03 00:32:05.000000000 -0400
32305@@ -1676,12 +1676,12 @@ static u32 dib9000_i2c_func(struct i2c_a
32306 return I2C_FUNC_I2C;
32307 }
32308
32309-static struct i2c_algorithm dib9000_tuner_algo = {
32310+static const struct i2c_algorithm dib9000_tuner_algo = {
32311 .master_xfer = dib9000_tuner_xfer,
32312 .functionality = dib9000_i2c_func,
32313 };
32314
32315-static struct i2c_algorithm dib9000_component_bus_algo = {
32316+static const struct i2c_algorithm dib9000_component_bus_algo = {
32317 .master_xfer = dib9000_fw_component_bus_xfer,
32318 .functionality = dib9000_i2c_func,
32319 };
32320diff -urNp linux-2.6.39.1/drivers/media/dvb/frontends/dibx000_common.c linux-2.6.39.1/drivers/media/dvb/frontends/dibx000_common.c
32321--- linux-2.6.39.1/drivers/media/dvb/frontends/dibx000_common.c 2011-06-03 00:04:14.000000000 -0400
32322+++ linux-2.6.39.1/drivers/media/dvb/frontends/dibx000_common.c 2011-06-03 00:37:36.000000000 -0400
32323@@ -221,12 +221,12 @@ static int dibx000_i2c_master_xfer_gpio3
32324 return num;
32325 }
32326
32327-static struct i2c_algorithm dibx000_i2c_master_gpio12_xfer_algo = {
32328+static const struct i2c_algorithm dibx000_i2c_master_gpio12_xfer_algo = {
32329 .master_xfer = dibx000_i2c_master_xfer_gpio12,
32330 .functionality = dibx000_i2c_func,
32331 };
32332
32333-static struct i2c_algorithm dibx000_i2c_master_gpio34_xfer_algo = {
32334+static const struct i2c_algorithm dibx000_i2c_master_gpio34_xfer_algo = {
32335 .master_xfer = dibx000_i2c_master_xfer_gpio34,
32336 .functionality = dibx000_i2c_func,
32337 };
32338@@ -285,7 +285,7 @@ static int dibx000_i2c_gated_gpio67_xfer
32339 return i2c_transfer(mst->i2c_adap, mst->msg, 2 + num) == 2 + num ? num : -EIO;
32340 }
32341
32342-static struct i2c_algorithm dibx000_i2c_gated_gpio67_algo = {
32343+static const struct i2c_algorithm dibx000_i2c_gated_gpio67_algo = {
32344 .master_xfer = dibx000_i2c_gated_gpio67_xfer,
32345 .functionality = dibx000_i2c_func,
32346 };
32347@@ -322,7 +322,7 @@ static int dibx000_i2c_gated_tuner_xfer(
32348 return i2c_transfer(mst->i2c_adap, mst->msg, 2 + num) == 2 + num ? num : -EIO;
32349 }
32350
32351-static struct i2c_algorithm dibx000_i2c_gated_tuner_algo = {
32352+static const struct i2c_algorithm dibx000_i2c_gated_tuner_algo = {
32353 .master_xfer = dibx000_i2c_gated_tuner_xfer,
32354 .functionality = dibx000_i2c_func,
32355 };
32356@@ -375,7 +375,7 @@ void dibx000_reset_i2c_master(struct dib
32357 EXPORT_SYMBOL(dibx000_reset_i2c_master);
32358
32359 static int i2c_adapter_init(struct i2c_adapter *i2c_adap,
32360- struct i2c_algorithm *algo, const char *name,
32361+ const struct i2c_algorithm *algo, const char *name,
32362 struct dibx000_i2c_master *mst)
32363 {
32364 strncpy(i2c_adap->name, name, sizeof(i2c_adap->name));
32365diff -urNp linux-2.6.39.1/drivers/media/dvb/frontends/mb86a16.c linux-2.6.39.1/drivers/media/dvb/frontends/mb86a16.c
32366--- linux-2.6.39.1/drivers/media/dvb/frontends/mb86a16.c 2011-05-19 00:06:34.000000000 -0400
32367+++ linux-2.6.39.1/drivers/media/dvb/frontends/mb86a16.c 2011-05-22 19:36:31.000000000 -0400
32368@@ -1060,6 +1060,8 @@ static int mb86a16_set_fe(struct mb86a16
32369 int ret = -1;
32370 int sync;
32371
32372+ pax_track_stack();
32373+
32374 dprintk(verbose, MB86A16_INFO, 1, "freq=%d Mhz, symbrt=%d Ksps", state->frequency, state->srate);
32375
32376 fcp = 3000;
32377diff -urNp linux-2.6.39.1/drivers/media/dvb/frontends/or51211.c linux-2.6.39.1/drivers/media/dvb/frontends/or51211.c
32378--- linux-2.6.39.1/drivers/media/dvb/frontends/or51211.c 2011-05-19 00:06:34.000000000 -0400
32379+++ linux-2.6.39.1/drivers/media/dvb/frontends/or51211.c 2011-05-22 19:36:31.000000000 -0400
32380@@ -113,6 +113,8 @@ static int or51211_load_firmware (struct
32381 u8 tudata[585];
32382 int i;
32383
32384+ pax_track_stack();
32385+
32386 dprintk("Firmware is %zd bytes\n",fw->size);
32387
32388 /* Get eprom data */
32389diff -urNp linux-2.6.39.1/drivers/media/dvb/frontends/s5h1420.c linux-2.6.39.1/drivers/media/dvb/frontends/s5h1420.c
32390--- linux-2.6.39.1/drivers/media/dvb/frontends/s5h1420.c 2011-05-19 00:06:34.000000000 -0400
32391+++ linux-2.6.39.1/drivers/media/dvb/frontends/s5h1420.c 2011-05-22 19:36:31.000000000 -0400
32392@@ -870,7 +870,7 @@ static int s5h1420_tuner_i2c_tuner_xfer(
32393 return i2c_transfer(state->i2c, m, 1+num) == 1 + num ? num : -EIO;
32394 }
32395
32396-static struct i2c_algorithm s5h1420_tuner_i2c_algo = {
32397+static const struct i2c_algorithm s5h1420_tuner_i2c_algo = {
32398 .master_xfer = s5h1420_tuner_i2c_tuner_xfer,
32399 .functionality = s5h1420_tuner_i2c_func,
32400 };
32401diff -urNp linux-2.6.39.1/drivers/media/dvb/mantis/mantis_i2c.c linux-2.6.39.1/drivers/media/dvb/mantis/mantis_i2c.c
32402--- linux-2.6.39.1/drivers/media/dvb/mantis/mantis_i2c.c 2011-05-19 00:06:34.000000000 -0400
32403+++ linux-2.6.39.1/drivers/media/dvb/mantis/mantis_i2c.c 2011-05-22 19:36:31.000000000 -0400
32404@@ -212,7 +212,7 @@ static u32 mantis_i2c_func(struct i2c_ad
32405 return I2C_FUNC_SMBUS_EMUL;
32406 }
32407
32408-static struct i2c_algorithm mantis_algo = {
32409+static const struct i2c_algorithm mantis_algo = {
32410 .master_xfer = mantis_i2c_xfer,
32411 .functionality = mantis_i2c_func,
32412 };
32413diff -urNp linux-2.6.39.1/drivers/media/dvb/ttusb-dec/ttusb_dec.c linux-2.6.39.1/drivers/media/dvb/ttusb-dec/ttusb_dec.c
32414--- linux-2.6.39.1/drivers/media/dvb/ttusb-dec/ttusb_dec.c 2011-05-19 00:06:34.000000000 -0400
32415+++ linux-2.6.39.1/drivers/media/dvb/ttusb-dec/ttusb_dec.c 2011-05-22 19:36:31.000000000 -0400
32416@@ -1614,7 +1614,7 @@ static int fe_send_command(struct dvb_fr
32417 return ttusb_dec_send_command(dec, command, param_length, params, result_length, cmd_result);
32418 }
32419
32420-static struct ttusbdecfe_config fe_config = {
32421+static const struct ttusbdecfe_config fe_config = {
32422 .send_command = fe_send_command
32423 };
32424
32425diff -urNp linux-2.6.39.1/drivers/media/radio/radio-cadet.c linux-2.6.39.1/drivers/media/radio/radio-cadet.c
32426--- linux-2.6.39.1/drivers/media/radio/radio-cadet.c 2011-05-19 00:06:34.000000000 -0400
32427+++ linux-2.6.39.1/drivers/media/radio/radio-cadet.c 2011-05-22 19:36:31.000000000 -0400
32428@@ -349,7 +349,7 @@ static ssize_t cadet_read(struct file *f
32429 readbuf[i++] = dev->rdsbuf[dev->rdsout++];
32430 mutex_unlock(&dev->lock);
32431
32432- if (copy_to_user(data, readbuf, i))
32433+ if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
32434 return -EFAULT;
32435 return i;
32436 }
32437diff -urNp linux-2.6.39.1/drivers/media/radio/radio-si4713.c linux-2.6.39.1/drivers/media/radio/radio-si4713.c
32438--- linux-2.6.39.1/drivers/media/radio/radio-si4713.c 2011-05-19 00:06:34.000000000 -0400
32439+++ linux-2.6.39.1/drivers/media/radio/radio-si4713.c 2011-05-22 19:36:31.000000000 -0400
32440@@ -231,7 +231,7 @@ static long radio_si4713_default(struct
32441 ioctl, cmd, arg);
32442 }
32443
32444-static struct v4l2_ioctl_ops radio_si4713_ioctl_ops = {
32445+static const struct v4l2_ioctl_ops radio_si4713_ioctl_ops = {
32446 .vidioc_enumaudout = radio_si4713_enumaudout,
32447 .vidioc_g_audout = radio_si4713_g_audout,
32448 .vidioc_s_audout = radio_si4713_s_audout,
32449diff -urNp linux-2.6.39.1/drivers/media/rc/ir-lirc-codec.c linux-2.6.39.1/drivers/media/rc/ir-lirc-codec.c
32450--- linux-2.6.39.1/drivers/media/rc/ir-lirc-codec.c 2011-05-19 00:06:34.000000000 -0400
32451+++ linux-2.6.39.1/drivers/media/rc/ir-lirc-codec.c 2011-05-22 19:36:31.000000000 -0400
32452@@ -277,7 +277,7 @@ static void ir_lirc_close(void *data)
32453 return;
32454 }
32455
32456-static struct file_operations lirc_fops = {
32457+static const struct file_operations lirc_fops = {
32458 .owner = THIS_MODULE,
32459 .write = ir_lirc_transmit_ir,
32460 .unlocked_ioctl = ir_lirc_ioctl,
32461diff -urNp linux-2.6.39.1/drivers/media/rc/lirc_dev.c linux-2.6.39.1/drivers/media/rc/lirc_dev.c
32462--- linux-2.6.39.1/drivers/media/rc/lirc_dev.c 2011-05-19 00:06:34.000000000 -0400
32463+++ linux-2.6.39.1/drivers/media/rc/lirc_dev.c 2011-05-22 19:36:31.000000000 -0400
32464@@ -151,7 +151,7 @@ static int lirc_thread(void *irctl)
32465 }
32466
32467
32468-static struct file_operations lirc_dev_fops = {
32469+static const struct file_operations lirc_dev_fops = {
32470 .owner = THIS_MODULE,
32471 .read = lirc_dev_fop_read,
32472 .write = lirc_dev_fop_write,
32473diff -urNp linux-2.6.39.1/drivers/media/rc/rc-main.c linux-2.6.39.1/drivers/media/rc/rc-main.c
32474--- linux-2.6.39.1/drivers/media/rc/rc-main.c 2011-05-19 00:06:34.000000000 -0400
32475+++ linux-2.6.39.1/drivers/media/rc/rc-main.c 2011-05-22 19:36:31.000000000 -0400
32476@@ -996,7 +996,7 @@ EXPORT_SYMBOL_GPL(rc_free_device);
32477
32478 int rc_register_device(struct rc_dev *dev)
32479 {
32480- static atomic_t devno = ATOMIC_INIT(0);
32481+ static atomic_unchecked_t devno = ATOMIC_INIT(0);
32482 struct rc_map *rc_map;
32483 const char *path;
32484 int rc;
32485@@ -1019,7 +1019,7 @@ int rc_register_device(struct rc_dev *de
32486 if (dev->close)
32487 dev->input_dev->close = ir_close;
32488
32489- dev->devno = (unsigned long)(atomic_inc_return(&devno) - 1);
32490+ dev->devno = (unsigned long)(atomic_inc_return_unchecked(&devno) - 1);
32491 dev_set_name(&dev->dev, "rc%ld", dev->devno);
32492 dev_set_drvdata(&dev->dev, dev);
32493 rc = device_add(&dev->dev);
32494diff -urNp linux-2.6.39.1/drivers/media/video/au0828/au0828.h linux-2.6.39.1/drivers/media/video/au0828/au0828.h
32495--- linux-2.6.39.1/drivers/media/video/au0828/au0828.h 2011-05-19 00:06:34.000000000 -0400
32496+++ linux-2.6.39.1/drivers/media/video/au0828/au0828.h 2011-05-22 19:36:31.000000000 -0400
32497@@ -191,7 +191,7 @@ struct au0828_dev {
32498
32499 /* I2C */
32500 struct i2c_adapter i2c_adap;
32501- struct i2c_algorithm i2c_algo;
32502+ struct i2c_algorithm i2c_algo;
32503 struct i2c_client i2c_client;
32504 u32 i2c_rc;
32505
32506diff -urNp linux-2.6.39.1/drivers/media/video/cafe_ccic.c linux-2.6.39.1/drivers/media/video/cafe_ccic.c
32507--- linux-2.6.39.1/drivers/media/video/cafe_ccic.c 2011-05-19 00:06:34.000000000 -0400
32508+++ linux-2.6.39.1/drivers/media/video/cafe_ccic.c 2011-05-22 19:36:31.000000000 -0400
32509@@ -520,7 +520,7 @@ static u32 cafe_smbus_func(struct i2c_ad
32510 I2C_FUNC_SMBUS_WRITE_BYTE_DATA;
32511 }
32512
32513-static struct i2c_algorithm cafe_smbus_algo = {
32514+static const struct i2c_algorithm cafe_smbus_algo = {
32515 .smbus_xfer = cafe_smbus_xfer,
32516 .functionality = cafe_smbus_func
32517 };
32518diff -urNp linux-2.6.39.1/drivers/media/video/cx18/cx18-alsa-pcm.c linux-2.6.39.1/drivers/media/video/cx18/cx18-alsa-pcm.c
32519--- linux-2.6.39.1/drivers/media/video/cx18/cx18-alsa-pcm.c 2011-05-19 00:06:34.000000000 -0400
32520+++ linux-2.6.39.1/drivers/media/video/cx18/cx18-alsa-pcm.c 2011-05-22 19:36:31.000000000 -0400
32521@@ -314,7 +314,7 @@ static struct page *snd_pcm_get_vmalloc_
32522 return vmalloc_to_page(pageptr);
32523 }
32524
32525-static struct snd_pcm_ops snd_cx18_pcm_capture_ops = {
32526+static const struct snd_pcm_ops snd_cx18_pcm_capture_ops = {
32527 .open = snd_cx18_pcm_capture_open,
32528 .close = snd_cx18_pcm_capture_close,
32529 .ioctl = snd_cx18_pcm_ioctl,
32530diff -urNp linux-2.6.39.1/drivers/media/video/cx18/cx18-driver.c linux-2.6.39.1/drivers/media/video/cx18/cx18-driver.c
32531--- linux-2.6.39.1/drivers/media/video/cx18/cx18-driver.c 2011-05-19 00:06:34.000000000 -0400
32532+++ linux-2.6.39.1/drivers/media/video/cx18/cx18-driver.c 2011-05-22 19:36:31.000000000 -0400
32533@@ -61,7 +61,7 @@ static struct pci_device_id cx18_pci_tbl
32534
32535 MODULE_DEVICE_TABLE(pci, cx18_pci_tbl);
32536
32537-static atomic_t cx18_instance = ATOMIC_INIT(0);
32538+static atomic_unchecked_t cx18_instance = ATOMIC_INIT(0);
32539
32540 /* Parameter declarations */
32541 static int cardtype[CX18_MAX_CARDS];
32542@@ -327,6 +327,8 @@ void cx18_read_eeprom(struct cx18 *cx, s
32543 struct i2c_client c;
32544 u8 eedata[256];
32545
32546+ pax_track_stack();
32547+
32548 memset(&c, 0, sizeof(c));
32549 strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
32550 c.adapter = &cx->i2c_adap[0];
32551@@ -892,7 +894,7 @@ static int __devinit cx18_probe(struct p
32552 struct cx18 *cx;
32553
32554 /* FIXME - module parameter arrays constrain max instances */
32555- i = atomic_inc_return(&cx18_instance) - 1;
32556+ i = atomic_inc_return_unchecked(&cx18_instance) - 1;
32557 if (i >= CX18_MAX_CARDS) {
32558 printk(KERN_ERR "cx18: cannot manage card %d, driver has a "
32559 "limit of 0 - %d\n", i, CX18_MAX_CARDS - 1);
32560diff -urNp linux-2.6.39.1/drivers/media/video/cx231xx/cx231xx-audio.c linux-2.6.39.1/drivers/media/video/cx231xx/cx231xx-audio.c
32561--- linux-2.6.39.1/drivers/media/video/cx231xx/cx231xx-audio.c 2011-05-19 00:06:34.000000000 -0400
32562+++ linux-2.6.39.1/drivers/media/video/cx231xx/cx231xx-audio.c 2011-05-22 19:36:31.000000000 -0400
32563@@ -613,7 +613,7 @@ static struct page *snd_pcm_get_vmalloc_
32564 return vmalloc_to_page(pageptr);
32565 }
32566
32567-static struct snd_pcm_ops snd_cx231xx_pcm_capture = {
32568+static const struct snd_pcm_ops snd_cx231xx_pcm_capture = {
32569 .open = snd_cx231xx_capture_open,
32570 .close = snd_cx231xx_pcm_close,
32571 .ioctl = snd_pcm_lib_ioctl,
32572diff -urNp linux-2.6.39.1/drivers/media/video/cx231xx/cx231xx-i2c.c linux-2.6.39.1/drivers/media/video/cx231xx/cx231xx-i2c.c
32573--- linux-2.6.39.1/drivers/media/video/cx231xx/cx231xx-i2c.c 2011-05-19 00:06:34.000000000 -0400
32574+++ linux-2.6.39.1/drivers/media/video/cx231xx/cx231xx-i2c.c 2011-05-22 19:36:31.000000000 -0400
32575@@ -435,7 +435,7 @@ static u32 functionality(struct i2c_adap
32576 return I2C_FUNC_SMBUS_EMUL | I2C_FUNC_I2C;
32577 }
32578
32579-static struct i2c_algorithm cx231xx_algo = {
32580+static const struct i2c_algorithm cx231xx_algo = {
32581 .master_xfer = cx231xx_i2c_xfer,
32582 .functionality = functionality,
32583 };
32584diff -urNp linux-2.6.39.1/drivers/media/video/cx23885/cx23885-input.c linux-2.6.39.1/drivers/media/video/cx23885/cx23885-input.c
32585--- linux-2.6.39.1/drivers/media/video/cx23885/cx23885-input.c 2011-05-19 00:06:34.000000000 -0400
32586+++ linux-2.6.39.1/drivers/media/video/cx23885/cx23885-input.c 2011-05-22 19:36:31.000000000 -0400
32587@@ -53,6 +53,8 @@ static void cx23885_input_process_measur
32588 bool handle = false;
32589 struct ir_raw_event ir_core_event[64];
32590
32591+ pax_track_stack();
32592+
32593 do {
32594 num = 0;
32595 v4l2_subdev_call(dev->sd_ir, ir, rx_read, (u8 *) ir_core_event,
32596diff -urNp linux-2.6.39.1/drivers/media/video/cx88/cx88-alsa.c linux-2.6.39.1/drivers/media/video/cx88/cx88-alsa.c
32597--- linux-2.6.39.1/drivers/media/video/cx88/cx88-alsa.c 2011-05-19 00:06:34.000000000 -0400
32598+++ linux-2.6.39.1/drivers/media/video/cx88/cx88-alsa.c 2011-05-22 19:36:31.000000000 -0400
32599@@ -519,7 +519,7 @@ static struct page *snd_cx88_page(struct
32600 /*
32601 * operators
32602 */
32603-static struct snd_pcm_ops snd_cx88_pcm_ops = {
32604+static const struct snd_pcm_ops snd_cx88_pcm_ops = {
32605 .open = snd_cx88_pcm_open,
32606 .close = snd_cx88_close,
32607 .ioctl = snd_pcm_lib_ioctl,
32608diff -urNp linux-2.6.39.1/drivers/media/video/davinci/ccdc_hw_device.h linux-2.6.39.1/drivers/media/video/davinci/ccdc_hw_device.h
32609--- linux-2.6.39.1/drivers/media/video/davinci/ccdc_hw_device.h 2011-05-19 00:06:34.000000000 -0400
32610+++ linux-2.6.39.1/drivers/media/video/davinci/ccdc_hw_device.h 2011-05-22 19:36:31.000000000 -0400
32611@@ -99,7 +99,7 @@ struct ccdc_hw_device {
32612 /* module owner */
32613 struct module *owner;
32614 /* hw ops */
32615- struct ccdc_hw_ops hw_ops;
32616+ const struct ccdc_hw_ops hw_ops;
32617 };
32618
32619 /* Used by CCDC module to register & unregister with vpfe capture driver */
32620diff -urNp linux-2.6.39.1/drivers/media/video/davinci/vpss.c linux-2.6.39.1/drivers/media/video/davinci/vpss.c
32621--- linux-2.6.39.1/drivers/media/video/davinci/vpss.c 2011-05-19 00:06:34.000000000 -0400
32622+++ linux-2.6.39.1/drivers/media/video/davinci/vpss.c 2011-05-22 19:36:31.000000000 -0400
32623@@ -103,7 +103,7 @@ struct vpss_oper_config {
32624 __iomem void *vpss_regs_base1;
32625 enum vpss_platform_type platform;
32626 spinlock_t vpss_lock;
32627- struct vpss_hw_ops hw_ops;
32628+ const struct vpss_hw_ops hw_ops;
32629 };
32630
32631 static struct vpss_oper_config oper_cfg;
32632diff -urNp linux-2.6.39.1/drivers/media/video/em28xx/em28xx-audio.c linux-2.6.39.1/drivers/media/video/em28xx/em28xx-audio.c
32633--- linux-2.6.39.1/drivers/media/video/em28xx/em28xx-audio.c 2011-05-19 00:06:34.000000000 -0400
32634+++ linux-2.6.39.1/drivers/media/video/em28xx/em28xx-audio.c 2011-05-22 19:36:31.000000000 -0400
32635@@ -432,7 +432,7 @@ static struct page *snd_pcm_get_vmalloc_
32636 return vmalloc_to_page(pageptr);
32637 }
32638
32639-static struct snd_pcm_ops snd_em28xx_pcm_capture = {
32640+static const struct snd_pcm_ops snd_em28xx_pcm_capture = {
32641 .open = snd_em28xx_capture_open,
32642 .close = snd_em28xx_pcm_close,
32643 .ioctl = snd_pcm_lib_ioctl,
32644diff -urNp linux-2.6.39.1/drivers/media/video/em28xx/em28xx-i2c.c linux-2.6.39.1/drivers/media/video/em28xx/em28xx-i2c.c
32645--- linux-2.6.39.1/drivers/media/video/em28xx/em28xx-i2c.c 2011-05-19 00:06:34.000000000 -0400
32646+++ linux-2.6.39.1/drivers/media/video/em28xx/em28xx-i2c.c 2011-05-22 19:36:31.000000000 -0400
32647@@ -451,7 +451,7 @@ static u32 functionality(struct i2c_adap
32648 return I2C_FUNC_SMBUS_EMUL;
32649 }
32650
32651-static struct i2c_algorithm em28xx_algo = {
32652+static const struct i2c_algorithm em28xx_algo = {
32653 .master_xfer = em28xx_i2c_xfer,
32654 .functionality = functionality,
32655 };
32656diff -urNp linux-2.6.39.1/drivers/media/video/hdpvr/hdpvr-i2c.c linux-2.6.39.1/drivers/media/video/hdpvr/hdpvr-i2c.c
32657--- linux-2.6.39.1/drivers/media/video/hdpvr/hdpvr-i2c.c 2011-05-19 00:06:34.000000000 -0400
32658+++ linux-2.6.39.1/drivers/media/video/hdpvr/hdpvr-i2c.c 2011-05-22 19:36:31.000000000 -0400
32659@@ -179,7 +179,7 @@ static u32 hdpvr_functionality(struct i2
32660 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
32661 }
32662
32663-static struct i2c_algorithm hdpvr_algo = {
32664+static const struct i2c_algorithm hdpvr_algo = {
32665 .master_xfer = hdpvr_transfer,
32666 .functionality = hdpvr_functionality,
32667 };
32668diff -urNp linux-2.6.39.1/drivers/media/video/imx074.c linux-2.6.39.1/drivers/media/video/imx074.c
32669--- linux-2.6.39.1/drivers/media/video/imx074.c 2011-05-19 00:06:34.000000000 -0400
32670+++ linux-2.6.39.1/drivers/media/video/imx074.c 2011-05-22 19:36:31.000000000 -0400
32671@@ -267,7 +267,7 @@ static int imx074_g_chip_ident(struct v4
32672 return 0;
32673 }
32674
32675-static struct v4l2_subdev_video_ops imx074_subdev_video_ops = {
32676+static const struct v4l2_subdev_video_ops imx074_subdev_video_ops = {
32677 .s_stream = imx074_s_stream,
32678 .s_mbus_fmt = imx074_s_fmt,
32679 .g_mbus_fmt = imx074_g_fmt,
32680@@ -277,7 +277,7 @@ static struct v4l2_subdev_video_ops imx0
32681 .cropcap = imx074_cropcap,
32682 };
32683
32684-static struct v4l2_subdev_core_ops imx074_subdev_core_ops = {
32685+static const struct v4l2_subdev_core_ops imx074_subdev_core_ops = {
32686 .g_chip_ident = imx074_g_chip_ident,
32687 };
32688
32689diff -urNp linux-2.6.39.1/drivers/media/video/ivtv/ivtv-driver.c linux-2.6.39.1/drivers/media/video/ivtv/ivtv-driver.c
32690--- linux-2.6.39.1/drivers/media/video/ivtv/ivtv-driver.c 2011-05-19 00:06:34.000000000 -0400
32691+++ linux-2.6.39.1/drivers/media/video/ivtv/ivtv-driver.c 2011-05-22 19:36:31.000000000 -0400
32692@@ -80,7 +80,7 @@ static struct pci_device_id ivtv_pci_tbl
32693 MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
32694
32695 /* ivtv instance counter */
32696-static atomic_t ivtv_instance = ATOMIC_INIT(0);
32697+static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0);
32698
32699 /* Parameter declarations */
32700 static int cardtype[IVTV_MAX_CARDS];
32701diff -urNp linux-2.6.39.1/drivers/media/video/mt9m001.c linux-2.6.39.1/drivers/media/video/mt9m001.c
32702--- linux-2.6.39.1/drivers/media/video/mt9m001.c 2011-05-19 00:06:34.000000000 -0400
32703+++ linux-2.6.39.1/drivers/media/video/mt9m001.c 2011-05-22 19:36:31.000000000 -0400
32704@@ -691,7 +691,7 @@ static int mt9m001_g_skip_top_lines(stru
32705 return 0;
32706 }
32707
32708-static struct v4l2_subdev_core_ops mt9m001_subdev_core_ops = {
32709+static const struct v4l2_subdev_core_ops mt9m001_subdev_core_ops = {
32710 .g_ctrl = mt9m001_g_ctrl,
32711 .s_ctrl = mt9m001_s_ctrl,
32712 .g_chip_ident = mt9m001_g_chip_ident,
32713@@ -714,7 +714,7 @@ static int mt9m001_enum_fmt(struct v4l2_
32714 return 0;
32715 }
32716
32717-static struct v4l2_subdev_video_ops mt9m001_subdev_video_ops = {
32718+static const struct v4l2_subdev_video_ops mt9m001_subdev_video_ops = {
32719 .s_stream = mt9m001_s_stream,
32720 .s_mbus_fmt = mt9m001_s_fmt,
32721 .g_mbus_fmt = mt9m001_g_fmt,
32722@@ -725,7 +725,7 @@ static struct v4l2_subdev_video_ops mt9m
32723 .enum_mbus_fmt = mt9m001_enum_fmt,
32724 };
32725
32726-static struct v4l2_subdev_sensor_ops mt9m001_subdev_sensor_ops = {
32727+static const struct v4l2_subdev_sensor_ops mt9m001_subdev_sensor_ops = {
32728 .g_skip_top_lines = mt9m001_g_skip_top_lines,
32729 };
32730
32731diff -urNp linux-2.6.39.1/drivers/media/video/mt9t031.c linux-2.6.39.1/drivers/media/video/mt9t031.c
32732--- linux-2.6.39.1/drivers/media/video/mt9t031.c 2011-05-19 00:06:34.000000000 -0400
32733+++ linux-2.6.39.1/drivers/media/video/mt9t031.c 2011-05-22 19:36:31.000000000 -0400
32734@@ -725,7 +725,7 @@ static int mt9t031_runtime_resume(struct
32735 return 0;
32736 }
32737
32738-static struct dev_pm_ops mt9t031_dev_pm_ops = {
32739+static const struct dev_pm_ops mt9t031_dev_pm_ops = {
32740 .runtime_suspend = mt9t031_runtime_suspend,
32741 .runtime_resume = mt9t031_runtime_resume,
32742 };
32743@@ -788,7 +788,7 @@ static int mt9t031_g_skip_top_lines(stru
32744 return 0;
32745 }
32746
32747-static struct v4l2_subdev_core_ops mt9t031_subdev_core_ops = {
32748+static const struct v4l2_subdev_core_ops mt9t031_subdev_core_ops = {
32749 .g_ctrl = mt9t031_g_ctrl,
32750 .s_ctrl = mt9t031_s_ctrl,
32751 .g_chip_ident = mt9t031_g_chip_ident,
32752@@ -808,7 +808,7 @@ static int mt9t031_enum_fmt(struct v4l2_
32753 return 0;
32754 }
32755
32756-static struct v4l2_subdev_video_ops mt9t031_subdev_video_ops = {
32757+static const struct v4l2_subdev_video_ops mt9t031_subdev_video_ops = {
32758 .s_stream = mt9t031_s_stream,
32759 .s_mbus_fmt = mt9t031_s_fmt,
32760 .g_mbus_fmt = mt9t031_g_fmt,
32761@@ -819,7 +819,7 @@ static struct v4l2_subdev_video_ops mt9t
32762 .enum_mbus_fmt = mt9t031_enum_fmt,
32763 };
32764
32765-static struct v4l2_subdev_sensor_ops mt9t031_subdev_sensor_ops = {
32766+static const struct v4l2_subdev_sensor_ops mt9t031_subdev_sensor_ops = {
32767 .g_skip_top_lines = mt9t031_g_skip_top_lines,
32768 };
32769
32770diff -urNp linux-2.6.39.1/drivers/media/video/mt9v022.c linux-2.6.39.1/drivers/media/video/mt9v022.c
32771--- linux-2.6.39.1/drivers/media/video/mt9v022.c 2011-05-19 00:06:34.000000000 -0400
32772+++ linux-2.6.39.1/drivers/media/video/mt9v022.c 2011-05-22 19:36:31.000000000 -0400
32773@@ -825,7 +825,7 @@ static int mt9v022_g_skip_top_lines(stru
32774 return 0;
32775 }
32776
32777-static struct v4l2_subdev_core_ops mt9v022_subdev_core_ops = {
32778+static const struct v4l2_subdev_core_ops mt9v022_subdev_core_ops = {
32779 .g_ctrl = mt9v022_g_ctrl,
32780 .s_ctrl = mt9v022_s_ctrl,
32781 .g_chip_ident = mt9v022_g_chip_ident,
32782@@ -848,7 +848,7 @@ static int mt9v022_enum_fmt(struct v4l2_
32783 return 0;
32784 }
32785
32786-static struct v4l2_subdev_video_ops mt9v022_subdev_video_ops = {
32787+static const struct v4l2_subdev_video_ops mt9v022_subdev_video_ops = {
32788 .s_stream = mt9v022_s_stream,
32789 .s_mbus_fmt = mt9v022_s_fmt,
32790 .g_mbus_fmt = mt9v022_g_fmt,
32791@@ -859,7 +859,7 @@ static struct v4l2_subdev_video_ops mt9v
32792 .enum_mbus_fmt = mt9v022_enum_fmt,
32793 };
32794
32795-static struct v4l2_subdev_sensor_ops mt9v022_subdev_sensor_ops = {
32796+static const struct v4l2_subdev_sensor_ops mt9v022_subdev_sensor_ops = {
32797 .g_skip_top_lines = mt9v022_g_skip_top_lines,
32798 };
32799
32800diff -urNp linux-2.6.39.1/drivers/media/video/mx2_camera.c linux-2.6.39.1/drivers/media/video/mx2_camera.c
32801--- linux-2.6.39.1/drivers/media/video/mx2_camera.c 2011-05-19 00:06:34.000000000 -0400
32802+++ linux-2.6.39.1/drivers/media/video/mx2_camera.c 2011-05-22 19:36:31.000000000 -0400
32803@@ -668,7 +668,7 @@ static void mx2_videobuf_release(struct
32804 free_buffer(vq, buf);
32805 }
32806
32807-static struct videobuf_queue_ops mx2_videobuf_ops = {
32808+static const struct videobuf_queue_ops mx2_videobuf_ops = {
32809 .buf_setup = mx2_videobuf_setup,
32810 .buf_prepare = mx2_videobuf_prepare,
32811 .buf_queue = mx2_videobuf_queue,
32812diff -urNp linux-2.6.39.1/drivers/media/video/omap24xxcam.c linux-2.6.39.1/drivers/media/video/omap24xxcam.c
32813--- linux-2.6.39.1/drivers/media/video/omap24xxcam.c 2011-05-19 00:06:34.000000000 -0400
32814+++ linux-2.6.39.1/drivers/media/video/omap24xxcam.c 2011-05-22 19:36:31.000000000 -0400
32815@@ -403,7 +403,7 @@ static void omap24xxcam_vbq_complete(str
32816 spin_unlock_irqrestore(&cam->core_enable_disable_lock, flags);
32817
32818 do_gettimeofday(&vb->ts);
32819- vb->field_count = atomic_add_return(2, &fh->field_count);
32820+ vb->field_count = atomic_add_return_unchecked(2, &fh->field_count);
32821 if (csr & csr_error) {
32822 vb->state = VIDEOBUF_ERROR;
32823 if (!atomic_read(&fh->cam->in_reset)) {
32824diff -urNp linux-2.6.39.1/drivers/media/video/omap24xxcam.h linux-2.6.39.1/drivers/media/video/omap24xxcam.h
32825--- linux-2.6.39.1/drivers/media/video/omap24xxcam.h 2011-05-19 00:06:34.000000000 -0400
32826+++ linux-2.6.39.1/drivers/media/video/omap24xxcam.h 2011-05-22 19:36:31.000000000 -0400
32827@@ -533,7 +533,7 @@ struct omap24xxcam_fh {
32828 spinlock_t vbq_lock; /* spinlock for the videobuf queue */
32829 struct videobuf_queue vbq;
32830 struct v4l2_pix_format pix; /* serialise pix by vbq->lock */
32831- atomic_t field_count; /* field counter for videobuf_buffer */
32832+ atomic_unchecked_t field_count; /* field counter for videobuf_buffer */
32833 /* accessing cam here doesn't need serialisation: it's constant */
32834 struct omap24xxcam_device *cam;
32835 };
32836diff -urNp linux-2.6.39.1/drivers/media/video/omap3isp/isp.h linux-2.6.39.1/drivers/media/video/omap3isp/isp.h
32837--- linux-2.6.39.1/drivers/media/video/omap3isp/isp.h 2011-05-19 00:06:34.000000000 -0400
32838+++ linux-2.6.39.1/drivers/media/video/omap3isp/isp.h 2011-05-22 19:36:31.000000000 -0400
32839@@ -290,7 +290,7 @@ struct isp_device {
32840
32841 struct iommu *iommu;
32842
32843- struct isp_platform_callback platform_cb;
32844+ const struct isp_platform_callback platform_cb;
32845 };
32846
32847 #define v4l2_dev_to_isp_device(dev) \
32848diff -urNp linux-2.6.39.1/drivers/media/video/ov2640.c linux-2.6.39.1/drivers/media/video/ov2640.c
32849--- linux-2.6.39.1/drivers/media/video/ov2640.c 2011-05-19 00:06:34.000000000 -0400
32850+++ linux-2.6.39.1/drivers/media/video/ov2640.c 2011-05-22 19:36:31.000000000 -0400
32851@@ -1080,7 +1080,7 @@ static struct soc_camera_ops ov2640_ops
32852 .num_controls = ARRAY_SIZE(ov2640_controls),
32853 };
32854
32855-static struct v4l2_subdev_core_ops ov2640_subdev_core_ops = {
32856+static const struct v4l2_subdev_core_ops ov2640_subdev_core_ops = {
32857 .g_ctrl = ov2640_g_ctrl,
32858 .s_ctrl = ov2640_s_ctrl,
32859 .g_chip_ident = ov2640_g_chip_ident,
32860@@ -1090,7 +1090,7 @@ static struct v4l2_subdev_core_ops ov264
32861 #endif
32862 };
32863
32864-static struct v4l2_subdev_video_ops ov2640_subdev_video_ops = {
32865+static const struct v4l2_subdev_video_ops ov2640_subdev_video_ops = {
32866 .s_stream = ov2640_s_stream,
32867 .g_mbus_fmt = ov2640_g_fmt,
32868 .s_mbus_fmt = ov2640_s_fmt,
32869diff -urNp linux-2.6.39.1/drivers/media/video/ov772x.c linux-2.6.39.1/drivers/media/video/ov772x.c
32870--- linux-2.6.39.1/drivers/media/video/ov772x.c 2011-05-19 00:06:34.000000000 -0400
32871+++ linux-2.6.39.1/drivers/media/video/ov772x.c 2011-05-22 19:36:31.000000000 -0400
32872@@ -1079,7 +1079,7 @@ static struct soc_camera_ops ov772x_ops
32873 .num_controls = ARRAY_SIZE(ov772x_controls),
32874 };
32875
32876-static struct v4l2_subdev_core_ops ov772x_subdev_core_ops = {
32877+static const struct v4l2_subdev_core_ops ov772x_subdev_core_ops = {
32878 .g_ctrl = ov772x_g_ctrl,
32879 .s_ctrl = ov772x_s_ctrl,
32880 .g_chip_ident = ov772x_g_chip_ident,
32881@@ -1099,7 +1099,7 @@ static int ov772x_enum_fmt(struct v4l2_s
32882 return 0;
32883 }
32884
32885-static struct v4l2_subdev_video_ops ov772x_subdev_video_ops = {
32886+static const struct v4l2_subdev_video_ops ov772x_subdev_video_ops = {
32887 .s_stream = ov772x_s_stream,
32888 .g_mbus_fmt = ov772x_g_fmt,
32889 .s_mbus_fmt = ov772x_s_fmt,
32890diff -urNp linux-2.6.39.1/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-2.6.39.1/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
32891--- linux-2.6.39.1/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-05-19 00:06:34.000000000 -0400
32892+++ linux-2.6.39.1/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-05-22 19:36:31.000000000 -0400
32893@@ -120,6 +120,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw
32894 u8 *eeprom;
32895 struct tveeprom tvdata;
32896
32897+ pax_track_stack();
32898+
32899 memset(&tvdata,0,sizeof(tvdata));
32900
32901 eeprom = pvr2_eeprom_fetch(hdw);
32902diff -urNp linux-2.6.39.1/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c linux-2.6.39.1/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
32903--- linux-2.6.39.1/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c 2011-05-19 00:06:34.000000000 -0400
32904+++ linux-2.6.39.1/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c 2011-05-22 19:36:31.000000000 -0400
32905@@ -527,7 +527,7 @@ static u32 pvr2_i2c_functionality(struct
32906 return I2C_FUNC_SMBUS_EMUL | I2C_FUNC_I2C;
32907 }
32908
32909-static struct i2c_algorithm pvr2_i2c_algo_template = {
32910+static const struct i2c_algorithm pvr2_i2c_algo_template = {
32911 .master_xfer = pvr2_i2c_xfer,
32912 .functionality = pvr2_i2c_functionality,
32913 };
32914diff -urNp linux-2.6.39.1/drivers/media/video/rj54n1cb0c.c linux-2.6.39.1/drivers/media/video/rj54n1cb0c.c
32915--- linux-2.6.39.1/drivers/media/video/rj54n1cb0c.c 2011-05-19 00:06:34.000000000 -0400
32916+++ linux-2.6.39.1/drivers/media/video/rj54n1cb0c.c 2011-05-22 19:36:31.000000000 -0400
32917@@ -1327,7 +1327,7 @@ static int rj54n1_s_ctrl(struct v4l2_sub
32918 return 0;
32919 }
32920
32921-static struct v4l2_subdev_core_ops rj54n1_subdev_core_ops = {
32922+static const struct v4l2_subdev_core_ops rj54n1_subdev_core_ops = {
32923 .g_ctrl = rj54n1_g_ctrl,
32924 .s_ctrl = rj54n1_s_ctrl,
32925 .g_chip_ident = rj54n1_g_chip_ident,
32926@@ -1337,7 +1337,7 @@ static struct v4l2_subdev_core_ops rj54n
32927 #endif
32928 };
32929
32930-static struct v4l2_subdev_video_ops rj54n1_subdev_video_ops = {
32931+static const struct v4l2_subdev_video_ops rj54n1_subdev_video_ops = {
32932 .s_stream = rj54n1_s_stream,
32933 .s_mbus_fmt = rj54n1_s_fmt,
32934 .g_mbus_fmt = rj54n1_g_fmt,
32935diff -urNp linux-2.6.39.1/drivers/media/video/s5p-fimc/fimc-capture.c linux-2.6.39.1/drivers/media/video/s5p-fimc/fimc-capture.c
32936--- linux-2.6.39.1/drivers/media/video/s5p-fimc/fimc-capture.c 2011-05-19 00:06:34.000000000 -0400
32937+++ linux-2.6.39.1/drivers/media/video/s5p-fimc/fimc-capture.c 2011-05-22 19:36:31.000000000 -0400
32938@@ -376,7 +376,7 @@ static void fimc_unlock(struct vb2_queue
32939 mutex_unlock(&ctx->fimc_dev->lock);
32940 }
32941
32942-static struct vb2_ops fimc_capture_qops = {
32943+static const struct vb2_ops fimc_capture_qops = {
32944 .queue_setup = queue_setup,
32945 .buf_prepare = buffer_prepare,
32946 .buf_queue = buffer_queue,
32947diff -urNp linux-2.6.39.1/drivers/media/video/s5p-fimc/fimc-core.c linux-2.6.39.1/drivers/media/video/s5p-fimc/fimc-core.c
32948--- linux-2.6.39.1/drivers/media/video/s5p-fimc/fimc-core.c 2011-05-19 00:06:34.000000000 -0400
32949+++ linux-2.6.39.1/drivers/media/video/s5p-fimc/fimc-core.c 2011-05-22 19:36:31.000000000 -0400
32950@@ -768,7 +768,7 @@ static void fimc_unlock(struct vb2_queue
32951 mutex_unlock(&ctx->fimc_dev->lock);
32952 }
32953
32954-static struct vb2_ops fimc_qops = {
32955+static const struct vb2_ops fimc_qops = {
32956 .queue_setup = fimc_queue_setup,
32957 .buf_prepare = fimc_buf_prepare,
32958 .buf_queue = fimc_buf_queue,
32959diff -urNp linux-2.6.39.1/drivers/media/video/saa7134/saa6752hs.c linux-2.6.39.1/drivers/media/video/saa7134/saa6752hs.c
32960--- linux-2.6.39.1/drivers/media/video/saa7134/saa6752hs.c 2011-05-19 00:06:34.000000000 -0400
32961+++ linux-2.6.39.1/drivers/media/video/saa7134/saa6752hs.c 2011-05-22 19:36:31.000000000 -0400
32962@@ -682,6 +682,8 @@ static int saa6752hs_init(struct v4l2_su
32963 unsigned char localPAT[256];
32964 unsigned char localPMT[256];
32965
32966+ pax_track_stack();
32967+
32968 /* Set video format - must be done first as it resets other settings */
32969 set_reg8(client, 0x41, h->video_format);
32970
32971diff -urNp linux-2.6.39.1/drivers/media/video/saa7134/saa7134-alsa.c linux-2.6.39.1/drivers/media/video/saa7134/saa7134-alsa.c
32972--- linux-2.6.39.1/drivers/media/video/saa7134/saa7134-alsa.c 2011-05-19 00:06:34.000000000 -0400
32973+++ linux-2.6.39.1/drivers/media/video/saa7134/saa7134-alsa.c 2011-05-22 19:36:31.000000000 -0400
32974@@ -808,7 +808,7 @@ static struct page *snd_card_saa7134_pag
32975 * ALSA capture callbacks definition
32976 */
32977
32978-static struct snd_pcm_ops snd_card_saa7134_capture_ops = {
32979+static const struct snd_pcm_ops snd_card_saa7134_capture_ops = {
32980 .open = snd_card_saa7134_capture_open,
32981 .close = snd_card_saa7134_capture_close,
32982 .ioctl = snd_pcm_lib_ioctl,
32983diff -urNp linux-2.6.39.1/drivers/media/video/saa7164/saa7164-cmd.c linux-2.6.39.1/drivers/media/video/saa7164/saa7164-cmd.c
32984--- linux-2.6.39.1/drivers/media/video/saa7164/saa7164-cmd.c 2011-05-19 00:06:34.000000000 -0400
32985+++ linux-2.6.39.1/drivers/media/video/saa7164/saa7164-cmd.c 2011-05-22 19:36:31.000000000 -0400
32986@@ -88,6 +88,8 @@ int saa7164_irq_dequeue(struct saa7164_d
32987 u8 tmp[512];
32988 dprintk(DBGLVL_CMD, "%s()\n", __func__);
32989
32990+ pax_track_stack();
32991+
32992 /* While any outstand message on the bus exists... */
32993 do {
32994
32995@@ -141,6 +143,8 @@ int saa7164_cmd_dequeue(struct saa7164_d
32996 u8 tmp[512];
32997 dprintk(DBGLVL_CMD, "%s()\n", __func__);
32998
32999+ pax_track_stack();
33000+
33001 while (loop) {
33002
33003 struct tmComResInfo tRsp = { 0, 0, 0, 0, 0, 0 };
33004diff -urNp linux-2.6.39.1/drivers/media/video/sh_mobile_csi2.c linux-2.6.39.1/drivers/media/video/sh_mobile_csi2.c
33005--- linux-2.6.39.1/drivers/media/video/sh_mobile_csi2.c 2011-05-19 00:06:34.000000000 -0400
33006+++ linux-2.6.39.1/drivers/media/video/sh_mobile_csi2.c 2011-05-22 19:36:31.000000000 -0400
33007@@ -127,12 +127,12 @@ static int sh_csi2_s_fmt(struct v4l2_sub
33008 return 0;
33009 }
33010
33011-static struct v4l2_subdev_video_ops sh_csi2_subdev_video_ops = {
33012+static const struct v4l2_subdev_video_ops sh_csi2_subdev_video_ops = {
33013 .s_mbus_fmt = sh_csi2_s_fmt,
33014 .try_mbus_fmt = sh_csi2_try_fmt,
33015 };
33016
33017-static struct v4l2_subdev_core_ops sh_csi2_subdev_core_ops;
33018+static const struct v4l2_subdev_core_ops sh_csi2_subdev_core_ops;
33019
33020 static struct v4l2_subdev_ops sh_csi2_subdev_ops = {
33021 .core = &sh_csi2_subdev_core_ops,
33022diff -urNp linux-2.6.39.1/drivers/media/video/soc_camera_platform.c linux-2.6.39.1/drivers/media/video/soc_camera_platform.c
33023--- linux-2.6.39.1/drivers/media/video/soc_camera_platform.c 2011-05-19 00:06:34.000000000 -0400
33024+++ linux-2.6.39.1/drivers/media/video/soc_camera_platform.c 2011-05-22 19:36:31.000000000 -0400
33025@@ -70,7 +70,7 @@ static int soc_camera_platform_fill_fmt(
33026 return 0;
33027 }
33028
33029-static struct v4l2_subdev_core_ops platform_subdev_core_ops;
33030+static const struct v4l2_subdev_core_ops platform_subdev_core_ops;
33031
33032 static int soc_camera_platform_enum_fmt(struct v4l2_subdev *sd, unsigned int index,
33033 enum v4l2_mbus_pixelcode *code)
33034@@ -115,7 +115,7 @@ static int soc_camera_platform_cropcap(s
33035 return 0;
33036 }
33037
33038-static struct v4l2_subdev_video_ops platform_subdev_video_ops = {
33039+static const struct v4l2_subdev_video_ops platform_subdev_video_ops = {
33040 .s_stream = soc_camera_platform_s_stream,
33041 .enum_mbus_fmt = soc_camera_platform_enum_fmt,
33042 .cropcap = soc_camera_platform_cropcap,
33043diff -urNp linux-2.6.39.1/drivers/media/video/tlg2300/pd-alsa.c linux-2.6.39.1/drivers/media/video/tlg2300/pd-alsa.c
33044--- linux-2.6.39.1/drivers/media/video/tlg2300/pd-alsa.c 2011-05-19 00:06:34.000000000 -0400
33045+++ linux-2.6.39.1/drivers/media/video/tlg2300/pd-alsa.c 2011-05-22 19:36:31.000000000 -0400
33046@@ -265,7 +265,7 @@ static struct page *snd_pcm_pd_get_page(
33047 return vmalloc_to_page(pageptr);
33048 }
33049
33050-static struct snd_pcm_ops pcm_capture_ops = {
33051+static const struct snd_pcm_ops pcm_capture_ops = {
33052 .open = snd_pd_capture_open,
33053 .close = snd_pd_pcm_close,
33054 .ioctl = snd_pcm_lib_ioctl,
33055diff -urNp linux-2.6.39.1/drivers/media/video/tw9910.c linux-2.6.39.1/drivers/media/video/tw9910.c
33056--- linux-2.6.39.1/drivers/media/video/tw9910.c 2011-05-19 00:06:34.000000000 -0400
33057+++ linux-2.6.39.1/drivers/media/video/tw9910.c 2011-05-22 19:36:31.000000000 -0400
33058@@ -894,7 +894,7 @@ static struct soc_camera_ops tw9910_ops
33059 .enum_input = tw9910_enum_input,
33060 };
33061
33062-static struct v4l2_subdev_core_ops tw9910_subdev_core_ops = {
33063+static const struct v4l2_subdev_core_ops tw9910_subdev_core_ops = {
33064 .g_chip_ident = tw9910_g_chip_ident,
33065 .s_std = tw9910_s_std,
33066 #ifdef CONFIG_VIDEO_ADV_DEBUG
33067@@ -913,7 +913,7 @@ static int tw9910_enum_fmt(struct v4l2_s
33068 return 0;
33069 }
33070
33071-static struct v4l2_subdev_video_ops tw9910_subdev_video_ops = {
33072+static const struct v4l2_subdev_video_ops tw9910_subdev_video_ops = {
33073 .s_stream = tw9910_s_stream,
33074 .g_mbus_fmt = tw9910_g_fmt,
33075 .s_mbus_fmt = tw9910_s_fmt,
33076diff -urNp linux-2.6.39.1/drivers/media/video/usbvision/usbvision-core.c linux-2.6.39.1/drivers/media/video/usbvision/usbvision-core.c
33077--- linux-2.6.39.1/drivers/media/video/usbvision/usbvision-core.c 2011-05-19 00:06:34.000000000 -0400
33078+++ linux-2.6.39.1/drivers/media/video/usbvision/usbvision-core.c 2011-05-22 19:36:31.000000000 -0400
33079@@ -799,6 +799,8 @@ static enum parse_state usbvision_parse_
33080 unsigned char rv, gv, bv;
33081 static unsigned char *Y, *U, *V;
33082
33083+ pax_track_stack();
33084+
33085 frame = usbvision->cur_frame;
33086 image_size = frame->frmwidth * frame->frmheight;
33087 if ((frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
33088diff -urNp linux-2.6.39.1/drivers/media/video/usbvision/usbvision-i2c.c linux-2.6.39.1/drivers/media/video/usbvision/usbvision-i2c.c
33089--- linux-2.6.39.1/drivers/media/video/usbvision/usbvision-i2c.c 2011-05-19 00:06:34.000000000 -0400
33090+++ linux-2.6.39.1/drivers/media/video/usbvision/usbvision-i2c.c 2011-05-22 19:36:31.000000000 -0400
33091@@ -189,7 +189,7 @@ static u32 functionality(struct i2c_adap
33092
33093 /* -----exported algorithm data: ------------------------------------- */
33094
33095-static struct i2c_algorithm usbvision_algo = {
33096+static const struct i2c_algorithm usbvision_algo = {
33097 .master_xfer = usbvision_i2c_xfer,
33098 .smbus_xfer = NULL,
33099 .functionality = functionality,
33100diff -urNp linux-2.6.39.1/drivers/media/video/v4l2-device.c linux-2.6.39.1/drivers/media/video/v4l2-device.c
33101--- linux-2.6.39.1/drivers/media/video/v4l2-device.c 2011-05-19 00:06:34.000000000 -0400
33102+++ linux-2.6.39.1/drivers/media/video/v4l2-device.c 2011-05-22 19:36:31.000000000 -0400
33103@@ -71,9 +71,9 @@ int v4l2_device_put(struct v4l2_device *
33104 EXPORT_SYMBOL_GPL(v4l2_device_put);
33105
33106 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
33107- atomic_t *instance)
33108+ atomic_unchecked_t *instance)
33109 {
33110- int num = atomic_inc_return(instance) - 1;
33111+ int num = atomic_inc_return_unchecked(instance) - 1;
33112 int len = strlen(basename);
33113
33114 if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
33115diff -urNp linux-2.6.39.1/drivers/media/video/videobuf-dma-sg.c linux-2.6.39.1/drivers/media/video/videobuf-dma-sg.c
33116--- linux-2.6.39.1/drivers/media/video/videobuf-dma-sg.c 2011-05-19 00:06:34.000000000 -0400
33117+++ linux-2.6.39.1/drivers/media/video/videobuf-dma-sg.c 2011-05-22 19:36:31.000000000 -0400
33118@@ -606,6 +606,8 @@ void *videobuf_sg_alloc(size_t size)
33119 {
33120 struct videobuf_queue q;
33121
33122+ pax_track_stack();
33123+
33124 /* Required to make generic handler to call __videobuf_alloc */
33125 q.int_ops = &sg_ops;
33126
33127diff -urNp linux-2.6.39.1/drivers/message/fusion/mptbase.c linux-2.6.39.1/drivers/message/fusion/mptbase.c
33128--- linux-2.6.39.1/drivers/message/fusion/mptbase.c 2011-05-19 00:06:34.000000000 -0400
33129+++ linux-2.6.39.1/drivers/message/fusion/mptbase.c 2011-05-22 19:41:37.000000000 -0400
33130@@ -143,7 +143,7 @@ static int MptDriverClass[MPT_MAX_PRO
33131 static MPT_EVHANDLER MptEvHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33132 /* Reset handler lookup table */
33133 static MPT_RESETHANDLER MptResetHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33134-static struct mpt_pci_driver *MptDeviceDriverHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33135+static const struct mpt_pci_driver *MptDeviceDriverHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33136
33137 #ifdef CONFIG_PROC_FS
33138 static struct proc_dir_entry *mpt_proc_root_dir;
33139@@ -772,7 +772,7 @@ mpt_reset_deregister(u8 cb_idx)
33140 * @cb_idx: MPT protocol driver index
33141 */
33142 int
33143-mpt_device_driver_register(struct mpt_pci_driver * dd_cbfunc, u8 cb_idx)
33144+mpt_device_driver_register(const struct mpt_pci_driver * dd_cbfunc, u8 cb_idx)
33145 {
33146 MPT_ADAPTER *ioc;
33147 const struct pci_device_id *id;
33148@@ -801,7 +801,7 @@ mpt_device_driver_register(struct mpt_pc
33149 void
33150 mpt_device_driver_deregister(u8 cb_idx)
33151 {
33152- struct mpt_pci_driver *dd_cbfunc;
33153+ const struct mpt_pci_driver *dd_cbfunc;
33154 MPT_ADAPTER *ioc;
33155
33156 if (!cb_idx || cb_idx >= MPT_MAX_PROTOCOL_DRIVERS)
33157@@ -6683,8 +6683,13 @@ static int mpt_iocinfo_proc_show(struct
33158 seq_printf(m, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
33159 seq_printf(m, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
33160
33161+#ifdef CONFIG_GRKERNSEC_HIDESYM
33162+ seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n", NULL, NULL);
33163+#else
33164 seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
33165 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
33166+#endif
33167+
33168 /*
33169 * Rounding UP to nearest 4-kB boundary here...
33170 */
33171diff -urNp linux-2.6.39.1/drivers/message/fusion/mptbase.h linux-2.6.39.1/drivers/message/fusion/mptbase.h
33172--- linux-2.6.39.1/drivers/message/fusion/mptbase.h 2011-05-19 00:06:34.000000000 -0400
33173+++ linux-2.6.39.1/drivers/message/fusion/mptbase.h 2011-05-22 19:36:31.000000000 -0400
33174@@ -908,7 +908,7 @@ extern int mpt_event_register(u8 cb_idx
33175 extern void mpt_event_deregister(u8 cb_idx);
33176 extern int mpt_reset_register(u8 cb_idx, MPT_RESETHANDLER reset_func);
33177 extern void mpt_reset_deregister(u8 cb_idx);
33178-extern int mpt_device_driver_register(struct mpt_pci_driver * dd_cbfunc, u8 cb_idx);
33179+extern int mpt_device_driver_register(const struct mpt_pci_driver * dd_cbfunc, u8 cb_idx);
33180 extern void mpt_device_driver_deregister(u8 cb_idx);
33181 extern MPT_FRAME_HDR *mpt_get_msg_frame(u8 cb_idx, MPT_ADAPTER *ioc);
33182 extern void mpt_free_msg_frame(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf);
33183diff -urNp linux-2.6.39.1/drivers/message/fusion/mptctl.c linux-2.6.39.1/drivers/message/fusion/mptctl.c
33184--- linux-2.6.39.1/drivers/message/fusion/mptctl.c 2011-05-19 00:06:34.000000000 -0400
33185+++ linux-2.6.39.1/drivers/message/fusion/mptctl.c 2011-05-22 19:36:31.000000000 -0400
33186@@ -3000,7 +3000,7 @@ mptctl_remove(struct pci_dev *pdev)
33187 {
33188 }
33189
33190-static struct mpt_pci_driver mptctl_driver = {
33191+static const struct mpt_pci_driver mptctl_driver = {
33192 .probe = mptctl_probe,
33193 .remove = mptctl_remove,
33194 };
33195diff -urNp linux-2.6.39.1/drivers/message/fusion/mptsas.c linux-2.6.39.1/drivers/message/fusion/mptsas.c
33196--- linux-2.6.39.1/drivers/message/fusion/mptsas.c 2011-05-19 00:06:34.000000000 -0400
33197+++ linux-2.6.39.1/drivers/message/fusion/mptsas.c 2011-05-22 19:36:31.000000000 -0400
33198@@ -439,6 +439,23 @@ mptsas_is_end_device(struct mptsas_devin
33199 return 0;
33200 }
33201
33202+static inline void
33203+mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
33204+{
33205+ if (phy_info->port_details) {
33206+ phy_info->port_details->rphy = rphy;
33207+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
33208+ ioc->name, rphy));
33209+ }
33210+
33211+ if (rphy) {
33212+ dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
33213+ &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
33214+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
33215+ ioc->name, rphy, rphy->dev.release));
33216+ }
33217+}
33218+
33219 /* no mutex */
33220 static void
33221 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
33222@@ -477,23 +494,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p
33223 return NULL;
33224 }
33225
33226-static inline void
33227-mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
33228-{
33229- if (phy_info->port_details) {
33230- phy_info->port_details->rphy = rphy;
33231- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
33232- ioc->name, rphy));
33233- }
33234-
33235- if (rphy) {
33236- dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
33237- &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
33238- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
33239- ioc->name, rphy, rphy->dev.release));
33240- }
33241-}
33242-
33243 static inline struct sas_port *
33244 mptsas_get_port(struct mptsas_phyinfo *phy_info)
33245 {
33246diff -urNp linux-2.6.39.1/drivers/message/fusion/mptscsih.c linux-2.6.39.1/drivers/message/fusion/mptscsih.c
33247--- linux-2.6.39.1/drivers/message/fusion/mptscsih.c 2011-05-19 00:06:34.000000000 -0400
33248+++ linux-2.6.39.1/drivers/message/fusion/mptscsih.c 2011-05-22 19:36:31.000000000 -0400
33249@@ -1268,15 +1268,16 @@ mptscsih_info(struct Scsi_Host *SChost)
33250
33251 h = shost_priv(SChost);
33252
33253- if (h) {
33254- if (h->info_kbuf == NULL)
33255- if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
33256- return h->info_kbuf;
33257- h->info_kbuf[0] = '\0';
33258+ if (!h)
33259+ return NULL;
33260
33261- mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
33262- h->info_kbuf[size-1] = '\0';
33263- }
33264+ if (h->info_kbuf == NULL)
33265+ if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
33266+ return h->info_kbuf;
33267+ h->info_kbuf[0] = '\0';
33268+
33269+ mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
33270+ h->info_kbuf[size-1] = '\0';
33271
33272 return h->info_kbuf;
33273 }
33274diff -urNp linux-2.6.39.1/drivers/message/i2o/i2o_config.c linux-2.6.39.1/drivers/message/i2o/i2o_config.c
33275--- linux-2.6.39.1/drivers/message/i2o/i2o_config.c 2011-05-19 00:06:34.000000000 -0400
33276+++ linux-2.6.39.1/drivers/message/i2o/i2o_config.c 2011-05-22 19:36:31.000000000 -0400
33277@@ -781,6 +781,8 @@ static int i2o_cfg_passthru(unsigned lon
33278 struct i2o_message *msg;
33279 unsigned int iop;
33280
33281+ pax_track_stack();
33282+
33283 if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
33284 return -EFAULT;
33285
33286diff -urNp linux-2.6.39.1/drivers/message/i2o/i2o_proc.c linux-2.6.39.1/drivers/message/i2o/i2o_proc.c
33287--- linux-2.6.39.1/drivers/message/i2o/i2o_proc.c 2011-05-19 00:06:34.000000000 -0400
33288+++ linux-2.6.39.1/drivers/message/i2o/i2o_proc.c 2011-05-22 19:36:31.000000000 -0400
33289@@ -255,13 +255,6 @@ static char *scsi_devices[] = {
33290 "Array Controller Device"
33291 };
33292
33293-static char *chtostr(u8 * chars, int n)
33294-{
33295- char tmp[256];
33296- tmp[0] = 0;
33297- return strncat(tmp, (char *)chars, n);
33298-}
33299-
33300 static int i2o_report_query_status(struct seq_file *seq, int block_status,
33301 char *group)
33302 {
33303@@ -838,8 +831,7 @@ static int i2o_seq_show_ddm_table(struct
33304
33305 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
33306 seq_printf(seq, "%-#8x", ddm_table.module_id);
33307- seq_printf(seq, "%-29s",
33308- chtostr(ddm_table.module_name_version, 28));
33309+ seq_printf(seq, "%-.28s", ddm_table.module_name_version);
33310 seq_printf(seq, "%9d ", ddm_table.data_size);
33311 seq_printf(seq, "%8d", ddm_table.code_size);
33312
33313@@ -940,8 +932,8 @@ static int i2o_seq_show_drivers_stored(s
33314
33315 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
33316 seq_printf(seq, "%-#8x", dst->module_id);
33317- seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
33318- seq_printf(seq, "%-9s", chtostr(dst->date, 8));
33319+ seq_printf(seq, "%-.28s", dst->module_name_version);
33320+ seq_printf(seq, "%-.8s", dst->date);
33321 seq_printf(seq, "%8d ", dst->module_size);
33322 seq_printf(seq, "%8d ", dst->mpb_size);
33323 seq_printf(seq, "0x%04x", dst->module_flags);
33324@@ -1272,14 +1264,10 @@ static int i2o_seq_show_dev_identity(str
33325 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
33326 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
33327 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
33328- seq_printf(seq, "Vendor info : %s\n",
33329- chtostr((u8 *) (work32 + 2), 16));
33330- seq_printf(seq, "Product info : %s\n",
33331- chtostr((u8 *) (work32 + 6), 16));
33332- seq_printf(seq, "Description : %s\n",
33333- chtostr((u8 *) (work32 + 10), 16));
33334- seq_printf(seq, "Product rev. : %s\n",
33335- chtostr((u8 *) (work32 + 14), 8));
33336+ seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
33337+ seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
33338+ seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
33339+ seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
33340
33341 seq_printf(seq, "Serial number : ");
33342 print_serial_number(seq, (u8 *) (work32 + 16),
33343@@ -1324,10 +1312,8 @@ static int i2o_seq_show_ddm_identity(str
33344 }
33345
33346 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
33347- seq_printf(seq, "Module name : %s\n",
33348- chtostr(result.module_name, 24));
33349- seq_printf(seq, "Module revision : %s\n",
33350- chtostr(result.module_rev, 8));
33351+ seq_printf(seq, "Module name : %.24s\n", result.module_name);
33352+ seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
33353
33354 seq_printf(seq, "Serial number : ");
33355 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
33356@@ -1358,14 +1344,10 @@ static int i2o_seq_show_uinfo(struct seq
33357 return 0;
33358 }
33359
33360- seq_printf(seq, "Device name : %s\n",
33361- chtostr(result.device_name, 64));
33362- seq_printf(seq, "Service name : %s\n",
33363- chtostr(result.service_name, 64));
33364- seq_printf(seq, "Physical name : %s\n",
33365- chtostr(result.physical_location, 64));
33366- seq_printf(seq, "Instance number : %s\n",
33367- chtostr(result.instance_number, 4));
33368+ seq_printf(seq, "Device name : %.64s\n", result.device_name);
33369+ seq_printf(seq, "Service name : %.64s\n", result.service_name);
33370+ seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
33371+ seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
33372
33373 return 0;
33374 }
33375diff -urNp linux-2.6.39.1/drivers/message/i2o/iop.c linux-2.6.39.1/drivers/message/i2o/iop.c
33376--- linux-2.6.39.1/drivers/message/i2o/iop.c 2011-05-19 00:06:34.000000000 -0400
33377+++ linux-2.6.39.1/drivers/message/i2o/iop.c 2011-05-22 19:36:31.000000000 -0400
33378@@ -111,10 +111,10 @@ u32 i2o_cntxt_list_add(struct i2o_contro
33379
33380 spin_lock_irqsave(&c->context_list_lock, flags);
33381
33382- if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
33383- atomic_inc(&c->context_list_counter);
33384+ if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
33385+ atomic_inc_unchecked(&c->context_list_counter);
33386
33387- entry->context = atomic_read(&c->context_list_counter);
33388+ entry->context = atomic_read_unchecked(&c->context_list_counter);
33389
33390 list_add(&entry->list, &c->context_list);
33391
33392@@ -1077,7 +1077,7 @@ struct i2o_controller *i2o_iop_alloc(voi
33393
33394 #if BITS_PER_LONG == 64
33395 spin_lock_init(&c->context_list_lock);
33396- atomic_set(&c->context_list_counter, 0);
33397+ atomic_set_unchecked(&c->context_list_counter, 0);
33398 INIT_LIST_HEAD(&c->context_list);
33399 #endif
33400
33401diff -urNp linux-2.6.39.1/drivers/mfd/ab3100-core.c linux-2.6.39.1/drivers/mfd/ab3100-core.c
33402--- linux-2.6.39.1/drivers/mfd/ab3100-core.c 2011-05-19 00:06:34.000000000 -0400
33403+++ linux-2.6.39.1/drivers/mfd/ab3100-core.c 2011-05-22 19:36:31.000000000 -0400
33404@@ -385,7 +385,7 @@ static int ab3100_event_registers_startu
33405 return 0;
33406 }
33407
33408-static struct abx500_ops ab3100_ops = {
33409+static const struct abx500_ops ab3100_ops = {
33410 .get_chip_id = ab3100_get_chip_id,
33411 .set_register = set_register_interruptible,
33412 .get_register = get_register_interruptible,
33413diff -urNp linux-2.6.39.1/drivers/mfd/ab3550-core.c linux-2.6.39.1/drivers/mfd/ab3550-core.c
33414--- linux-2.6.39.1/drivers/mfd/ab3550-core.c 2011-05-19 00:06:34.000000000 -0400
33415+++ linux-2.6.39.1/drivers/mfd/ab3550-core.c 2011-05-22 19:36:31.000000000 -0400
33416@@ -676,7 +676,7 @@ static int ab3550_startup_irq_enabled(st
33417 return val;
33418 }
33419
33420-static struct abx500_ops ab3550_ops = {
33421+static const struct abx500_ops ab3550_ops = {
33422 .get_chip_id = ab3550_get_chip_id,
33423 .get_register = ab3550_get_register_interruptible,
33424 .set_register = ab3550_set_register_interruptible,
33425diff -urNp linux-2.6.39.1/drivers/mfd/ab8500-core.c linux-2.6.39.1/drivers/mfd/ab8500-core.c
33426--- linux-2.6.39.1/drivers/mfd/ab8500-core.c 2011-05-19 00:06:34.000000000 -0400
33427+++ linux-2.6.39.1/drivers/mfd/ab8500-core.c 2011-05-22 19:36:31.000000000 -0400
33428@@ -223,7 +223,7 @@ static int ab8500_mask_and_set_register(
33429
33430 }
33431
33432-static struct abx500_ops ab8500_ops = {
33433+static const struct abx500_ops ab8500_ops = {
33434 .get_chip_id = ab8500_get_chip_id,
33435 .get_register = ab8500_get_register,
33436 .set_register = ab8500_set_register,
33437diff -urNp linux-2.6.39.1/drivers/mfd/abx500-core.c linux-2.6.39.1/drivers/mfd/abx500-core.c
33438--- linux-2.6.39.1/drivers/mfd/abx500-core.c 2011-05-19 00:06:34.000000000 -0400
33439+++ linux-2.6.39.1/drivers/mfd/abx500-core.c 2011-05-22 19:36:31.000000000 -0400
33440@@ -18,7 +18,7 @@ struct abx500_device_entry {
33441 struct device *dev;
33442 };
33443
33444-static void lookup_ops(struct device *dev, struct abx500_ops **ops)
33445+static void lookup_ops(struct device *dev, const struct abx500_ops **ops)
33446 {
33447 struct abx500_device_entry *dev_entry;
33448
33449@@ -31,7 +31,7 @@ static void lookup_ops(struct device *de
33450 }
33451 }
33452
33453-int abx500_register_ops(struct device *dev, struct abx500_ops *ops)
33454+int abx500_register_ops(struct device *dev, const struct abx500_ops *ops)
33455 {
33456 struct abx500_device_entry *dev_entry;
33457
33458@@ -65,7 +65,7 @@ EXPORT_SYMBOL(abx500_remove_ops);
33459 int abx500_set_register_interruptible(struct device *dev, u8 bank, u8 reg,
33460 u8 value)
33461 {
33462- struct abx500_ops *ops;
33463+ const struct abx500_ops *ops;
33464
33465 lookup_ops(dev->parent, &ops);
33466 if ((ops != NULL) && (ops->set_register != NULL))
33467@@ -78,7 +78,7 @@ EXPORT_SYMBOL(abx500_set_register_interr
33468 int abx500_get_register_interruptible(struct device *dev, u8 bank, u8 reg,
33469 u8 *value)
33470 {
33471- struct abx500_ops *ops;
33472+ const struct abx500_ops *ops;
33473
33474 lookup_ops(dev->parent, &ops);
33475 if ((ops != NULL) && (ops->get_register != NULL))
33476@@ -91,7 +91,7 @@ EXPORT_SYMBOL(abx500_get_register_interr
33477 int abx500_get_register_page_interruptible(struct device *dev, u8 bank,
33478 u8 first_reg, u8 *regvals, u8 numregs)
33479 {
33480- struct abx500_ops *ops;
33481+ const struct abx500_ops *ops;
33482
33483 lookup_ops(dev->parent, &ops);
33484 if ((ops != NULL) && (ops->get_register_page != NULL))
33485@@ -105,7 +105,7 @@ EXPORT_SYMBOL(abx500_get_register_page_i
33486 int abx500_mask_and_set_register_interruptible(struct device *dev, u8 bank,
33487 u8 reg, u8 bitmask, u8 bitvalues)
33488 {
33489- struct abx500_ops *ops;
33490+ const struct abx500_ops *ops;
33491
33492 lookup_ops(dev->parent, &ops);
33493 if ((ops != NULL) && (ops->mask_and_set_register != NULL))
33494@@ -118,7 +118,7 @@ EXPORT_SYMBOL(abx500_mask_and_set_regist
33495
33496 int abx500_get_chip_id(struct device *dev)
33497 {
33498- struct abx500_ops *ops;
33499+ const struct abx500_ops *ops;
33500
33501 lookup_ops(dev->parent, &ops);
33502 if ((ops != NULL) && (ops->get_chip_id != NULL))
33503@@ -130,7 +130,7 @@ EXPORT_SYMBOL(abx500_get_chip_id);
33504
33505 int abx500_event_registers_startup_state_get(struct device *dev, u8 *event)
33506 {
33507- struct abx500_ops *ops;
33508+ const struct abx500_ops *ops;
33509
33510 lookup_ops(dev->parent, &ops);
33511 if ((ops != NULL) && (ops->event_registers_startup_state_get != NULL))
33512@@ -142,7 +142,7 @@ EXPORT_SYMBOL(abx500_event_registers_sta
33513
33514 int abx500_startup_irq_enabled(struct device *dev, unsigned int irq)
33515 {
33516- struct abx500_ops *ops;
33517+ const struct abx500_ops *ops;
33518
33519 lookup_ops(dev->parent, &ops);
33520 if ((ops != NULL) && (ops->startup_irq_enabled != NULL))
33521diff -urNp linux-2.6.39.1/drivers/mfd/janz-cmodio.c linux-2.6.39.1/drivers/mfd/janz-cmodio.c
33522--- linux-2.6.39.1/drivers/mfd/janz-cmodio.c 2011-05-19 00:06:34.000000000 -0400
33523+++ linux-2.6.39.1/drivers/mfd/janz-cmodio.c 2011-05-22 19:36:31.000000000 -0400
33524@@ -13,6 +13,7 @@
33525
33526 #include <linux/kernel.h>
33527 #include <linux/module.h>
33528+#include <linux/slab.h>
33529 #include <linux/init.h>
33530 #include <linux/pci.h>
33531 #include <linux/interrupt.h>
33532diff -urNp linux-2.6.39.1/drivers/mfd/mcp-sa11x0.c linux-2.6.39.1/drivers/mfd/mcp-sa11x0.c
33533--- linux-2.6.39.1/drivers/mfd/mcp-sa11x0.c 2011-05-19 00:06:34.000000000 -0400
33534+++ linux-2.6.39.1/drivers/mfd/mcp-sa11x0.c 2011-05-22 19:36:31.000000000 -0400
33535@@ -128,7 +128,7 @@ static void mcp_sa11x0_disable(struct mc
33536 /*
33537 * Our methods.
33538 */
33539-static struct mcp_ops mcp_sa11x0 = {
33540+static const struct mcp_ops mcp_sa11x0 = {
33541 .set_telecom_divisor = mcp_sa11x0_set_telecom_divisor,
33542 .set_audio_divisor = mcp_sa11x0_set_audio_divisor,
33543 .reg_write = mcp_sa11x0_write,
33544diff -urNp linux-2.6.39.1/drivers/mfd/wm8350-i2c.c linux-2.6.39.1/drivers/mfd/wm8350-i2c.c
33545--- linux-2.6.39.1/drivers/mfd/wm8350-i2c.c 2011-05-19 00:06:34.000000000 -0400
33546+++ linux-2.6.39.1/drivers/mfd/wm8350-i2c.c 2011-05-22 19:36:31.000000000 -0400
33547@@ -44,6 +44,8 @@ static int wm8350_i2c_write_device(struc
33548 u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
33549 int ret;
33550
33551+ pax_track_stack();
33552+
33553 if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
33554 return -EINVAL;
33555
33556diff -urNp linux-2.6.39.1/drivers/misc/enclosure.c linux-2.6.39.1/drivers/misc/enclosure.c
33557--- linux-2.6.39.1/drivers/misc/enclosure.c 2011-05-19 00:06:34.000000000 -0400
33558+++ linux-2.6.39.1/drivers/misc/enclosure.c 2011-05-22 19:36:31.000000000 -0400
33559@@ -161,7 +161,7 @@ enclosure_register(struct device *dev, c
33560 }
33561 EXPORT_SYMBOL_GPL(enclosure_register);
33562
33563-static struct enclosure_component_callbacks enclosure_null_callbacks;
33564+static const struct enclosure_component_callbacks enclosure_null_callbacks;
33565
33566 /**
33567 * enclosure_unregister - remove an enclosure
33568diff -urNp linux-2.6.39.1/drivers/misc/kgdbts.c linux-2.6.39.1/drivers/misc/kgdbts.c
33569--- linux-2.6.39.1/drivers/misc/kgdbts.c 2011-05-19 00:06:34.000000000 -0400
33570+++ linux-2.6.39.1/drivers/misc/kgdbts.c 2011-05-22 19:36:31.000000000 -0400
33571@@ -118,7 +118,7 @@
33572 } while (0)
33573 #define MAX_CONFIG_LEN 40
33574
33575-static struct kgdb_io kgdbts_io_ops;
33576+static const struct kgdb_io kgdbts_io_ops;
33577 static char get_buf[BUFMAX];
33578 static int get_buf_cnt;
33579 static char put_buf[BUFMAX];
33580@@ -1103,7 +1103,7 @@ static void kgdbts_post_exp_handler(void
33581 module_put(THIS_MODULE);
33582 }
33583
33584-static struct kgdb_io kgdbts_io_ops = {
33585+static const struct kgdb_io kgdbts_io_ops = {
33586 .name = "kgdbts",
33587 .read_char = kgdbts_get_char,
33588 .write_char = kgdbts_put_char,
33589diff -urNp linux-2.6.39.1/drivers/misc/lis3lv02d/lis3lv02d.c linux-2.6.39.1/drivers/misc/lis3lv02d/lis3lv02d.c
33590--- linux-2.6.39.1/drivers/misc/lis3lv02d/lis3lv02d.c 2011-05-19 00:06:34.000000000 -0400
33591+++ linux-2.6.39.1/drivers/misc/lis3lv02d/lis3lv02d.c 2011-05-22 19:36:31.000000000 -0400
33592@@ -435,7 +435,7 @@ static irqreturn_t lis302dl_interrupt(in
33593 * the lid is closed. This leads to interrupts as soon as a little move
33594 * is done.
33595 */
33596- atomic_inc(&lis3_dev.count);
33597+ atomic_inc_unchecked(&lis3_dev.count);
33598
33599 wake_up_interruptible(&lis3_dev.misc_wait);
33600 kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
33601@@ -518,7 +518,7 @@ static int lis3lv02d_misc_open(struct in
33602 if (lis3_dev.pm_dev)
33603 pm_runtime_get_sync(lis3_dev.pm_dev);
33604
33605- atomic_set(&lis3_dev.count, 0);
33606+ atomic_set_unchecked(&lis3_dev.count, 0);
33607 return 0;
33608 }
33609
33610@@ -545,7 +545,7 @@ static ssize_t lis3lv02d_misc_read(struc
33611 add_wait_queue(&lis3_dev.misc_wait, &wait);
33612 while (true) {
33613 set_current_state(TASK_INTERRUPTIBLE);
33614- data = atomic_xchg(&lis3_dev.count, 0);
33615+ data = atomic_xchg_unchecked(&lis3_dev.count, 0);
33616 if (data)
33617 break;
33618
33619@@ -583,7 +583,7 @@ out:
33620 static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
33621 {
33622 poll_wait(file, &lis3_dev.misc_wait, wait);
33623- if (atomic_read(&lis3_dev.count))
33624+ if (atomic_read_unchecked(&lis3_dev.count))
33625 return POLLIN | POLLRDNORM;
33626 return 0;
33627 }
33628diff -urNp linux-2.6.39.1/drivers/misc/lis3lv02d/lis3lv02d.h linux-2.6.39.1/drivers/misc/lis3lv02d/lis3lv02d.h
33629--- linux-2.6.39.1/drivers/misc/lis3lv02d/lis3lv02d.h 2011-05-19 00:06:34.000000000 -0400
33630+++ linux-2.6.39.1/drivers/misc/lis3lv02d/lis3lv02d.h 2011-05-22 19:36:31.000000000 -0400
33631@@ -265,7 +265,7 @@ struct lis3lv02d {
33632 struct input_polled_dev *idev; /* input device */
33633 struct platform_device *pdev; /* platform device */
33634 struct regulator_bulk_data regulators[2];
33635- atomic_t count; /* interrupt count after last read */
33636+ atomic_unchecked_t count; /* interrupt count after last read */
33637 union axis_conversion ac; /* hw -> logical axis */
33638 int mapped_btns[3];
33639
33640diff -urNp linux-2.6.39.1/drivers/misc/sgi-gru/gruhandles.c linux-2.6.39.1/drivers/misc/sgi-gru/gruhandles.c
33641--- linux-2.6.39.1/drivers/misc/sgi-gru/gruhandles.c 2011-05-19 00:06:34.000000000 -0400
33642+++ linux-2.6.39.1/drivers/misc/sgi-gru/gruhandles.c 2011-05-22 19:36:31.000000000 -0400
33643@@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op
33644 unsigned long nsec;
33645
33646 nsec = CLKS2NSEC(clks);
33647- atomic_long_inc(&mcs_op_statistics[op].count);
33648- atomic_long_add(nsec, &mcs_op_statistics[op].total);
33649+ atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
33650+ atomic_long_add_unchecked(nsec, &mcs_op_statistics[op].total);
33651 if (mcs_op_statistics[op].max < nsec)
33652 mcs_op_statistics[op].max = nsec;
33653 }
33654diff -urNp linux-2.6.39.1/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.39.1/drivers/misc/sgi-gru/gruprocfs.c
33655--- linux-2.6.39.1/drivers/misc/sgi-gru/gruprocfs.c 2011-05-19 00:06:34.000000000 -0400
33656+++ linux-2.6.39.1/drivers/misc/sgi-gru/gruprocfs.c 2011-05-22 19:36:31.000000000 -0400
33657@@ -32,9 +32,9 @@
33658
33659 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
33660
33661-static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
33662+static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
33663 {
33664- unsigned long val = atomic_long_read(v);
33665+ unsigned long val = atomic_long_read_unchecked(v);
33666
33667 seq_printf(s, "%16lu %s\n", val, id);
33668 }
33669@@ -134,8 +134,8 @@ static int mcs_statistics_show(struct se
33670
33671 seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
33672 for (op = 0; op < mcsop_last; op++) {
33673- count = atomic_long_read(&mcs_op_statistics[op].count);
33674- total = atomic_long_read(&mcs_op_statistics[op].total);
33675+ count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
33676+ total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
33677 max = mcs_op_statistics[op].max;
33678 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
33679 count ? total / count : 0, max);
33680diff -urNp linux-2.6.39.1/drivers/misc/sgi-gru/grutables.h linux-2.6.39.1/drivers/misc/sgi-gru/grutables.h
33681--- linux-2.6.39.1/drivers/misc/sgi-gru/grutables.h 2011-05-19 00:06:34.000000000 -0400
33682+++ linux-2.6.39.1/drivers/misc/sgi-gru/grutables.h 2011-05-22 19:36:31.000000000 -0400
33683@@ -167,82 +167,82 @@ extern unsigned int gru_max_gids;
33684 * GRU statistics.
33685 */
33686 struct gru_stats_s {
33687- atomic_long_t vdata_alloc;
33688- atomic_long_t vdata_free;
33689- atomic_long_t gts_alloc;
33690- atomic_long_t gts_free;
33691- atomic_long_t gms_alloc;
33692- atomic_long_t gms_free;
33693- atomic_long_t gts_double_allocate;
33694- atomic_long_t assign_context;
33695- atomic_long_t assign_context_failed;
33696- atomic_long_t free_context;
33697- atomic_long_t load_user_context;
33698- atomic_long_t load_kernel_context;
33699- atomic_long_t lock_kernel_context;
33700- atomic_long_t unlock_kernel_context;
33701- atomic_long_t steal_user_context;
33702- atomic_long_t steal_kernel_context;
33703- atomic_long_t steal_context_failed;
33704- atomic_long_t nopfn;
33705- atomic_long_t asid_new;
33706- atomic_long_t asid_next;
33707- atomic_long_t asid_wrap;
33708- atomic_long_t asid_reuse;
33709- atomic_long_t intr;
33710- atomic_long_t intr_cbr;
33711- atomic_long_t intr_tfh;
33712- atomic_long_t intr_spurious;
33713- atomic_long_t intr_mm_lock_failed;
33714- atomic_long_t call_os;
33715- atomic_long_t call_os_wait_queue;
33716- atomic_long_t user_flush_tlb;
33717- atomic_long_t user_unload_context;
33718- atomic_long_t user_exception;
33719- atomic_long_t set_context_option;
33720- atomic_long_t check_context_retarget_intr;
33721- atomic_long_t check_context_unload;
33722- atomic_long_t tlb_dropin;
33723- atomic_long_t tlb_preload_page;
33724- atomic_long_t tlb_dropin_fail_no_asid;
33725- atomic_long_t tlb_dropin_fail_upm;
33726- atomic_long_t tlb_dropin_fail_invalid;
33727- atomic_long_t tlb_dropin_fail_range_active;
33728- atomic_long_t tlb_dropin_fail_idle;
33729- atomic_long_t tlb_dropin_fail_fmm;
33730- atomic_long_t tlb_dropin_fail_no_exception;
33731- atomic_long_t tfh_stale_on_fault;
33732- atomic_long_t mmu_invalidate_range;
33733- atomic_long_t mmu_invalidate_page;
33734- atomic_long_t flush_tlb;
33735- atomic_long_t flush_tlb_gru;
33736- atomic_long_t flush_tlb_gru_tgh;
33737- atomic_long_t flush_tlb_gru_zero_asid;
33738-
33739- atomic_long_t copy_gpa;
33740- atomic_long_t read_gpa;
33741-
33742- atomic_long_t mesq_receive;
33743- atomic_long_t mesq_receive_none;
33744- atomic_long_t mesq_send;
33745- atomic_long_t mesq_send_failed;
33746- atomic_long_t mesq_noop;
33747- atomic_long_t mesq_send_unexpected_error;
33748- atomic_long_t mesq_send_lb_overflow;
33749- atomic_long_t mesq_send_qlimit_reached;
33750- atomic_long_t mesq_send_amo_nacked;
33751- atomic_long_t mesq_send_put_nacked;
33752- atomic_long_t mesq_page_overflow;
33753- atomic_long_t mesq_qf_locked;
33754- atomic_long_t mesq_qf_noop_not_full;
33755- atomic_long_t mesq_qf_switch_head_failed;
33756- atomic_long_t mesq_qf_unexpected_error;
33757- atomic_long_t mesq_noop_unexpected_error;
33758- atomic_long_t mesq_noop_lb_overflow;
33759- atomic_long_t mesq_noop_qlimit_reached;
33760- atomic_long_t mesq_noop_amo_nacked;
33761- atomic_long_t mesq_noop_put_nacked;
33762- atomic_long_t mesq_noop_page_overflow;
33763+ atomic_long_unchecked_t vdata_alloc;
33764+ atomic_long_unchecked_t vdata_free;
33765+ atomic_long_unchecked_t gts_alloc;
33766+ atomic_long_unchecked_t gts_free;
33767+ atomic_long_unchecked_t gms_alloc;
33768+ atomic_long_unchecked_t gms_free;
33769+ atomic_long_unchecked_t gts_double_allocate;
33770+ atomic_long_unchecked_t assign_context;
33771+ atomic_long_unchecked_t assign_context_failed;
33772+ atomic_long_unchecked_t free_context;
33773+ atomic_long_unchecked_t load_user_context;
33774+ atomic_long_unchecked_t load_kernel_context;
33775+ atomic_long_unchecked_t lock_kernel_context;
33776+ atomic_long_unchecked_t unlock_kernel_context;
33777+ atomic_long_unchecked_t steal_user_context;
33778+ atomic_long_unchecked_t steal_kernel_context;
33779+ atomic_long_unchecked_t steal_context_failed;
33780+ atomic_long_unchecked_t nopfn;
33781+ atomic_long_unchecked_t asid_new;
33782+ atomic_long_unchecked_t asid_next;
33783+ atomic_long_unchecked_t asid_wrap;
33784+ atomic_long_unchecked_t asid_reuse;
33785+ atomic_long_unchecked_t intr;
33786+ atomic_long_unchecked_t intr_cbr;
33787+ atomic_long_unchecked_t intr_tfh;
33788+ atomic_long_unchecked_t intr_spurious;
33789+ atomic_long_unchecked_t intr_mm_lock_failed;
33790+ atomic_long_unchecked_t call_os;
33791+ atomic_long_unchecked_t call_os_wait_queue;
33792+ atomic_long_unchecked_t user_flush_tlb;
33793+ atomic_long_unchecked_t user_unload_context;
33794+ atomic_long_unchecked_t user_exception;
33795+ atomic_long_unchecked_t set_context_option;
33796+ atomic_long_unchecked_t check_context_retarget_intr;
33797+ atomic_long_unchecked_t check_context_unload;
33798+ atomic_long_unchecked_t tlb_dropin;
33799+ atomic_long_unchecked_t tlb_preload_page;
33800+ atomic_long_unchecked_t tlb_dropin_fail_no_asid;
33801+ atomic_long_unchecked_t tlb_dropin_fail_upm;
33802+ atomic_long_unchecked_t tlb_dropin_fail_invalid;
33803+ atomic_long_unchecked_t tlb_dropin_fail_range_active;
33804+ atomic_long_unchecked_t tlb_dropin_fail_idle;
33805+ atomic_long_unchecked_t tlb_dropin_fail_fmm;
33806+ atomic_long_unchecked_t tlb_dropin_fail_no_exception;
33807+ atomic_long_unchecked_t tfh_stale_on_fault;
33808+ atomic_long_unchecked_t mmu_invalidate_range;
33809+ atomic_long_unchecked_t mmu_invalidate_page;
33810+ atomic_long_unchecked_t flush_tlb;
33811+ atomic_long_unchecked_t flush_tlb_gru;
33812+ atomic_long_unchecked_t flush_tlb_gru_tgh;
33813+ atomic_long_unchecked_t flush_tlb_gru_zero_asid;
33814+
33815+ atomic_long_unchecked_t copy_gpa;
33816+ atomic_long_unchecked_t read_gpa;
33817+
33818+ atomic_long_unchecked_t mesq_receive;
33819+ atomic_long_unchecked_t mesq_receive_none;
33820+ atomic_long_unchecked_t mesq_send;
33821+ atomic_long_unchecked_t mesq_send_failed;
33822+ atomic_long_unchecked_t mesq_noop;
33823+ atomic_long_unchecked_t mesq_send_unexpected_error;
33824+ atomic_long_unchecked_t mesq_send_lb_overflow;
33825+ atomic_long_unchecked_t mesq_send_qlimit_reached;
33826+ atomic_long_unchecked_t mesq_send_amo_nacked;
33827+ atomic_long_unchecked_t mesq_send_put_nacked;
33828+ atomic_long_unchecked_t mesq_page_overflow;
33829+ atomic_long_unchecked_t mesq_qf_locked;
33830+ atomic_long_unchecked_t mesq_qf_noop_not_full;
33831+ atomic_long_unchecked_t mesq_qf_switch_head_failed;
33832+ atomic_long_unchecked_t mesq_qf_unexpected_error;
33833+ atomic_long_unchecked_t mesq_noop_unexpected_error;
33834+ atomic_long_unchecked_t mesq_noop_lb_overflow;
33835+ atomic_long_unchecked_t mesq_noop_qlimit_reached;
33836+ atomic_long_unchecked_t mesq_noop_amo_nacked;
33837+ atomic_long_unchecked_t mesq_noop_put_nacked;
33838+ atomic_long_unchecked_t mesq_noop_page_overflow;
33839
33840 };
33841
33842@@ -251,8 +251,8 @@ enum mcs_op {cchop_allocate, cchop_start
33843 tghop_invalidate, mcsop_last};
33844
33845 struct mcs_op_statistic {
33846- atomic_long_t count;
33847- atomic_long_t total;
33848+ atomic_long_unchecked_t count;
33849+ atomic_long_unchecked_t total;
33850 unsigned long max;
33851 };
33852
33853@@ -275,7 +275,7 @@ extern struct mcs_op_statistic mcs_op_st
33854
33855 #define STAT(id) do { \
33856 if (gru_options & OPT_STATS) \
33857- atomic_long_inc(&gru_stats.id); \
33858+ atomic_long_inc_unchecked(&gru_stats.id); \
33859 } while (0)
33860
33861 #ifdef CONFIG_SGI_GRU_DEBUG
33862diff -urNp linux-2.6.39.1/drivers/misc/sgi-xp/xpc_sn2.c linux-2.6.39.1/drivers/misc/sgi-xp/xpc_sn2.c
33863--- linux-2.6.39.1/drivers/misc/sgi-xp/xpc_sn2.c 2011-05-19 00:06:34.000000000 -0400
33864+++ linux-2.6.39.1/drivers/misc/sgi-xp/xpc_sn2.c 2011-05-22 19:36:31.000000000 -0400
33865@@ -2351,7 +2351,7 @@ xpc_received_payload_sn2(struct xpc_chan
33866 xpc_acknowledge_msgs_sn2(ch, get, msg->flags);
33867 }
33868
33869-static struct xpc_arch_operations xpc_arch_ops_sn2 = {
33870+static const struct xpc_arch_operations xpc_arch_ops_sn2 = {
33871 .setup_partitions = xpc_setup_partitions_sn2,
33872 .teardown_partitions = xpc_teardown_partitions_sn2,
33873 .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_sn2,
33874diff -urNp linux-2.6.39.1/drivers/misc/sgi-xp/xpc_uv.c linux-2.6.39.1/drivers/misc/sgi-xp/xpc_uv.c
33875--- linux-2.6.39.1/drivers/misc/sgi-xp/xpc_uv.c 2011-05-19 00:06:34.000000000 -0400
33876+++ linux-2.6.39.1/drivers/misc/sgi-xp/xpc_uv.c 2011-05-22 19:36:31.000000000 -0400
33877@@ -1674,7 +1674,7 @@ xpc_received_payload_uv(struct xpc_chann
33878 XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
33879 }
33880
33881-static struct xpc_arch_operations xpc_arch_ops_uv = {
33882+static const struct xpc_arch_operations xpc_arch_ops_uv = {
33883 .setup_partitions = xpc_setup_partitions_uv,
33884 .teardown_partitions = xpc_teardown_partitions_uv,
33885 .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_uv,
33886diff -urNp linux-2.6.39.1/drivers/misc/spear13xx_pcie_gadget.c linux-2.6.39.1/drivers/misc/spear13xx_pcie_gadget.c
33887--- linux-2.6.39.1/drivers/misc/spear13xx_pcie_gadget.c 2011-05-19 00:06:34.000000000 -0400
33888+++ linux-2.6.39.1/drivers/misc/spear13xx_pcie_gadget.c 2011-05-22 19:36:31.000000000 -0400
33889@@ -644,7 +644,7 @@ static ssize_t pcie_gadget_target_attr_s
33890 return ret;
33891 }
33892
33893-static struct configfs_item_operations pcie_gadget_target_item_ops = {
33894+static const struct configfs_item_operations pcie_gadget_target_item_ops = {
33895 .show_attribute = pcie_gadget_target_attr_show,
33896 .store_attribute = pcie_gadget_target_attr_store,
33897 };
33898diff -urNp linux-2.6.39.1/drivers/mmc/host/davinci_mmc.c linux-2.6.39.1/drivers/mmc/host/davinci_mmc.c
33899--- linux-2.6.39.1/drivers/mmc/host/davinci_mmc.c 2011-05-19 00:06:34.000000000 -0400
33900+++ linux-2.6.39.1/drivers/mmc/host/davinci_mmc.c 2011-05-22 19:36:31.000000000 -0400
33901@@ -1133,7 +1133,7 @@ static void mmc_davinci_enable_sdio_irq(
33902 }
33903 }
33904
33905-static struct mmc_host_ops mmc_davinci_ops = {
33906+static const struct mmc_host_ops mmc_davinci_ops = {
33907 .request = mmc_davinci_request,
33908 .set_ios = mmc_davinci_set_ios,
33909 .get_cd = mmc_davinci_get_cd,
33910diff -urNp linux-2.6.39.1/drivers/mmc/host/dw_mmc.c linux-2.6.39.1/drivers/mmc/host/dw_mmc.c
33911--- linux-2.6.39.1/drivers/mmc/host/dw_mmc.c 2011-05-19 00:06:34.000000000 -0400
33912+++ linux-2.6.39.1/drivers/mmc/host/dw_mmc.c 2011-05-22 19:36:31.000000000 -0400
33913@@ -417,7 +417,7 @@ static int dw_mci_idmac_init(struct dw_m
33914 return 0;
33915 }
33916
33917-static struct dw_mci_dma_ops dw_mci_idmac_ops = {
33918+static const struct dw_mci_dma_ops dw_mci_idmac_ops = {
33919 .init = dw_mci_idmac_init,
33920 .start = dw_mci_idmac_start_dma,
33921 .stop = dw_mci_idmac_stop_dma,
33922diff -urNp linux-2.6.39.1/drivers/mmc/host/s3cmci.c linux-2.6.39.1/drivers/mmc/host/s3cmci.c
33923--- linux-2.6.39.1/drivers/mmc/host/s3cmci.c 2011-05-19 00:06:34.000000000 -0400
33924+++ linux-2.6.39.1/drivers/mmc/host/s3cmci.c 2011-05-22 19:36:31.000000000 -0400
33925@@ -1349,7 +1349,7 @@ static void s3cmci_enable_sdio_irq(struc
33926 s3cmci_check_sdio_irq(host);
33927 }
33928
33929-static struct mmc_host_ops s3cmci_ops = {
33930+static const struct mmc_host_ops s3cmci_ops = {
33931 .request = s3cmci_request,
33932 .set_ios = s3cmci_set_ios,
33933 .get_ro = s3cmci_get_ro,
33934diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-cns3xxx.c linux-2.6.39.1/drivers/mmc/host/sdhci-cns3xxx.c
33935--- linux-2.6.39.1/drivers/mmc/host/sdhci-cns3xxx.c 2011-05-19 00:06:34.000000000 -0400
33936+++ linux-2.6.39.1/drivers/mmc/host/sdhci-cns3xxx.c 2011-05-22 19:36:31.000000000 -0400
33937@@ -81,7 +81,7 @@ out:
33938 host->clock = clock;
33939 }
33940
33941-static struct sdhci_ops sdhci_cns3xxx_ops = {
33942+static const struct sdhci_ops sdhci_cns3xxx_ops = {
33943 .get_max_clock = sdhci_cns3xxx_get_max_clk,
33944 .set_clock = sdhci_cns3xxx_set_clock,
33945 };
33946diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-dove.c linux-2.6.39.1/drivers/mmc/host/sdhci-dove.c
33947--- linux-2.6.39.1/drivers/mmc/host/sdhci-dove.c 2011-05-19 00:06:34.000000000 -0400
33948+++ linux-2.6.39.1/drivers/mmc/host/sdhci-dove.c 2011-05-22 19:36:31.000000000 -0400
33949@@ -56,7 +56,7 @@ static u32 sdhci_dove_readl(struct sdhci
33950 return ret;
33951 }
33952
33953-static struct sdhci_ops sdhci_dove_ops = {
33954+static const struct sdhci_ops sdhci_dove_ops = {
33955 .read_w = sdhci_dove_readw,
33956 .read_l = sdhci_dove_readl,
33957 };
33958diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-esdhc-imx.c linux-2.6.39.1/drivers/mmc/host/sdhci-esdhc-imx.c
33959--- linux-2.6.39.1/drivers/mmc/host/sdhci-esdhc-imx.c 2011-05-19 00:06:34.000000000 -0400
33960+++ linux-2.6.39.1/drivers/mmc/host/sdhci-esdhc-imx.c 2011-05-22 19:36:31.000000000 -0400
33961@@ -201,7 +201,7 @@ static unsigned int esdhc_pltfm_get_ro(s
33962 return -ENOSYS;
33963 }
33964
33965-static struct sdhci_ops sdhci_esdhc_ops = {
33966+static const struct sdhci_ops sdhci_esdhc_ops = {
33967 .read_l = esdhc_readl_le,
33968 .read_w = esdhc_readw_le,
33969 .write_l = esdhc_writel_le,
33970diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-of.h linux-2.6.39.1/drivers/mmc/host/sdhci-of.h
33971--- linux-2.6.39.1/drivers/mmc/host/sdhci-of.h 2011-05-19 00:06:34.000000000 -0400
33972+++ linux-2.6.39.1/drivers/mmc/host/sdhci-of.h 2011-05-22 19:36:31.000000000 -0400
33973@@ -21,7 +21,7 @@
33974
33975 struct sdhci_of_data {
33976 unsigned int quirks;
33977- struct sdhci_ops ops;
33978+ const struct sdhci_ops ops;
33979 };
33980
33981 struct sdhci_of_host {
33982diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-pci.c linux-2.6.39.1/drivers/mmc/host/sdhci-pci.c
33983--- linux-2.6.39.1/drivers/mmc/host/sdhci-pci.c 2011-05-19 00:06:34.000000000 -0400
33984+++ linux-2.6.39.1/drivers/mmc/host/sdhci-pci.c 2011-05-22 19:36:31.000000000 -0400
33985@@ -786,7 +786,7 @@ static int sdhci_pci_enable_dma(struct s
33986 return 0;
33987 }
33988
33989-static struct sdhci_ops sdhci_pci_ops = {
33990+static const struct sdhci_ops sdhci_pci_ops = {
33991 .enable_dma = sdhci_pci_enable_dma,
33992 };
33993
33994diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-pltfm.c linux-2.6.39.1/drivers/mmc/host/sdhci-pltfm.c
33995--- linux-2.6.39.1/drivers/mmc/host/sdhci-pltfm.c 2011-05-19 00:06:34.000000000 -0400
33996+++ linux-2.6.39.1/drivers/mmc/host/sdhci-pltfm.c 2011-05-22 19:36:31.000000000 -0400
33997@@ -41,7 +41,7 @@
33998 * *
33999 \*****************************************************************************/
34000
34001-static struct sdhci_ops sdhci_pltfm_ops = {
34002+static const struct sdhci_ops sdhci_pltfm_ops = {
34003 };
34004
34005 /*****************************************************************************\
34006diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-pxa.c linux-2.6.39.1/drivers/mmc/host/sdhci-pxa.c
34007--- linux-2.6.39.1/drivers/mmc/host/sdhci-pxa.c 2011-05-19 00:06:34.000000000 -0400
34008+++ linux-2.6.39.1/drivers/mmc/host/sdhci-pxa.c 2011-05-22 19:36:31.000000000 -0400
34009@@ -69,7 +69,7 @@ static void set_clock(struct sdhci_host
34010 }
34011 }
34012
34013-static struct sdhci_ops sdhci_pxa_ops = {
34014+static const struct sdhci_ops sdhci_pxa_ops = {
34015 .set_clock = set_clock,
34016 };
34017
34018diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-s3c.c linux-2.6.39.1/drivers/mmc/host/sdhci-s3c.c
34019--- linux-2.6.39.1/drivers/mmc/host/sdhci-s3c.c 2011-05-19 00:06:34.000000000 -0400
34020+++ linux-2.6.39.1/drivers/mmc/host/sdhci-s3c.c 2011-05-22 19:36:31.000000000 -0400
34021@@ -309,7 +309,7 @@ static int sdhci_s3c_platform_8bit_width
34022 return 0;
34023 }
34024
34025-static struct sdhci_ops sdhci_s3c_ops = {
34026+static const struct sdhci_ops sdhci_s3c_ops = {
34027 .get_max_clock = sdhci_s3c_get_max_clk,
34028 .set_clock = sdhci_s3c_set_clock,
34029 .get_min_clock = sdhci_s3c_get_min_clock,
34030diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-spear.c linux-2.6.39.1/drivers/mmc/host/sdhci-spear.c
34031--- linux-2.6.39.1/drivers/mmc/host/sdhci-spear.c 2011-05-19 00:06:34.000000000 -0400
34032+++ linux-2.6.39.1/drivers/mmc/host/sdhci-spear.c 2011-05-22 19:36:31.000000000 -0400
34033@@ -32,7 +32,7 @@ struct spear_sdhci {
34034 };
34035
34036 /* sdhci ops */
34037-static struct sdhci_ops sdhci_pltfm_ops = {
34038+static const struct sdhci_ops sdhci_pltfm_ops = {
34039 /* Nothing to do for now. */
34040 };
34041
34042diff -urNp linux-2.6.39.1/drivers/mmc/host/sdhci-tegra.c linux-2.6.39.1/drivers/mmc/host/sdhci-tegra.c
34043--- linux-2.6.39.1/drivers/mmc/host/sdhci-tegra.c 2011-05-19 00:06:34.000000000 -0400
34044+++ linux-2.6.39.1/drivers/mmc/host/sdhci-tegra.c 2011-05-22 19:36:31.000000000 -0400
34045@@ -242,7 +242,7 @@ static void tegra_sdhci_pltfm_exit(struc
34046 clk_put(pltfm_host->clk);
34047 }
34048
34049-static struct sdhci_ops tegra_sdhci_ops = {
34050+static const struct sdhci_ops tegra_sdhci_ops = {
34051 .get_ro = tegra_sdhci_get_ro,
34052 .read_l = tegra_sdhci_readl,
34053 .read_w = tegra_sdhci_readw,
34054diff -urNp linux-2.6.39.1/drivers/mmc/host/sdricoh_cs.c linux-2.6.39.1/drivers/mmc/host/sdricoh_cs.c
34055--- linux-2.6.39.1/drivers/mmc/host/sdricoh_cs.c 2011-05-19 00:06:34.000000000 -0400
34056+++ linux-2.6.39.1/drivers/mmc/host/sdricoh_cs.c 2011-05-22 19:36:31.000000000 -0400
34057@@ -387,7 +387,7 @@ static int sdricoh_get_ro(struct mmc_hos
34058 return (status & STATUS_CARD_LOCKED);
34059 }
34060
34061-static struct mmc_host_ops sdricoh_ops = {
34062+static const struct mmc_host_ops sdricoh_ops = {
34063 .request = sdricoh_request,
34064 .set_ios = sdricoh_set_ios,
34065 .get_ro = sdricoh_get_ro,
34066diff -urNp linux-2.6.39.1/drivers/mmc/host/sh_mmcif.c linux-2.6.39.1/drivers/mmc/host/sh_mmcif.c
34067--- linux-2.6.39.1/drivers/mmc/host/sh_mmcif.c 2011-05-19 00:06:34.000000000 -0400
34068+++ linux-2.6.39.1/drivers/mmc/host/sh_mmcif.c 2011-05-22 19:36:31.000000000 -0400
34069@@ -872,7 +872,7 @@ static int sh_mmcif_get_cd(struct mmc_ho
34070 return p->get_cd(host->pd);
34071 }
34072
34073-static struct mmc_host_ops sh_mmcif_ops = {
34074+static const struct mmc_host_ops sh_mmcif_ops = {
34075 .request = sh_mmcif_request,
34076 .set_ios = sh_mmcif_set_ios,
34077 .get_cd = sh_mmcif_get_cd,
34078diff -urNp linux-2.6.39.1/drivers/mtd/chips/cfi_cmdset_0001.c linux-2.6.39.1/drivers/mtd/chips/cfi_cmdset_0001.c
34079--- linux-2.6.39.1/drivers/mtd/chips/cfi_cmdset_0001.c 2011-05-19 00:06:34.000000000 -0400
34080+++ linux-2.6.39.1/drivers/mtd/chips/cfi_cmdset_0001.c 2011-05-22 19:36:31.000000000 -0400
34081@@ -757,6 +757,8 @@ static int chip_ready (struct map_info *
34082 struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
34083 unsigned long timeo = jiffies + HZ;
34084
34085+ pax_track_stack();
34086+
34087 /* Prevent setting state FL_SYNCING for chip in suspended state. */
34088 if (mode == FL_SYNCING && chip->oldstate != FL_READY)
34089 goto sleep;
34090@@ -1657,6 +1659,8 @@ static int __xipram do_write_buffer(stru
34091 unsigned long initial_adr;
34092 int initial_len = len;
34093
34094+ pax_track_stack();
34095+
34096 wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
34097 adr += chip->start;
34098 initial_adr = adr;
34099@@ -1875,6 +1879,8 @@ static int __xipram do_erase_oneblock(st
34100 int retries = 3;
34101 int ret;
34102
34103+ pax_track_stack();
34104+
34105 adr += chip->start;
34106
34107 retry:
34108diff -urNp linux-2.6.39.1/drivers/mtd/chips/cfi_cmdset_0020.c linux-2.6.39.1/drivers/mtd/chips/cfi_cmdset_0020.c
34109--- linux-2.6.39.1/drivers/mtd/chips/cfi_cmdset_0020.c 2011-05-19 00:06:34.000000000 -0400
34110+++ linux-2.6.39.1/drivers/mtd/chips/cfi_cmdset_0020.c 2011-05-22 19:36:31.000000000 -0400
34111@@ -255,6 +255,8 @@ static inline int do_read_onechip(struct
34112 unsigned long cmd_addr;
34113 struct cfi_private *cfi = map->fldrv_priv;
34114
34115+ pax_track_stack();
34116+
34117 adr += chip->start;
34118
34119 /* Ensure cmd read/writes are aligned. */
34120@@ -428,6 +430,8 @@ static inline int do_write_buffer(struct
34121 DECLARE_WAITQUEUE(wait, current);
34122 int wbufsize, z;
34123
34124+ pax_track_stack();
34125+
34126 /* M58LW064A requires bus alignment for buffer wriets -- saw */
34127 if (adr & (map_bankwidth(map)-1))
34128 return -EINVAL;
34129@@ -742,6 +746,8 @@ static inline int do_erase_oneblock(stru
34130 DECLARE_WAITQUEUE(wait, current);
34131 int ret = 0;
34132
34133+ pax_track_stack();
34134+
34135 adr += chip->start;
34136
34137 /* Let's determine this according to the interleave only once */
34138@@ -1047,6 +1053,8 @@ static inline int do_lock_oneblock(struc
34139 unsigned long timeo = jiffies + HZ;
34140 DECLARE_WAITQUEUE(wait, current);
34141
34142+ pax_track_stack();
34143+
34144 adr += chip->start;
34145
34146 /* Let's determine this according to the interleave only once */
34147@@ -1196,6 +1204,8 @@ static inline int do_unlock_oneblock(str
34148 unsigned long timeo = jiffies + HZ;
34149 DECLARE_WAITQUEUE(wait, current);
34150
34151+ pax_track_stack();
34152+
34153 adr += chip->start;
34154
34155 /* Let's determine this according to the interleave only once */
34156diff -urNp linux-2.6.39.1/drivers/mtd/devices/doc2000.c linux-2.6.39.1/drivers/mtd/devices/doc2000.c
34157--- linux-2.6.39.1/drivers/mtd/devices/doc2000.c 2011-05-19 00:06:34.000000000 -0400
34158+++ linux-2.6.39.1/drivers/mtd/devices/doc2000.c 2011-05-22 19:36:31.000000000 -0400
34159@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
34160
34161 /* The ECC will not be calculated correctly if less than 512 is written */
34162 /* DBB-
34163- if (len != 0x200 && eccbuf)
34164+ if (len != 0x200)
34165 printk(KERN_WARNING
34166 "ECC needs a full sector write (adr: %lx size %lx)\n",
34167 (long) to, (long) len);
34168diff -urNp linux-2.6.39.1/drivers/mtd/devices/doc2001.c linux-2.6.39.1/drivers/mtd/devices/doc2001.c
34169--- linux-2.6.39.1/drivers/mtd/devices/doc2001.c 2011-05-19 00:06:34.000000000 -0400
34170+++ linux-2.6.39.1/drivers/mtd/devices/doc2001.c 2011-05-22 19:36:31.000000000 -0400
34171@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
34172 struct Nand *mychip = &this->chips[from >> (this->chipshift)];
34173
34174 /* Don't allow read past end of device */
34175- if (from >= this->totlen)
34176+ if (from >= this->totlen || !len)
34177 return -EINVAL;
34178
34179 /* Don't allow a single read to cross a 512-byte block boundary */
34180diff -urNp linux-2.6.39.1/drivers/mtd/ftl.c linux-2.6.39.1/drivers/mtd/ftl.c
34181--- linux-2.6.39.1/drivers/mtd/ftl.c 2011-05-19 00:06:34.000000000 -0400
34182+++ linux-2.6.39.1/drivers/mtd/ftl.c 2011-05-22 19:36:31.000000000 -0400
34183@@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *
34184 loff_t offset;
34185 uint16_t srcunitswap = cpu_to_le16(srcunit);
34186
34187+ pax_track_stack();
34188+
34189 eun = &part->EUNInfo[srcunit];
34190 xfer = &part->XferInfo[xferunit];
34191 DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
34192diff -urNp linux-2.6.39.1/drivers/mtd/inftlcore.c linux-2.6.39.1/drivers/mtd/inftlcore.c
34193--- linux-2.6.39.1/drivers/mtd/inftlcore.c 2011-05-19 00:06:34.000000000 -0400
34194+++ linux-2.6.39.1/drivers/mtd/inftlcore.c 2011-05-22 19:36:31.000000000 -0400
34195@@ -259,6 +259,8 @@ static u16 INFTL_foldchain(struct INFTLr
34196 struct inftl_oob oob;
34197 size_t retlen;
34198
34199+ pax_track_stack();
34200+
34201 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
34202 "pending=%d)\n", inftl, thisVUC, pendingblock);
34203
34204diff -urNp linux-2.6.39.1/drivers/mtd/inftlmount.c linux-2.6.39.1/drivers/mtd/inftlmount.c
34205--- linux-2.6.39.1/drivers/mtd/inftlmount.c 2011-05-19 00:06:34.000000000 -0400
34206+++ linux-2.6.39.1/drivers/mtd/inftlmount.c 2011-05-22 19:36:31.000000000 -0400
34207@@ -53,6 +53,8 @@ static int find_boot_record(struct INFTL
34208 struct INFTLPartition *ip;
34209 size_t retlen;
34210
34211+ pax_track_stack();
34212+
34213 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
34214
34215 /*
34216diff -urNp linux-2.6.39.1/drivers/mtd/lpddr/qinfo_probe.c linux-2.6.39.1/drivers/mtd/lpddr/qinfo_probe.c
34217--- linux-2.6.39.1/drivers/mtd/lpddr/qinfo_probe.c 2011-05-19 00:06:34.000000000 -0400
34218+++ linux-2.6.39.1/drivers/mtd/lpddr/qinfo_probe.c 2011-05-22 19:36:31.000000000 -0400
34219@@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map
34220 {
34221 map_word pfow_val[4];
34222
34223+ pax_track_stack();
34224+
34225 /* Check identification string */
34226 pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
34227 pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
34228diff -urNp linux-2.6.39.1/drivers/mtd/mtdchar.c linux-2.6.39.1/drivers/mtd/mtdchar.c
34229--- linux-2.6.39.1/drivers/mtd/mtdchar.c 2011-05-19 00:06:34.000000000 -0400
34230+++ linux-2.6.39.1/drivers/mtd/mtdchar.c 2011-05-22 19:36:31.000000000 -0400
34231@@ -560,6 +560,8 @@ static int mtd_ioctl(struct file *file,
34232 u_long size;
34233 struct mtd_info_user info;
34234
34235+ pax_track_stack();
34236+
34237 DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
34238
34239 size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
34240diff -urNp linux-2.6.39.1/drivers/mtd/nand/denali.c linux-2.6.39.1/drivers/mtd/nand/denali.c
34241--- linux-2.6.39.1/drivers/mtd/nand/denali.c 2011-05-19 00:06:34.000000000 -0400
34242+++ linux-2.6.39.1/drivers/mtd/nand/denali.c 2011-05-22 19:36:31.000000000 -0400
34243@@ -25,6 +25,7 @@
34244 #include <linux/pci.h>
34245 #include <linux/mtd/mtd.h>
34246 #include <linux/module.h>
34247+#include <linux/slab.h>
34248
34249 #include "denali.h"
34250
34251diff -urNp linux-2.6.39.1/drivers/mtd/nftlcore.c linux-2.6.39.1/drivers/mtd/nftlcore.c
34252--- linux-2.6.39.1/drivers/mtd/nftlcore.c 2011-05-19 00:06:34.000000000 -0400
34253+++ linux-2.6.39.1/drivers/mtd/nftlcore.c 2011-05-22 19:36:31.000000000 -0400
34254@@ -264,6 +264,8 @@ static u16 NFTL_foldchain (struct NFTLre
34255 int inplace = 1;
34256 size_t retlen;
34257
34258+ pax_track_stack();
34259+
34260 memset(BlockMap, 0xff, sizeof(BlockMap));
34261 memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
34262
34263diff -urNp linux-2.6.39.1/drivers/mtd/nftlmount.c linux-2.6.39.1/drivers/mtd/nftlmount.c
34264--- linux-2.6.39.1/drivers/mtd/nftlmount.c 2011-05-19 00:06:34.000000000 -0400
34265+++ linux-2.6.39.1/drivers/mtd/nftlmount.c 2011-05-22 19:36:31.000000000 -0400
34266@@ -24,6 +24,7 @@
34267 #include <asm/errno.h>
34268 #include <linux/delay.h>
34269 #include <linux/slab.h>
34270+#include <linux/sched.h>
34271 #include <linux/mtd/mtd.h>
34272 #include <linux/mtd/nand.h>
34273 #include <linux/mtd/nftl.h>
34274@@ -45,6 +46,8 @@ static int find_boot_record(struct NFTLr
34275 struct mtd_info *mtd = nftl->mbd.mtd;
34276 unsigned int i;
34277
34278+ pax_track_stack();
34279+
34280 /* Assume logical EraseSize == physical erasesize for starting the scan.
34281 We'll sort it out later if we find a MediaHeader which says otherwise */
34282 /* Actually, we won't. The new DiskOnChip driver has already scanned
34283diff -urNp linux-2.6.39.1/drivers/mtd/ubi/build.c linux-2.6.39.1/drivers/mtd/ubi/build.c
34284--- linux-2.6.39.1/drivers/mtd/ubi/build.c 2011-05-19 00:06:34.000000000 -0400
34285+++ linux-2.6.39.1/drivers/mtd/ubi/build.c 2011-05-22 19:36:31.000000000 -0400
34286@@ -1287,7 +1287,7 @@ module_exit(ubi_exit);
34287 static int __init bytes_str_to_int(const char *str)
34288 {
34289 char *endp;
34290- unsigned long result;
34291+ unsigned long result, scale = 1;
34292
34293 result = simple_strtoul(str, &endp, 0);
34294 if (str == endp || result >= INT_MAX) {
34295@@ -1298,11 +1298,11 @@ static int __init bytes_str_to_int(const
34296
34297 switch (*endp) {
34298 case 'G':
34299- result *= 1024;
34300+ scale *= 1024;
34301 case 'M':
34302- result *= 1024;
34303+ scale *= 1024;
34304 case 'K':
34305- result *= 1024;
34306+ scale *= 1024;
34307 if (endp[1] == 'i' && endp[2] == 'B')
34308 endp += 2;
34309 case '\0':
34310@@ -1313,7 +1313,13 @@ static int __init bytes_str_to_int(const
34311 return -EINVAL;
34312 }
34313
34314- return result;
34315+ if ((intoverflow_t)result*scale >= INT_MAX) {
34316+ printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
34317+ str);
34318+ return -EINVAL;
34319+ }
34320+
34321+ return result*scale;
34322 }
34323
34324 /**
34325diff -urNp linux-2.6.39.1/drivers/net/bcm63xx_enet.c linux-2.6.39.1/drivers/net/bcm63xx_enet.c
34326--- linux-2.6.39.1/drivers/net/bcm63xx_enet.c 2011-05-19 00:06:34.000000000 -0400
34327+++ linux-2.6.39.1/drivers/net/bcm63xx_enet.c 2011-05-22 19:36:31.000000000 -0400
34328@@ -1469,7 +1469,7 @@ static int bcm_enet_set_pauseparam(struc
34329 return 0;
34330 }
34331
34332-static struct ethtool_ops bcm_enet_ethtool_ops = {
34333+static const struct ethtool_ops bcm_enet_ethtool_ops = {
34334 .get_strings = bcm_enet_get_strings,
34335 .get_sset_count = bcm_enet_get_sset_count,
34336 .get_ethtool_stats = bcm_enet_get_ethtool_stats,
34337diff -urNp linux-2.6.39.1/drivers/net/bna/bnad_ethtool.c linux-2.6.39.1/drivers/net/bna/bnad_ethtool.c
34338--- linux-2.6.39.1/drivers/net/bna/bnad_ethtool.c 2011-05-19 00:06:34.000000000 -0400
34339+++ linux-2.6.39.1/drivers/net/bna/bnad_ethtool.c 2011-05-22 19:36:31.000000000 -0400
34340@@ -1242,7 +1242,7 @@ bnad_get_sset_count(struct net_device *n
34341 }
34342 }
34343
34344-static struct ethtool_ops bnad_ethtool_ops = {
34345+static const struct ethtool_ops bnad_ethtool_ops = {
34346 .get_settings = bnad_get_settings,
34347 .set_settings = bnad_set_settings,
34348 .get_drvinfo = bnad_get_drvinfo,
34349diff -urNp linux-2.6.39.1/drivers/net/bnx2.c linux-2.6.39.1/drivers/net/bnx2.c
34350--- linux-2.6.39.1/drivers/net/bnx2.c 2011-05-19 00:06:34.000000000 -0400
34351+++ linux-2.6.39.1/drivers/net/bnx2.c 2011-05-22 19:36:31.000000000 -0400
34352@@ -5828,6 +5828,8 @@ bnx2_test_nvram(struct bnx2 *bp)
34353 int rc = 0;
34354 u32 magic, csum;
34355
34356+ pax_track_stack();
34357+
34358 if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
34359 goto test_nvram_done;
34360
34361diff -urNp linux-2.6.39.1/drivers/net/bnx2x/bnx2x_ethtool.c linux-2.6.39.1/drivers/net/bnx2x/bnx2x_ethtool.c
34362--- linux-2.6.39.1/drivers/net/bnx2x/bnx2x_ethtool.c 2011-05-19 00:06:34.000000000 -0400
34363+++ linux-2.6.39.1/drivers/net/bnx2x/bnx2x_ethtool.c 2011-05-22 19:36:31.000000000 -0400
34364@@ -1788,6 +1788,8 @@ static int bnx2x_test_nvram(struct bnx2x
34365 int i, rc;
34366 u32 magic, crc;
34367
34368+ pax_track_stack();
34369+
34370 if (BP_NOMCP(bp))
34371 return 0;
34372
34373diff -urNp linux-2.6.39.1/drivers/net/chelsio/pm3393.c linux-2.6.39.1/drivers/net/chelsio/pm3393.c
34374--- linux-2.6.39.1/drivers/net/chelsio/pm3393.c 2011-05-19 00:06:34.000000000 -0400
34375+++ linux-2.6.39.1/drivers/net/chelsio/pm3393.c 2011-05-22 19:36:31.000000000 -0400
34376@@ -571,7 +571,7 @@ static void pm3393_destroy(struct cmac *
34377 kfree(cmac);
34378 }
34379
34380-static struct cmac_ops pm3393_ops = {
34381+static const struct cmac_ops pm3393_ops = {
34382 .destroy = pm3393_destroy,
34383 .reset = pm3393_reset,
34384 .interrupt_enable = pm3393_interrupt_enable,
34385diff -urNp linux-2.6.39.1/drivers/net/chelsio/vsc7326.c linux-2.6.39.1/drivers/net/chelsio/vsc7326.c
34386--- linux-2.6.39.1/drivers/net/chelsio/vsc7326.c 2011-05-19 00:06:34.000000000 -0400
34387+++ linux-2.6.39.1/drivers/net/chelsio/vsc7326.c 2011-05-22 19:36:31.000000000 -0400
34388@@ -666,7 +666,7 @@ static void mac_destroy(struct cmac *mac
34389 kfree(mac);
34390 }
34391
34392-static struct cmac_ops vsc7326_ops = {
34393+static const struct cmac_ops vsc7326_ops = {
34394 .destroy = mac_destroy,
34395 .reset = mac_reset,
34396 .interrupt_handler = mac_intr_handler,
34397diff -urNp linux-2.6.39.1/drivers/net/cxgb4/cxgb4_main.c linux-2.6.39.1/drivers/net/cxgb4/cxgb4_main.c
34398--- linux-2.6.39.1/drivers/net/cxgb4/cxgb4_main.c 2011-05-19 00:06:34.000000000 -0400
34399+++ linux-2.6.39.1/drivers/net/cxgb4/cxgb4_main.c 2011-05-22 19:36:31.000000000 -0400
34400@@ -3428,6 +3428,8 @@ static int __devinit enable_msix(struct
34401 unsigned int nchan = adap->params.nports;
34402 struct msix_entry entries[MAX_INGQ + 1];
34403
34404+ pax_track_stack();
34405+
34406 for (i = 0; i < ARRAY_SIZE(entries); ++i)
34407 entries[i].entry = i;
34408
34409diff -urNp linux-2.6.39.1/drivers/net/cxgb4/t4_hw.c linux-2.6.39.1/drivers/net/cxgb4/t4_hw.c
34410--- linux-2.6.39.1/drivers/net/cxgb4/t4_hw.c 2011-05-19 00:06:34.000000000 -0400
34411+++ linux-2.6.39.1/drivers/net/cxgb4/t4_hw.c 2011-05-22 19:36:31.000000000 -0400
34412@@ -362,6 +362,8 @@ static int get_vpd_params(struct adapter
34413 u8 vpd[VPD_LEN], csum;
34414 unsigned int vpdr_len, kw_offset, id_len;
34415
34416+ pax_track_stack();
34417+
34418 ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(vpd), vpd);
34419 if (ret < 0)
34420 return ret;
34421diff -urNp linux-2.6.39.1/drivers/net/cxgb4vf/cxgb4vf_main.c linux-2.6.39.1/drivers/net/cxgb4vf/cxgb4vf_main.c
34422--- linux-2.6.39.1/drivers/net/cxgb4vf/cxgb4vf_main.c 2011-05-19 00:06:34.000000000 -0400
34423+++ linux-2.6.39.1/drivers/net/cxgb4vf/cxgb4vf_main.c 2011-05-22 19:36:31.000000000 -0400
34424@@ -1572,7 +1572,7 @@ static int cxgb4vf_set_tso(struct net_de
34425 return 0;
34426 }
34427
34428-static struct ethtool_ops cxgb4vf_ethtool_ops = {
34429+static const struct ethtool_ops cxgb4vf_ethtool_ops = {
34430 .get_settings = cxgb4vf_get_settings,
34431 .get_drvinfo = cxgb4vf_get_drvinfo,
34432 .get_msglevel = cxgb4vf_get_msglevel,
34433diff -urNp linux-2.6.39.1/drivers/net/e1000e/82571.c linux-2.6.39.1/drivers/net/e1000e/82571.c
34434--- linux-2.6.39.1/drivers/net/e1000e/82571.c 2011-05-19 00:06:34.000000000 -0400
34435+++ linux-2.6.39.1/drivers/net/e1000e/82571.c 2011-05-22 19:36:31.000000000 -0400
34436@@ -239,7 +239,7 @@ static s32 e1000_init_mac_params_82571(s
34437 {
34438 struct e1000_hw *hw = &adapter->hw;
34439 struct e1000_mac_info *mac = &hw->mac;
34440- struct e1000_mac_operations *func = &mac->ops;
34441+ struct e1000_mac_operations *func = &mac->ops; /* cannot be const */
34442 u32 swsm = 0;
34443 u32 swsm2 = 0;
34444 bool force_clear_smbi = false;
34445@@ -1930,7 +1930,7 @@ static void e1000_clear_hw_cntrs_82571(s
34446 er32(ICRXDMTC);
34447 }
34448
34449-static struct e1000_mac_operations e82571_mac_ops = {
34450+static const struct e1000_mac_operations e82571_mac_ops = {
34451 /* .check_mng_mode: mac type dependent */
34452 /* .check_for_link: media type dependent */
34453 .id_led_init = e1000e_id_led_init,
34454@@ -1952,7 +1952,7 @@ static struct e1000_mac_operations e8257
34455 .read_mac_addr = e1000_read_mac_addr_82571,
34456 };
34457
34458-static struct e1000_phy_operations e82_phy_ops_igp = {
34459+static const struct e1000_phy_operations e82_phy_ops_igp = {
34460 .acquire = e1000_get_hw_semaphore_82571,
34461 .check_polarity = e1000_check_polarity_igp,
34462 .check_reset_block = e1000e_check_reset_block_generic,
34463@@ -1970,7 +1970,7 @@ static struct e1000_phy_operations e82_p
34464 .cfg_on_link_up = NULL,
34465 };
34466
34467-static struct e1000_phy_operations e82_phy_ops_m88 = {
34468+static const struct e1000_phy_operations e82_phy_ops_m88 = {
34469 .acquire = e1000_get_hw_semaphore_82571,
34470 .check_polarity = e1000_check_polarity_m88,
34471 .check_reset_block = e1000e_check_reset_block_generic,
34472@@ -1988,7 +1988,7 @@ static struct e1000_phy_operations e82_p
34473 .cfg_on_link_up = NULL,
34474 };
34475
34476-static struct e1000_phy_operations e82_phy_ops_bm = {
34477+static const struct e1000_phy_operations e82_phy_ops_bm = {
34478 .acquire = e1000_get_hw_semaphore_82571,
34479 .check_polarity = e1000_check_polarity_m88,
34480 .check_reset_block = e1000e_check_reset_block_generic,
34481@@ -2006,7 +2006,7 @@ static struct e1000_phy_operations e82_p
34482 .cfg_on_link_up = NULL,
34483 };
34484
34485-static struct e1000_nvm_operations e82571_nvm_ops = {
34486+static const struct e1000_nvm_operations e82571_nvm_ops = {
34487 .acquire = e1000_acquire_nvm_82571,
34488 .read = e1000e_read_nvm_eerd,
34489 .release = e1000_release_nvm_82571,
34490diff -urNp linux-2.6.39.1/drivers/net/e1000e/e1000.h linux-2.6.39.1/drivers/net/e1000e/e1000.h
34491--- linux-2.6.39.1/drivers/net/e1000e/e1000.h 2011-05-19 00:06:34.000000000 -0400
34492+++ linux-2.6.39.1/drivers/net/e1000e/e1000.h 2011-05-22 19:36:31.000000000 -0400
34493@@ -409,9 +409,9 @@ struct e1000_info {
34494 u32 pba;
34495 u32 max_hw_frame_size;
34496 s32 (*get_variants)(struct e1000_adapter *);
34497- struct e1000_mac_operations *mac_ops;
34498- struct e1000_phy_operations *phy_ops;
34499- struct e1000_nvm_operations *nvm_ops;
34500+ const struct e1000_mac_operations *mac_ops;
34501+ const struct e1000_phy_operations *phy_ops;
34502+ const struct e1000_nvm_operations *nvm_ops;
34503 };
34504
34505 /* hardware capability, feature, and workaround flags */
34506diff -urNp linux-2.6.39.1/drivers/net/e1000e/es2lan.c linux-2.6.39.1/drivers/net/e1000e/es2lan.c
34507--- linux-2.6.39.1/drivers/net/e1000e/es2lan.c 2011-05-19 00:06:34.000000000 -0400
34508+++ linux-2.6.39.1/drivers/net/e1000e/es2lan.c 2011-05-22 19:36:31.000000000 -0400
34509@@ -205,7 +205,7 @@ static s32 e1000_init_mac_params_80003es
34510 {
34511 struct e1000_hw *hw = &adapter->hw;
34512 struct e1000_mac_info *mac = &hw->mac;
34513- struct e1000_mac_operations *func = &mac->ops;
34514+ struct e1000_mac_operations *func = &mac->ops; /* cannot be const */
34515
34516 /* Set media type */
34517 switch (adapter->pdev->device) {
34518@@ -1431,7 +1431,7 @@ static void e1000_clear_hw_cntrs_80003es
34519 er32(ICRXDMTC);
34520 }
34521
34522-static struct e1000_mac_operations es2_mac_ops = {
34523+static const struct e1000_mac_operations es2_mac_ops = {
34524 .read_mac_addr = e1000_read_mac_addr_80003es2lan,
34525 .id_led_init = e1000e_id_led_init,
34526 .check_mng_mode = e1000e_check_mng_mode_generic,
34527@@ -1453,7 +1453,7 @@ static struct e1000_mac_operations es2_m
34528 .setup_led = e1000e_setup_led_generic,
34529 };
34530
34531-static struct e1000_phy_operations es2_phy_ops = {
34532+static const struct e1000_phy_operations es2_phy_ops = {
34533 .acquire = e1000_acquire_phy_80003es2lan,
34534 .check_polarity = e1000_check_polarity_m88,
34535 .check_reset_block = e1000e_check_reset_block_generic,
34536@@ -1471,7 +1471,7 @@ static struct e1000_phy_operations es2_p
34537 .cfg_on_link_up = e1000_cfg_on_link_up_80003es2lan,
34538 };
34539
34540-static struct e1000_nvm_operations es2_nvm_ops = {
34541+static const struct e1000_nvm_operations es2_nvm_ops = {
34542 .acquire = e1000_acquire_nvm_80003es2lan,
34543 .read = e1000e_read_nvm_eerd,
34544 .release = e1000_release_nvm_80003es2lan,
34545diff -urNp linux-2.6.39.1/drivers/net/e1000e/hw.h linux-2.6.39.1/drivers/net/e1000e/hw.h
34546--- linux-2.6.39.1/drivers/net/e1000e/hw.h 2011-05-19 00:06:34.000000000 -0400
34547+++ linux-2.6.39.1/drivers/net/e1000e/hw.h 2011-05-22 19:36:31.000000000 -0400
34548@@ -811,6 +811,7 @@ struct e1000_nvm_operations {
34549 };
34550
34551 struct e1000_mac_info {
34552+ /* cannot be const see e1000_init_mac_params_ich8lan */
34553 struct e1000_mac_operations ops;
34554 u8 addr[ETH_ALEN];
34555 u8 perm_addr[ETH_ALEN];
34556@@ -852,6 +853,7 @@ struct e1000_mac_info {
34557 };
34558
34559 struct e1000_phy_info {
34560+ /* Cannot be const see e1000_init_phy_params_82571() */
34561 struct e1000_phy_operations ops;
34562
34563 enum e1000_phy_type type;
34564@@ -886,6 +888,7 @@ struct e1000_phy_info {
34565 };
34566
34567 struct e1000_nvm_info {
34568+ /* cannot be const */
34569 struct e1000_nvm_operations ops;
34570
34571 enum e1000_nvm_type type;
34572diff -urNp linux-2.6.39.1/drivers/net/e1000e/ich8lan.c linux-2.6.39.1/drivers/net/e1000e/ich8lan.c
34573--- linux-2.6.39.1/drivers/net/e1000e/ich8lan.c 2011-05-19 00:06:34.000000000 -0400
34574+++ linux-2.6.39.1/drivers/net/e1000e/ich8lan.c 2011-05-22 19:36:31.000000000 -0400
34575@@ -3866,7 +3866,7 @@ static void e1000_clear_hw_cntrs_ich8lan
34576 }
34577 }
34578
34579-static struct e1000_mac_operations ich8_mac_ops = {
34580+static const struct e1000_mac_operations ich8_mac_ops = {
34581 .id_led_init = e1000e_id_led_init,
34582 /* check_mng_mode dependent on mac type */
34583 .check_for_link = e1000_check_for_copper_link_ich8lan,
34584@@ -3885,7 +3885,7 @@ static struct e1000_mac_operations ich8_
34585 /* id_led_init dependent on mac type */
34586 };
34587
34588-static struct e1000_phy_operations ich8_phy_ops = {
34589+static const struct e1000_phy_operations ich8_phy_ops = {
34590 .acquire = e1000_acquire_swflag_ich8lan,
34591 .check_reset_block = e1000_check_reset_block_ich8lan,
34592 .commit = NULL,
34593@@ -3899,7 +3899,7 @@ static struct e1000_phy_operations ich8_
34594 .write_reg = e1000e_write_phy_reg_igp,
34595 };
34596
34597-static struct e1000_nvm_operations ich8_nvm_ops = {
34598+static const struct e1000_nvm_operations ich8_nvm_ops = {
34599 .acquire = e1000_acquire_nvm_ich8lan,
34600 .read = e1000_read_nvm_ich8lan,
34601 .release = e1000_release_nvm_ich8lan,
34602diff -urNp linux-2.6.39.1/drivers/net/greth.c linux-2.6.39.1/drivers/net/greth.c
34603--- linux-2.6.39.1/drivers/net/greth.c 2011-05-19 00:06:34.000000000 -0400
34604+++ linux-2.6.39.1/drivers/net/greth.c 2011-05-22 19:36:31.000000000 -0400
34605@@ -1192,7 +1192,7 @@ static const struct ethtool_ops greth_et
34606 .get_link = ethtool_op_get_link,
34607 };
34608
34609-static struct net_device_ops greth_netdev_ops = {
34610+static const struct net_device_ops greth_netdev_ops = {
34611 .ndo_open = greth_open,
34612 .ndo_stop = greth_close,
34613 .ndo_start_xmit = greth_start_xmit,
34614diff -urNp linux-2.6.39.1/drivers/net/hamradio/6pack.c linux-2.6.39.1/drivers/net/hamradio/6pack.c
34615--- linux-2.6.39.1/drivers/net/hamradio/6pack.c 2011-05-19 00:06:34.000000000 -0400
34616+++ linux-2.6.39.1/drivers/net/hamradio/6pack.c 2011-05-22 19:36:31.000000000 -0400
34617@@ -463,6 +463,8 @@ static void sixpack_receive_buf(struct t
34618 unsigned char buf[512];
34619 int count1;
34620
34621+ pax_track_stack();
34622+
34623 if (!count)
34624 return;
34625
34626diff -urNp linux-2.6.39.1/drivers/net/ibm_newemac/phy.c linux-2.6.39.1/drivers/net/ibm_newemac/phy.c
34627--- linux-2.6.39.1/drivers/net/ibm_newemac/phy.c 2011-05-19 00:06:34.000000000 -0400
34628+++ linux-2.6.39.1/drivers/net/ibm_newemac/phy.c 2011-05-22 19:36:31.000000000 -0400
34629@@ -273,7 +273,7 @@ static int genmii_read_link(struct mii_p
34630 }
34631
34632 /* Generic implementation for most 10/100/1000 PHYs */
34633-static struct mii_phy_ops generic_phy_ops = {
34634+static const struct mii_phy_ops generic_phy_ops = {
34635 .setup_aneg = genmii_setup_aneg,
34636 .setup_forced = genmii_setup_forced,
34637 .poll_link = genmii_poll_link,
34638@@ -337,7 +337,7 @@ static int cis8201_init(struct mii_phy *
34639 return 0;
34640 }
34641
34642-static struct mii_phy_ops cis8201_phy_ops = {
34643+static const struct mii_phy_ops cis8201_phy_ops = {
34644 .init = cis8201_init,
34645 .setup_aneg = genmii_setup_aneg,
34646 .setup_forced = genmii_setup_forced,
34647@@ -417,7 +417,7 @@ static int et1011c_init(struct mii_phy *
34648 return 0;
34649 }
34650
34651-static struct mii_phy_ops et1011c_phy_ops = {
34652+static const struct mii_phy_ops et1011c_phy_ops = {
34653 .init = et1011c_init,
34654 .setup_aneg = genmii_setup_aneg,
34655 .setup_forced = genmii_setup_forced,
34656@@ -436,7 +436,7 @@ static struct mii_phy_def et1011c_phy_de
34657
34658
34659
34660-static struct mii_phy_ops m88e1111_phy_ops = {
34661+static const struct mii_phy_ops m88e1111_phy_ops = {
34662 .init = m88e1111_init,
34663 .setup_aneg = genmii_setup_aneg,
34664 .setup_forced = genmii_setup_forced,
34665@@ -452,7 +452,7 @@ static struct mii_phy_def m88e1111_phy_d
34666 .ops = &m88e1111_phy_ops,
34667 };
34668
34669-static struct mii_phy_ops m88e1112_phy_ops = {
34670+static const struct mii_phy_ops m88e1112_phy_ops = {
34671 .init = m88e1112_init,
34672 .setup_aneg = genmii_setup_aneg,
34673 .setup_forced = genmii_setup_forced,
34674diff -urNp linux-2.6.39.1/drivers/net/ibmveth.c linux-2.6.39.1/drivers/net/ibmveth.c
34675--- linux-2.6.39.1/drivers/net/ibmveth.c 2011-05-19 00:06:34.000000000 -0400
34676+++ linux-2.6.39.1/drivers/net/ibmveth.c 2011-05-22 19:36:31.000000000 -0400
34677@@ -1625,7 +1625,7 @@ static struct vio_device_id ibmveth_devi
34678 };
34679 MODULE_DEVICE_TABLE(vio, ibmveth_device_table);
34680
34681-static struct dev_pm_ops ibmveth_pm_ops = {
34682+static const struct dev_pm_ops ibmveth_pm_ops = {
34683 .resume = ibmveth_resume
34684 };
34685
34686diff -urNp linux-2.6.39.1/drivers/net/igb/e1000_82575.c linux-2.6.39.1/drivers/net/igb/e1000_82575.c
34687--- linux-2.6.39.1/drivers/net/igb/e1000_82575.c 2011-05-19 00:06:34.000000000 -0400
34688+++ linux-2.6.39.1/drivers/net/igb/e1000_82575.c 2011-05-22 19:36:31.000000000 -0400
34689@@ -2029,7 +2029,7 @@ out:
34690 return ret_val;
34691 }
34692
34693-static struct e1000_mac_operations e1000_mac_ops_82575 = {
34694+static const struct e1000_mac_operations e1000_mac_ops_82575 = {
34695 .init_hw = igb_init_hw_82575,
34696 .check_for_link = igb_check_for_link_82575,
34697 .rar_set = igb_rar_set,
34698@@ -2037,13 +2037,13 @@ static struct e1000_mac_operations e1000
34699 .get_speed_and_duplex = igb_get_speed_and_duplex_copper,
34700 };
34701
34702-static struct e1000_phy_operations e1000_phy_ops_82575 = {
34703+static const struct e1000_phy_operations e1000_phy_ops_82575 = {
34704 .acquire = igb_acquire_phy_82575,
34705 .get_cfg_done = igb_get_cfg_done_82575,
34706 .release = igb_release_phy_82575,
34707 };
34708
34709-static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
34710+static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
34711 .acquire = igb_acquire_nvm_82575,
34712 .read = igb_read_nvm_eerd,
34713 .release = igb_release_nvm_82575,
34714diff -urNp linux-2.6.39.1/drivers/net/igb/e1000_hw.h linux-2.6.39.1/drivers/net/igb/e1000_hw.h
34715--- linux-2.6.39.1/drivers/net/igb/e1000_hw.h 2011-05-19 00:06:34.000000000 -0400
34716+++ linux-2.6.39.1/drivers/net/igb/e1000_hw.h 2011-05-22 19:36:31.000000000 -0400
34717@@ -342,14 +342,15 @@ struct e1000_nvm_operations {
34718
34719 struct e1000_info {
34720 s32 (*get_invariants)(struct e1000_hw *);
34721- struct e1000_mac_operations *mac_ops;
34722- struct e1000_phy_operations *phy_ops;
34723- struct e1000_nvm_operations *nvm_ops;
34724+ const struct e1000_mac_operations *mac_ops;
34725+ const struct e1000_phy_operations *phy_ops;
34726+ const struct e1000_nvm_operations *nvm_ops;
34727 };
34728
34729 extern const struct e1000_info e1000_82575_info;
34730
34731 struct e1000_mac_info {
34732+ /* cannot be const see igb_get_invariants_82575() */
34733 struct e1000_mac_operations ops;
34734
34735 u8 addr[6];
34736@@ -388,6 +389,7 @@ struct e1000_mac_info {
34737 };
34738
34739 struct e1000_phy_info {
34740+ /* cannot be const see igb_get_invariants_82575() */
34741 struct e1000_phy_operations ops;
34742
34743 enum e1000_phy_type type;
34744@@ -423,6 +425,7 @@ struct e1000_phy_info {
34745 };
34746
34747 struct e1000_nvm_info {
34748+ /* cannot be const */
34749 struct e1000_nvm_operations ops;
34750 enum e1000_nvm_type type;
34751 enum e1000_nvm_override override;
34752diff -urNp linux-2.6.39.1/drivers/net/igbvf/vf.h linux-2.6.39.1/drivers/net/igbvf/vf.h
34753--- linux-2.6.39.1/drivers/net/igbvf/vf.h 2011-05-19 00:06:34.000000000 -0400
34754+++ linux-2.6.39.1/drivers/net/igbvf/vf.h 2011-05-22 19:36:31.000000000 -0400
34755@@ -191,6 +191,7 @@ struct e1000_mac_operations {
34756 };
34757
34758 struct e1000_mac_info {
34759+ /* cannot be const see e1000_init_mac_params_vf() */
34760 struct e1000_mac_operations ops;
34761 u8 addr[6];
34762 u8 perm_addr[6];
34763diff -urNp linux-2.6.39.1/drivers/net/irda/sh_irda.c linux-2.6.39.1/drivers/net/irda/sh_irda.c
34764--- linux-2.6.39.1/drivers/net/irda/sh_irda.c 2011-05-19 00:06:34.000000000 -0400
34765+++ linux-2.6.39.1/drivers/net/irda/sh_irda.c 2011-05-22 19:36:31.000000000 -0400
34766@@ -307,7 +307,7 @@ static int xir_fte(struct sh_irda_self *
34767 return 0;
34768 }
34769
34770-static struct sh_irda_xir_func xir_func = {
34771+static const struct sh_irda_xir_func xir_func = {
34772 .xir_fre = xir_fre,
34773 .xir_trov = xir_trov,
34774 .xir_9 = xir_9,
34775@@ -321,7 +321,7 @@ static struct sh_irda_xir_func xir_func
34776 *
34777 * MIR/FIR are not supported now
34778 *=====================================*/
34779-static struct sh_irda_xir_func mfir_func = {
34780+static const struct sh_irda_xir_func mfir_func = {
34781 .xir_fre = xir_fre,
34782 .xir_trov = xir_trov,
34783 .xir_9 = xir_9,
34784@@ -400,7 +400,7 @@ static int sir_fte(struct sh_irda_self *
34785 return 0;
34786 }
34787
34788-static struct sh_irda_xir_func sir_func = {
34789+static const struct sh_irda_xir_func sir_func = {
34790 .xir_fre = sir_fre,
34791 .xir_trov = sir_trov,
34792 .xir_9 = sir_tot,
34793@@ -411,7 +411,7 @@ static struct sh_irda_xir_func sir_func
34794 static void sh_irda_set_mode(struct sh_irda_self *self, enum sh_irda_mode mode)
34795 {
34796 struct device *dev = &self->ndev->dev;
34797- struct sh_irda_xir_func *func;
34798+ const struct sh_irda_xir_func *func;
34799 const char *name;
34800 u16 data;
34801
34802diff -urNp linux-2.6.39.1/drivers/net/ixgb/ixgb_main.c linux-2.6.39.1/drivers/net/ixgb/ixgb_main.c
34803--- linux-2.6.39.1/drivers/net/ixgb/ixgb_main.c 2011-05-19 00:06:34.000000000 -0400
34804+++ linux-2.6.39.1/drivers/net/ixgb/ixgb_main.c 2011-05-22 19:36:31.000000000 -0400
34805@@ -1069,6 +1069,8 @@ ixgb_set_multi(struct net_device *netdev
34806 u32 rctl;
34807 int i;
34808
34809+ pax_track_stack();
34810+
34811 /* Check for Promiscuous and All Multicast modes */
34812
34813 rctl = IXGB_READ_REG(hw, RCTL);
34814diff -urNp linux-2.6.39.1/drivers/net/ixgb/ixgb_param.c linux-2.6.39.1/drivers/net/ixgb/ixgb_param.c
34815--- linux-2.6.39.1/drivers/net/ixgb/ixgb_param.c 2011-05-19 00:06:34.000000000 -0400
34816+++ linux-2.6.39.1/drivers/net/ixgb/ixgb_param.c 2011-05-22 19:36:31.000000000 -0400
34817@@ -261,6 +261,9 @@ void __devinit
34818 ixgb_check_options(struct ixgb_adapter *adapter)
34819 {
34820 int bd = adapter->bd_number;
34821+
34822+ pax_track_stack();
34823+
34824 if (bd >= IXGB_MAX_NIC) {
34825 pr_notice("Warning: no configuration for board #%i\n", bd);
34826 pr_notice("Using defaults for all values\n");
34827diff -urNp linux-2.6.39.1/drivers/net/ixgbe/ixgbe_82599.c linux-2.6.39.1/drivers/net/ixgbe/ixgbe_82599.c
34828--- linux-2.6.39.1/drivers/net/ixgbe/ixgbe_82599.c 2011-05-19 00:06:34.000000000 -0400
34829+++ linux-2.6.39.1/drivers/net/ixgbe/ixgbe_82599.c 2011-05-22 19:36:31.000000000 -0400
34830@@ -2099,7 +2099,7 @@ static struct ixgbe_phy_operations phy_o
34831 .check_overtemp = &ixgbe_tn_check_overtemp,
34832 };
34833
34834-struct ixgbe_info ixgbe_82599_info = {
34835+const struct ixgbe_info ixgbe_82599_info = {
34836 .mac = ixgbe_mac_82599EB,
34837 .get_invariants = &ixgbe_get_invariants_82599,
34838 .mac_ops = &mac_ops_82599,
34839diff -urNp linux-2.6.39.1/drivers/net/ixgbe/ixgbe.h linux-2.6.39.1/drivers/net/ixgbe/ixgbe.h
34840--- linux-2.6.39.1/drivers/net/ixgbe/ixgbe.h 2011-05-19 00:06:34.000000000 -0400
34841+++ linux-2.6.39.1/drivers/net/ixgbe/ixgbe.h 2011-05-22 19:36:31.000000000 -0400
34842@@ -493,8 +493,8 @@ enum ixgbe_boards {
34843 };
34844
34845 extern struct ixgbe_info ixgbe_82598_info;
34846-extern struct ixgbe_info ixgbe_82599_info;
34847-extern struct ixgbe_info ixgbe_X540_info;
34848+extern const struct ixgbe_info ixgbe_82599_info;
34849+extern const struct ixgbe_info ixgbe_X540_info;
34850 #ifdef CONFIG_IXGBE_DCB
34851 extern const struct dcbnl_rtnl_ops dcbnl_ops;
34852 extern int ixgbe_copy_dcb_cfg(struct ixgbe_dcb_config *src_dcb_cfg,
34853diff -urNp linux-2.6.39.1/drivers/net/ixgbe/ixgbe_type.h linux-2.6.39.1/drivers/net/ixgbe/ixgbe_type.h
34854--- linux-2.6.39.1/drivers/net/ixgbe/ixgbe_type.h 2011-05-19 00:06:34.000000000 -0400
34855+++ linux-2.6.39.1/drivers/net/ixgbe/ixgbe_type.h 2011-05-22 19:36:31.000000000 -0400
34856@@ -2572,7 +2572,7 @@ struct ixgbe_phy_operations {
34857 };
34858
34859 struct ixgbe_eeprom_info {
34860- struct ixgbe_eeprom_operations ops;
34861+ struct ixgbe_eeprom_operations ops;
34862 enum ixgbe_eeprom_type type;
34863 u32 semaphore_delay;
34864 u16 word_size;
34865@@ -2581,7 +2581,7 @@ struct ixgbe_eeprom_info {
34866
34867 #define IXGBE_FLAGS_DOUBLE_RESET_REQUIRED 0x01
34868 struct ixgbe_mac_info {
34869- struct ixgbe_mac_operations ops;
34870+ struct ixgbe_mac_operations ops;
34871 enum ixgbe_mac_type type;
34872 u8 addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
34873 u8 perm_addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
34874@@ -2608,7 +2608,7 @@ struct ixgbe_mac_info {
34875 };
34876
34877 struct ixgbe_phy_info {
34878- struct ixgbe_phy_operations ops;
34879+ struct ixgbe_phy_operations ops;
34880 struct mdio_if_info mdio;
34881 enum ixgbe_phy_type type;
34882 u32 id;
34883diff -urNp linux-2.6.39.1/drivers/net/ixgbe/ixgbe_x540.c linux-2.6.39.1/drivers/net/ixgbe/ixgbe_x540.c
34884--- linux-2.6.39.1/drivers/net/ixgbe/ixgbe_x540.c 2011-05-19 00:06:34.000000000 -0400
34885+++ linux-2.6.39.1/drivers/net/ixgbe/ixgbe_x540.c 2011-05-22 19:36:31.000000000 -0400
34886@@ -727,7 +727,7 @@ static struct ixgbe_phy_operations phy_o
34887 .check_overtemp = &ixgbe_tn_check_overtemp,
34888 };
34889
34890-struct ixgbe_info ixgbe_X540_info = {
34891+const struct ixgbe_info ixgbe_X540_info = {
34892 .mac = ixgbe_mac_X540,
34893 .get_invariants = &ixgbe_get_invariants_X540,
34894 .mac_ops = &mac_ops_X540,
34895diff -urNp linux-2.6.39.1/drivers/net/ixgbevf/ethtool.c linux-2.6.39.1/drivers/net/ixgbevf/ethtool.c
34896--- linux-2.6.39.1/drivers/net/ixgbevf/ethtool.c 2011-05-19 00:06:34.000000000 -0400
34897+++ linux-2.6.39.1/drivers/net/ixgbevf/ethtool.c 2011-05-22 19:36:31.000000000 -0400
34898@@ -709,7 +709,7 @@ static int ixgbevf_nway_reset(struct net
34899 return 0;
34900 }
34901
34902-static struct ethtool_ops ixgbevf_ethtool_ops = {
34903+static const struct ethtool_ops ixgbevf_ethtool_ops = {
34904 .get_settings = ixgbevf_get_settings,
34905 .get_drvinfo = ixgbevf_get_drvinfo,
34906 .get_regs_len = ixgbevf_get_regs_len,
34907diff -urNp linux-2.6.39.1/drivers/net/ixgbevf/ixgbevf.h linux-2.6.39.1/drivers/net/ixgbevf/ixgbevf.h
34908--- linux-2.6.39.1/drivers/net/ixgbevf/ixgbevf.h 2011-05-19 00:06:34.000000000 -0400
34909+++ linux-2.6.39.1/drivers/net/ixgbevf/ixgbevf.h 2011-05-22 19:36:31.000000000 -0400
34910@@ -279,7 +279,7 @@ enum ixgbevf_boards {
34911
34912 extern struct ixgbevf_info ixgbevf_82599_vf_info;
34913 extern struct ixgbevf_info ixgbevf_X540_vf_info;
34914-extern struct ixgbe_mac_operations ixgbevf_mbx_ops;
34915+extern const struct ixgbe_mac_operations ixgbevf_mbx_ops;
34916
34917 /* needed by ethtool.c */
34918 extern char ixgbevf_driver_name[];
34919diff -urNp linux-2.6.39.1/drivers/net/ixgbevf/vf.c linux-2.6.39.1/drivers/net/ixgbevf/vf.c
34920--- linux-2.6.39.1/drivers/net/ixgbevf/vf.c 2011-05-19 00:06:34.000000000 -0400
34921+++ linux-2.6.39.1/drivers/net/ixgbevf/vf.c 2011-05-22 19:36:31.000000000 -0400
34922@@ -368,7 +368,7 @@ static s32 ixgbevf_check_mac_link_vf(str
34923 return 0;
34924 }
34925
34926-static struct ixgbe_mac_operations ixgbevf_mac_ops = {
34927+static const struct ixgbe_mac_operations ixgbevf_mac_ops = {
34928 .init_hw = ixgbevf_init_hw_vf,
34929 .reset_hw = ixgbevf_reset_hw_vf,
34930 .start_hw = ixgbevf_start_hw_vf,
34931@@ -381,12 +381,12 @@ static struct ixgbe_mac_operations ixgbe
34932 .set_vfta = ixgbevf_set_vfta_vf,
34933 };
34934
34935-struct ixgbevf_info ixgbevf_82599_vf_info = {
34936+const struct ixgbevf_info ixgbevf_82599_vf_info = {
34937 .mac = ixgbe_mac_82599_vf,
34938 .mac_ops = &ixgbevf_mac_ops,
34939 };
34940
34941-struct ixgbevf_info ixgbevf_X540_vf_info = {
34942+const struct ixgbevf_info ixgbevf_X540_vf_info = {
34943 .mac = ixgbe_mac_X540_vf,
34944 .mac_ops = &ixgbevf_mac_ops,
34945 };
34946diff -urNp linux-2.6.39.1/drivers/net/ixgbevf/vf.h linux-2.6.39.1/drivers/net/ixgbevf/vf.h
34947--- linux-2.6.39.1/drivers/net/ixgbevf/vf.h 2011-05-19 00:06:34.000000000 -0400
34948+++ linux-2.6.39.1/drivers/net/ixgbevf/vf.h 2011-05-22 19:36:31.000000000 -0400
34949@@ -166,7 +166,7 @@ struct ixgbevf_hw_stats {
34950
34951 struct ixgbevf_info {
34952 enum ixgbe_mac_type mac;
34953- struct ixgbe_mac_operations *mac_ops;
34954+ const struct ixgbe_mac_operations *mac_ops;
34955 };
34956
34957 #endif /* __IXGBE_VF_H__ */
34958diff -urNp linux-2.6.39.1/drivers/net/ksz884x.c linux-2.6.39.1/drivers/net/ksz884x.c
34959--- linux-2.6.39.1/drivers/net/ksz884x.c 2011-05-19 00:06:34.000000000 -0400
34960+++ linux-2.6.39.1/drivers/net/ksz884x.c 2011-05-22 19:36:31.000000000 -0400
34961@@ -6536,6 +6536,8 @@ static void netdev_get_ethtool_stats(str
34962 int rc;
34963 u64 counter[TOTAL_PORT_COUNTER_NUM];
34964
34965+ pax_track_stack();
34966+
34967 mutex_lock(&hw_priv->lock);
34968 n = SWITCH_PORT_NUM;
34969 for (i = 0, p = port->first_port; i < port->mib_port_cnt; i++, p++) {
34970@@ -6637,7 +6639,7 @@ static int netdev_set_rx_csum(struct net
34971 return 0;
34972 }
34973
34974-static struct ethtool_ops netdev_ethtool_ops = {
34975+static const struct ethtool_ops netdev_ethtool_ops = {
34976 .get_settings = netdev_get_settings,
34977 .set_settings = netdev_set_settings,
34978 .nway_reset = netdev_nway_reset,
34979diff -urNp linux-2.6.39.1/drivers/net/mlx4/main.c linux-2.6.39.1/drivers/net/mlx4/main.c
34980--- linux-2.6.39.1/drivers/net/mlx4/main.c 2011-05-19 00:06:34.000000000 -0400
34981+++ linux-2.6.39.1/drivers/net/mlx4/main.c 2011-05-22 19:36:31.000000000 -0400
34982@@ -40,6 +40,7 @@
34983 #include <linux/dma-mapping.h>
34984 #include <linux/slab.h>
34985 #include <linux/io-mapping.h>
34986+#include <linux/sched.h>
34987
34988 #include <linux/mlx4/device.h>
34989 #include <linux/mlx4/doorbell.h>
34990@@ -764,6 +765,8 @@ static int mlx4_init_hca(struct mlx4_dev
34991 u64 icm_size;
34992 int err;
34993
34994+ pax_track_stack();
34995+
34996 err = mlx4_QUERY_FW(dev);
34997 if (err) {
34998 if (err == -EACCES)
34999diff -urNp linux-2.6.39.1/drivers/net/netconsole.c linux-2.6.39.1/drivers/net/netconsole.c
35000--- linux-2.6.39.1/drivers/net/netconsole.c 2011-05-19 00:06:34.000000000 -0400
35001+++ linux-2.6.39.1/drivers/net/netconsole.c 2011-05-22 19:36:31.000000000 -0400
35002@@ -634,7 +634,7 @@ static void drop_netconsole_target(struc
35003 config_item_put(&nt->item);
35004 }
35005
35006-static struct configfs_group_operations netconsole_subsys_group_ops = {
35007+static const struct configfs_group_operations netconsole_subsys_group_ops = {
35008 .make_item = make_netconsole_target,
35009 .drop_item = drop_netconsole_target,
35010 };
35011diff -urNp linux-2.6.39.1/drivers/net/niu.c linux-2.6.39.1/drivers/net/niu.c
35012--- linux-2.6.39.1/drivers/net/niu.c 2011-05-19 00:06:34.000000000 -0400
35013+++ linux-2.6.39.1/drivers/net/niu.c 2011-05-22 19:36:31.000000000 -0400
35014@@ -9067,6 +9067,8 @@ static void __devinit niu_try_msix(struc
35015 int i, num_irqs, err;
35016 u8 first_ldg;
35017
35018+ pax_track_stack();
35019+
35020 first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
35021 for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
35022 ldg_num_map[i] = first_ldg + i;
35023diff -urNp linux-2.6.39.1/drivers/net/pcnet32.c linux-2.6.39.1/drivers/net/pcnet32.c
35024--- linux-2.6.39.1/drivers/net/pcnet32.c 2011-05-19 00:06:34.000000000 -0400
35025+++ linux-2.6.39.1/drivers/net/pcnet32.c 2011-05-22 19:36:31.000000000 -0400
35026@@ -82,7 +82,7 @@ static int cards_found;
35027 /*
35028 * VLB I/O addresses
35029 */
35030-static unsigned int pcnet32_portlist[] __initdata =
35031+static unsigned int pcnet32_portlist[] __devinitdata =
35032 { 0x300, 0x320, 0x340, 0x360, 0 };
35033
35034 static int pcnet32_debug;
35035@@ -379,7 +379,7 @@ static int pcnet32_wio_check(unsigned lo
35036 return inw(addr + PCNET32_WIO_RAP) == 88;
35037 }
35038
35039-static struct pcnet32_access pcnet32_wio = {
35040+static const struct pcnet32_access pcnet32_wio = {
35041 .read_csr = pcnet32_wio_read_csr,
35042 .write_csr = pcnet32_wio_write_csr,
35043 .read_bcr = pcnet32_wio_read_bcr,
35044@@ -434,7 +434,7 @@ static int pcnet32_dwio_check(unsigned l
35045 return (inl(addr + PCNET32_DWIO_RAP) & 0xffff) == 88;
35046 }
35047
35048-static struct pcnet32_access pcnet32_dwio = {
35049+static const struct pcnet32_access pcnet32_dwio = {
35050 .read_csr = pcnet32_dwio_read_csr,
35051 .write_csr = pcnet32_dwio_write_csr,
35052 .read_bcr = pcnet32_dwio_read_bcr,
35053@@ -1546,7 +1546,7 @@ pcnet32_probe1(unsigned long ioaddr, int
35054 int chip_version;
35055 char *chipname;
35056 struct net_device *dev;
35057- struct pcnet32_access *a = NULL;
35058+ const struct pcnet32_access *a = NULL;
35059 u8 promaddr[6];
35060 int ret = -ENODEV;
35061
35062diff -urNp linux-2.6.39.1/drivers/net/ppp_generic.c linux-2.6.39.1/drivers/net/ppp_generic.c
35063--- linux-2.6.39.1/drivers/net/ppp_generic.c 2011-05-19 00:06:34.000000000 -0400
35064+++ linux-2.6.39.1/drivers/net/ppp_generic.c 2011-05-22 19:36:31.000000000 -0400
35065@@ -987,7 +987,6 @@ ppp_net_ioctl(struct net_device *dev, st
35066 void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
35067 struct ppp_stats stats;
35068 struct ppp_comp_stats cstats;
35069- char *vers;
35070
35071 switch (cmd) {
35072 case SIOCGPPPSTATS:
35073@@ -1009,8 +1008,7 @@ ppp_net_ioctl(struct net_device *dev, st
35074 break;
35075
35076 case SIOCGPPPVER:
35077- vers = PPP_VERSION;
35078- if (copy_to_user(addr, vers, strlen(vers) + 1))
35079+ if (copy_to_user(addr, PPP_VERSION, sizeof(PPP_VERSION)))
35080 break;
35081 err = 0;
35082 break;
35083diff -urNp linux-2.6.39.1/drivers/net/qlcnic/qlcnic.h linux-2.6.39.1/drivers/net/qlcnic/qlcnic.h
35084--- linux-2.6.39.1/drivers/net/qlcnic/qlcnic.h 2011-05-19 00:06:34.000000000 -0400
35085+++ linux-2.6.39.1/drivers/net/qlcnic/qlcnic.h 2011-05-22 19:36:31.000000000 -0400
35086@@ -1037,7 +1037,7 @@ struct qlcnic_adapter {
35087 struct vlan_group *vlgrp;
35088 struct qlcnic_npar_info *npars;
35089 struct qlcnic_eswitch *eswitch;
35090- struct qlcnic_nic_template *nic_ops;
35091+ const struct qlcnic_nic_template *nic_ops;
35092
35093 struct qlcnic_adapter_stats stats;
35094
35095diff -urNp linux-2.6.39.1/drivers/net/qlcnic/qlcnic_main.c linux-2.6.39.1/drivers/net/qlcnic/qlcnic_main.c
35096--- linux-2.6.39.1/drivers/net/qlcnic/qlcnic_main.c 2011-05-19 00:06:34.000000000 -0400
35097+++ linux-2.6.39.1/drivers/net/qlcnic/qlcnic_main.c 2011-05-22 19:36:31.000000000 -0400
35098@@ -340,13 +340,13 @@ static const struct net_device_ops qlcni
35099 #endif
35100 };
35101
35102-static struct qlcnic_nic_template qlcnic_ops = {
35103+static const struct qlcnic_nic_template qlcnic_ops = {
35104 .config_bridged_mode = qlcnic_config_bridged_mode,
35105 .config_led = qlcnic_config_led,
35106 .start_firmware = qlcnic_start_firmware
35107 };
35108
35109-static struct qlcnic_nic_template qlcnic_vf_ops = {
35110+static const struct qlcnic_nic_template qlcnic_vf_ops = {
35111 .config_bridged_mode = qlcnicvf_config_bridged_mode,
35112 .config_led = qlcnicvf_config_led,
35113 .start_firmware = qlcnicvf_start_firmware
35114diff -urNp linux-2.6.39.1/drivers/net/qlge/qlge.h linux-2.6.39.1/drivers/net/qlge/qlge.h
35115--- linux-2.6.39.1/drivers/net/qlge/qlge.h 2011-05-19 00:06:34.000000000 -0400
35116+++ linux-2.6.39.1/drivers/net/qlge/qlge.h 2011-05-22 19:36:31.000000000 -0400
35117@@ -2134,7 +2134,7 @@ struct ql_adapter {
35118 struct delayed_work mpi_idc_work;
35119 struct delayed_work mpi_core_to_log;
35120 struct completion ide_completion;
35121- struct nic_operations *nic_ops;
35122+ const struct nic_operations *nic_ops;
35123 u16 device_id;
35124 struct timer_list timer;
35125 atomic_t lb_count;
35126diff -urNp linux-2.6.39.1/drivers/net/qlge/qlge_main.c linux-2.6.39.1/drivers/net/qlge/qlge_main.c
35127--- linux-2.6.39.1/drivers/net/qlge/qlge_main.c 2011-05-19 00:06:34.000000000 -0400
35128+++ linux-2.6.39.1/drivers/net/qlge/qlge_main.c 2011-05-22 19:36:31.000000000 -0400
35129@@ -4412,12 +4412,12 @@ error:
35130 rtnl_unlock();
35131 }
35132
35133-static struct nic_operations qla8012_nic_ops = {
35134+static const struct nic_operations qla8012_nic_ops = {
35135 .get_flash = ql_get_8012_flash_params,
35136 .port_initialize = ql_8012_port_initialize,
35137 };
35138
35139-static struct nic_operations qla8000_nic_ops = {
35140+static const struct nic_operations qla8000_nic_ops = {
35141 .get_flash = ql_get_8000_flash_params,
35142 .port_initialize = ql_8000_port_initialize,
35143 };
35144diff -urNp linux-2.6.39.1/drivers/net/sfc/falcon.c linux-2.6.39.1/drivers/net/sfc/falcon.c
35145--- linux-2.6.39.1/drivers/net/sfc/falcon.c 2011-05-19 00:06:34.000000000 -0400
35146+++ linux-2.6.39.1/drivers/net/sfc/falcon.c 2011-05-22 19:36:31.000000000 -0400
35147@@ -1703,7 +1703,7 @@ static int falcon_set_wol(struct efx_nic
35148 **************************************************************************
35149 */
35150
35151-struct efx_nic_type falcon_a1_nic_type = {
35152+const struct efx_nic_type falcon_a1_nic_type = {
35153 .probe = falcon_probe_nic,
35154 .remove = falcon_remove_nic,
35155 .init = falcon_init_nic,
35156@@ -1744,7 +1744,7 @@ struct efx_nic_type falcon_a1_nic_type =
35157 .reset_world_flags = ETH_RESET_IRQ,
35158 };
35159
35160-struct efx_nic_type falcon_b0_nic_type = {
35161+const struct efx_nic_type falcon_b0_nic_type = {
35162 .probe = falcon_probe_nic,
35163 .remove = falcon_remove_nic,
35164 .init = falcon_init_nic,
35165diff -urNp linux-2.6.39.1/drivers/net/sfc/mtd.c linux-2.6.39.1/drivers/net/sfc/mtd.c
35166--- linux-2.6.39.1/drivers/net/sfc/mtd.c 2011-05-19 00:06:34.000000000 -0400
35167+++ linux-2.6.39.1/drivers/net/sfc/mtd.c 2011-05-22 19:36:31.000000000 -0400
35168@@ -382,7 +382,7 @@ static int falcon_mtd_sync(struct mtd_in
35169 return rc;
35170 }
35171
35172-static struct efx_mtd_ops falcon_mtd_ops = {
35173+static const struct efx_mtd_ops falcon_mtd_ops = {
35174 .read = falcon_mtd_read,
35175 .erase = falcon_mtd_erase,
35176 .write = falcon_mtd_write,
35177@@ -560,7 +560,7 @@ static int siena_mtd_sync(struct mtd_inf
35178 return rc;
35179 }
35180
35181-static struct efx_mtd_ops siena_mtd_ops = {
35182+static const struct efx_mtd_ops siena_mtd_ops = {
35183 .read = siena_mtd_read,
35184 .erase = siena_mtd_erase,
35185 .write = siena_mtd_write,
35186diff -urNp linux-2.6.39.1/drivers/net/sfc/nic.h linux-2.6.39.1/drivers/net/sfc/nic.h
35187--- linux-2.6.39.1/drivers/net/sfc/nic.h 2011-05-19 00:06:34.000000000 -0400
35188+++ linux-2.6.39.1/drivers/net/sfc/nic.h 2011-05-22 19:36:31.000000000 -0400
35189@@ -152,9 +152,9 @@ struct siena_nic_data {
35190 int wol_filter_id;
35191 };
35192
35193-extern struct efx_nic_type falcon_a1_nic_type;
35194-extern struct efx_nic_type falcon_b0_nic_type;
35195-extern struct efx_nic_type siena_a0_nic_type;
35196+extern const struct efx_nic_type falcon_a1_nic_type;
35197+extern const struct efx_nic_type falcon_b0_nic_type;
35198+extern const struct efx_nic_type siena_a0_nic_type;
35199
35200 /**************************************************************************
35201 *
35202diff -urNp linux-2.6.39.1/drivers/net/sfc/siena.c linux-2.6.39.1/drivers/net/sfc/siena.c
35203--- linux-2.6.39.1/drivers/net/sfc/siena.c 2011-05-19 00:06:34.000000000 -0400
35204+++ linux-2.6.39.1/drivers/net/sfc/siena.c 2011-05-22 19:36:31.000000000 -0400
35205@@ -599,7 +599,7 @@ static void siena_init_wol(struct efx_ni
35206 **************************************************************************
35207 */
35208
35209-struct efx_nic_type siena_a0_nic_type = {
35210+const struct efx_nic_type siena_a0_nic_type = {
35211 .probe = siena_probe_nic,
35212 .remove = siena_remove_nic,
35213 .init = siena_init_nic,
35214diff -urNp linux-2.6.39.1/drivers/net/sh_eth.c linux-2.6.39.1/drivers/net/sh_eth.c
35215--- linux-2.6.39.1/drivers/net/sh_eth.c 2011-05-19 00:06:34.000000000 -0400
35216+++ linux-2.6.39.1/drivers/net/sh_eth.c 2011-05-22 19:36:31.000000000 -0400
35217@@ -1360,7 +1360,7 @@ static void sh_eth_get_strings(struct ne
35218 }
35219 }
35220
35221-static struct ethtool_ops sh_eth_ethtool_ops = {
35222+static const struct ethtool_ops sh_eth_ethtool_ops = {
35223 .get_settings = sh_eth_get_settings,
35224 .set_settings = sh_eth_set_settings,
35225 .nway_reset = sh_eth_nway_reset,
35226diff -urNp linux-2.6.39.1/drivers/net/stmmac/stmmac_ethtool.c linux-2.6.39.1/drivers/net/stmmac/stmmac_ethtool.c
35227--- linux-2.6.39.1/drivers/net/stmmac/stmmac_ethtool.c 2011-05-19 00:06:34.000000000 -0400
35228+++ linux-2.6.39.1/drivers/net/stmmac/stmmac_ethtool.c 2011-05-22 19:36:31.000000000 -0400
35229@@ -348,7 +348,7 @@ static int stmmac_set_wol(struct net_dev
35230 return 0;
35231 }
35232
35233-static struct ethtool_ops stmmac_ethtool_ops = {
35234+static const struct ethtool_ops stmmac_ethtool_ops = {
35235 .begin = stmmac_check_if_running,
35236 .get_drvinfo = stmmac_ethtool_getdrvinfo,
35237 .get_settings = stmmac_ethtool_getsettings,
35238diff -urNp linux-2.6.39.1/drivers/net/sungem_phy.c linux-2.6.39.1/drivers/net/sungem_phy.c
35239--- linux-2.6.39.1/drivers/net/sungem_phy.c 2011-05-19 00:06:34.000000000 -0400
35240+++ linux-2.6.39.1/drivers/net/sungem_phy.c 2011-05-22 19:36:31.000000000 -0400
35241@@ -886,7 +886,7 @@ static int marvell_read_link(struct mii_
35242 SUPPORTED_1000baseT_Half | SUPPORTED_1000baseT_Full)
35243
35244 /* Broadcom BCM 5201 */
35245-static struct mii_phy_ops bcm5201_phy_ops = {
35246+static const struct mii_phy_ops bcm5201_phy_ops = {
35247 .init = bcm5201_init,
35248 .suspend = bcm5201_suspend,
35249 .setup_aneg = genmii_setup_aneg,
35250@@ -905,7 +905,7 @@ static struct mii_phy_def bcm5201_phy_de
35251 };
35252
35253 /* Broadcom BCM 5221 */
35254-static struct mii_phy_ops bcm5221_phy_ops = {
35255+static const struct mii_phy_ops bcm5221_phy_ops = {
35256 .suspend = bcm5221_suspend,
35257 .init = bcm5221_init,
35258 .setup_aneg = genmii_setup_aneg,
35259@@ -924,7 +924,7 @@ static struct mii_phy_def bcm5221_phy_de
35260 };
35261
35262 /* Broadcom BCM 5241 */
35263-static struct mii_phy_ops bcm5241_phy_ops = {
35264+static const struct mii_phy_ops bcm5241_phy_ops = {
35265 .suspend = bcm5241_suspend,
35266 .init = bcm5241_init,
35267 .setup_aneg = genmii_setup_aneg,
35268@@ -942,7 +942,7 @@ static struct mii_phy_def bcm5241_phy_de
35269 };
35270
35271 /* Broadcom BCM 5400 */
35272-static struct mii_phy_ops bcm5400_phy_ops = {
35273+static const struct mii_phy_ops bcm5400_phy_ops = {
35274 .init = bcm5400_init,
35275 .suspend = bcm5400_suspend,
35276 .setup_aneg = bcm54xx_setup_aneg,
35277@@ -961,7 +961,7 @@ static struct mii_phy_def bcm5400_phy_de
35278 };
35279
35280 /* Broadcom BCM 5401 */
35281-static struct mii_phy_ops bcm5401_phy_ops = {
35282+static const struct mii_phy_ops bcm5401_phy_ops = {
35283 .init = bcm5401_init,
35284 .suspend = bcm5401_suspend,
35285 .setup_aneg = bcm54xx_setup_aneg,
35286@@ -980,7 +980,7 @@ static struct mii_phy_def bcm5401_phy_de
35287 };
35288
35289 /* Broadcom BCM 5411 */
35290-static struct mii_phy_ops bcm5411_phy_ops = {
35291+static const struct mii_phy_ops bcm5411_phy_ops = {
35292 .init = bcm5411_init,
35293 .suspend = generic_suspend,
35294 .setup_aneg = bcm54xx_setup_aneg,
35295@@ -999,7 +999,7 @@ static struct mii_phy_def bcm5411_phy_de
35296 };
35297
35298 /* Broadcom BCM 5421 */
35299-static struct mii_phy_ops bcm5421_phy_ops = {
35300+static const struct mii_phy_ops bcm5421_phy_ops = {
35301 .init = bcm5421_init,
35302 .suspend = generic_suspend,
35303 .setup_aneg = bcm54xx_setup_aneg,
35304@@ -1019,7 +1019,7 @@ static struct mii_phy_def bcm5421_phy_de
35305 };
35306
35307 /* Broadcom BCM 5421 built-in K2 */
35308-static struct mii_phy_ops bcm5421k2_phy_ops = {
35309+static const struct mii_phy_ops bcm5421k2_phy_ops = {
35310 .init = bcm5421_init,
35311 .suspend = generic_suspend,
35312 .setup_aneg = bcm54xx_setup_aneg,
35313@@ -1037,7 +1037,7 @@ static struct mii_phy_def bcm5421k2_phy_
35314 .ops = &bcm5421k2_phy_ops
35315 };
35316
35317-static struct mii_phy_ops bcm5461_phy_ops = {
35318+static const struct mii_phy_ops bcm5461_phy_ops = {
35319 .init = bcm5421_init,
35320 .suspend = generic_suspend,
35321 .setup_aneg = bcm54xx_setup_aneg,
35322@@ -1057,7 +1057,7 @@ static struct mii_phy_def bcm5461_phy_de
35323 };
35324
35325 /* Broadcom BCM 5462 built-in Vesta */
35326-static struct mii_phy_ops bcm5462V_phy_ops = {
35327+static const struct mii_phy_ops bcm5462V_phy_ops = {
35328 .init = bcm5421_init,
35329 .suspend = generic_suspend,
35330 .setup_aneg = bcm54xx_setup_aneg,
35331@@ -1076,7 +1076,7 @@ static struct mii_phy_def bcm5462V_phy_d
35332 };
35333
35334 /* Marvell 88E1101 amd 88E1111 */
35335-static struct mii_phy_ops marvell88e1101_phy_ops = {
35336+static const struct mii_phy_ops marvell88e1101_phy_ops = {
35337 .suspend = generic_suspend,
35338 .setup_aneg = marvell_setup_aneg,
35339 .setup_forced = marvell_setup_forced,
35340@@ -1084,7 +1084,7 @@ static struct mii_phy_ops marvell88e1101
35341 .read_link = marvell_read_link
35342 };
35343
35344-static struct mii_phy_ops marvell88e1111_phy_ops = {
35345+static const struct mii_phy_ops marvell88e1111_phy_ops = {
35346 .init = marvell88e1111_init,
35347 .suspend = generic_suspend,
35348 .setup_aneg = marvell_setup_aneg,
35349@@ -1122,7 +1122,7 @@ static struct mii_phy_def marvell88e1111
35350 };
35351
35352 /* Generic implementation for most 10/100 PHYs */
35353-static struct mii_phy_ops generic_phy_ops = {
35354+static const struct mii_phy_ops generic_phy_ops = {
35355 .setup_aneg = genmii_setup_aneg,
35356 .setup_forced = genmii_setup_forced,
35357 .poll_link = genmii_poll_link,
35358diff -urNp linux-2.6.39.1/drivers/net/tg3.h linux-2.6.39.1/drivers/net/tg3.h
35359--- linux-2.6.39.1/drivers/net/tg3.h 2011-05-19 00:06:34.000000000 -0400
35360+++ linux-2.6.39.1/drivers/net/tg3.h 2011-05-22 19:36:31.000000000 -0400
35361@@ -131,6 +131,7 @@
35362 #define CHIPREV_ID_5750_A0 0x4000
35363 #define CHIPREV_ID_5750_A1 0x4001
35364 #define CHIPREV_ID_5750_A3 0x4003
35365+#define CHIPREV_ID_5750_C1 0x4201
35366 #define CHIPREV_ID_5750_C2 0x4202
35367 #define CHIPREV_ID_5752_A0_HW 0x5000
35368 #define CHIPREV_ID_5752_A0 0x6000
35369diff -urNp linux-2.6.39.1/drivers/net/tile/tilepro.c linux-2.6.39.1/drivers/net/tile/tilepro.c
35370--- linux-2.6.39.1/drivers/net/tile/tilepro.c 2011-05-19 00:06:34.000000000 -0400
35371+++ linux-2.6.39.1/drivers/net/tile/tilepro.c 2011-05-22 19:36:31.000000000 -0400
35372@@ -2263,7 +2263,7 @@ static int tile_net_get_mac(struct net_d
35373 }
35374
35375
35376-static struct net_device_ops tile_net_ops = {
35377+static const struct net_device_ops tile_net_ops = {
35378 .ndo_open = tile_net_open,
35379 .ndo_stop = tile_net_stop,
35380 .ndo_start_xmit = tile_net_tx,
35381diff -urNp linux-2.6.39.1/drivers/net/tulip/de2104x.c linux-2.6.39.1/drivers/net/tulip/de2104x.c
35382--- linux-2.6.39.1/drivers/net/tulip/de2104x.c 2011-05-19 00:06:34.000000000 -0400
35383+++ linux-2.6.39.1/drivers/net/tulip/de2104x.c 2011-05-22 19:36:31.000000000 -0400
35384@@ -1817,6 +1817,8 @@ static void __devinit de21041_get_srom_i
35385 struct de_srom_info_leaf *il;
35386 void *bufp;
35387
35388+ pax_track_stack();
35389+
35390 /* download entire eeprom */
35391 for (i = 0; i < DE_EEPROM_WORDS; i++)
35392 ((__le16 *)ee_data)[i] =
35393diff -urNp linux-2.6.39.1/drivers/net/tulip/de4x5.c linux-2.6.39.1/drivers/net/tulip/de4x5.c
35394--- linux-2.6.39.1/drivers/net/tulip/de4x5.c 2011-05-19 00:06:34.000000000 -0400
35395+++ linux-2.6.39.1/drivers/net/tulip/de4x5.c 2011-05-22 19:36:31.000000000 -0400
35396@@ -5401,7 +5401,7 @@ de4x5_ioctl(struct net_device *dev, stru
35397 for (i=0; i<ETH_ALEN; i++) {
35398 tmp.addr[i] = dev->dev_addr[i];
35399 }
35400- if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
35401+ if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
35402 break;
35403
35404 case DE4X5_SET_HWADDR: /* Set the hardware address */
35405@@ -5441,7 +5441,7 @@ de4x5_ioctl(struct net_device *dev, stru
35406 spin_lock_irqsave(&lp->lock, flags);
35407 memcpy(&statbuf, &lp->pktStats, ioc->len);
35408 spin_unlock_irqrestore(&lp->lock, flags);
35409- if (copy_to_user(ioc->data, &statbuf, ioc->len))
35410+ if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
35411 return -EFAULT;
35412 break;
35413 }
35414diff -urNp linux-2.6.39.1/drivers/net/usb/asix.c linux-2.6.39.1/drivers/net/usb/asix.c
35415--- linux-2.6.39.1/drivers/net/usb/asix.c 2011-05-19 00:06:34.000000000 -0400
35416+++ linux-2.6.39.1/drivers/net/usb/asix.c 2011-05-22 19:36:31.000000000 -0400
35417@@ -1098,7 +1098,7 @@ out:
35418 return ret;
35419 }
35420
35421-static struct ethtool_ops ax88178_ethtool_ops = {
35422+static const struct ethtool_ops ax88178_ethtool_ops = {
35423 .get_drvinfo = asix_get_drvinfo,
35424 .get_link = asix_get_link,
35425 .get_msglevel = usbnet_get_msglevel,
35426diff -urNp linux-2.6.39.1/drivers/net/usb/cdc_ncm.c linux-2.6.39.1/drivers/net/usb/cdc_ncm.c
35427--- linux-2.6.39.1/drivers/net/usb/cdc_ncm.c 2011-05-19 00:06:34.000000000 -0400
35428+++ linux-2.6.39.1/drivers/net/usb/cdc_ncm.c 2011-05-22 19:36:31.000000000 -0400
35429@@ -141,7 +141,7 @@ struct cdc_ncm_ctx {
35430 static void cdc_ncm_tx_timeout(unsigned long arg);
35431 static const struct driver_info cdc_ncm_info;
35432 static struct usb_driver cdc_ncm_driver;
35433-static struct ethtool_ops cdc_ncm_ethtool_ops;
35434+static const struct ethtool_ops cdc_ncm_ethtool_ops;
35435
35436 static const struct usb_device_id cdc_devs[] = {
35437 { USB_INTERFACE_INFO(USB_CLASS_COMM,
35438@@ -1257,7 +1257,7 @@ static struct usb_driver cdc_ncm_driver
35439 .supports_autosuspend = 1,
35440 };
35441
35442-static struct ethtool_ops cdc_ncm_ethtool_ops = {
35443+static const struct ethtool_ops cdc_ncm_ethtool_ops = {
35444 .get_drvinfo = cdc_ncm_get_drvinfo,
35445 .get_link = usbnet_get_link,
35446 .get_msglevel = usbnet_get_msglevel,
35447diff -urNp linux-2.6.39.1/drivers/net/usb/hso.c linux-2.6.39.1/drivers/net/usb/hso.c
35448--- linux-2.6.39.1/drivers/net/usb/hso.c 2011-05-19 00:06:34.000000000 -0400
35449+++ linux-2.6.39.1/drivers/net/usb/hso.c 2011-05-22 19:36:31.000000000 -0400
35450@@ -71,7 +71,7 @@
35451 #include <asm/byteorder.h>
35452 #include <linux/serial_core.h>
35453 #include <linux/serial.h>
35454-
35455+#include <asm/local.h>
35456
35457 #define MOD_AUTHOR "Option Wireless"
35458 #define MOD_DESCRIPTION "USB High Speed Option driver"
35459@@ -257,7 +257,7 @@ struct hso_serial {
35460
35461 /* from usb_serial_port */
35462 struct tty_struct *tty;
35463- int open_count;
35464+ local_t open_count;
35465 spinlock_t serial_lock;
35466
35467 int (*write_data) (struct hso_serial *serial);
35468@@ -1190,7 +1190,7 @@ static void put_rxbuf_data_and_resubmit_
35469 struct urb *urb;
35470
35471 urb = serial->rx_urb[0];
35472- if (serial->open_count > 0) {
35473+ if (local_read(&serial->open_count) > 0) {
35474 count = put_rxbuf_data(urb, serial);
35475 if (count == -1)
35476 return;
35477@@ -1226,7 +1226,7 @@ static void hso_std_serial_read_bulk_cal
35478 DUMP1(urb->transfer_buffer, urb->actual_length);
35479
35480 /* Anyone listening? */
35481- if (serial->open_count == 0)
35482+ if (local_read(&serial->open_count) == 0)
35483 return;
35484
35485 if (status == 0) {
35486@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
35487 spin_unlock_irq(&serial->serial_lock);
35488
35489 /* check for port already opened, if not set the termios */
35490- serial->open_count++;
35491- if (serial->open_count == 1) {
35492+ if (local_inc_return(&serial->open_count) == 1) {
35493 serial->rx_state = RX_IDLE;
35494 /* Force default termio settings */
35495 _hso_serial_set_termios(tty, NULL);
35496@@ -1324,7 +1323,7 @@ static int hso_serial_open(struct tty_st
35497 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
35498 if (result) {
35499 hso_stop_serial_device(serial->parent);
35500- serial->open_count--;
35501+ local_dec(&serial->open_count);
35502 kref_put(&serial->parent->ref, hso_serial_ref_free);
35503 }
35504 } else {
35505@@ -1361,10 +1360,10 @@ static void hso_serial_close(struct tty_
35506
35507 /* reset the rts and dtr */
35508 /* do the actual close */
35509- serial->open_count--;
35510+ local_dec(&serial->open_count);
35511
35512- if (serial->open_count <= 0) {
35513- serial->open_count = 0;
35514+ if (local_read(&serial->open_count) <= 0) {
35515+ local_set(&serial->open_count, 0);
35516 spin_lock_irq(&serial->serial_lock);
35517 if (serial->tty == tty) {
35518 serial->tty->driver_data = NULL;
35519@@ -1446,7 +1445,7 @@ static void hso_serial_set_termios(struc
35520
35521 /* the actual setup */
35522 spin_lock_irqsave(&serial->serial_lock, flags);
35523- if (serial->open_count)
35524+ if (local_read(&serial->open_count))
35525 _hso_serial_set_termios(tty, old);
35526 else
35527 tty->termios = old;
35528@@ -1905,7 +1904,7 @@ static void intr_callback(struct urb *ur
35529 D1("Pending read interrupt on port %d\n", i);
35530 spin_lock(&serial->serial_lock);
35531 if (serial->rx_state == RX_IDLE &&
35532- serial->open_count > 0) {
35533+ local_read(&serial->open_count) > 0) {
35534 /* Setup and send a ctrl req read on
35535 * port i */
35536 if (!serial->rx_urb_filled[0]) {
35537@@ -3097,7 +3096,7 @@ static int hso_resume(struct usb_interfa
35538 /* Start all serial ports */
35539 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
35540 if (serial_table[i] && (serial_table[i]->interface == iface)) {
35541- if (dev2ser(serial_table[i])->open_count) {
35542+ if (local_read(&dev2ser(serial_table[i])->open_count)) {
35543 result =
35544 hso_start_serial_device(serial_table[i], GFP_NOIO);
35545 hso_kick_transmit(dev2ser(serial_table[i]));
35546diff -urNp linux-2.6.39.1/drivers/net/usb/ipheth.c linux-2.6.39.1/drivers/net/usb/ipheth.c
35547--- linux-2.6.39.1/drivers/net/usb/ipheth.c 2011-05-19 00:06:34.000000000 -0400
35548+++ linux-2.6.39.1/drivers/net/usb/ipheth.c 2011-05-22 19:36:31.000000000 -0400
35549@@ -421,7 +421,7 @@ static u32 ipheth_ethtool_op_get_link(st
35550 return netif_carrier_ok(dev->net);
35551 }
35552
35553-static struct ethtool_ops ops = {
35554+static const struct ethtool_ops ops = {
35555 .get_link = ipheth_ethtool_op_get_link
35556 };
35557
35558diff -urNp linux-2.6.39.1/drivers/net/usb/sierra_net.c linux-2.6.39.1/drivers/net/usb/sierra_net.c
35559--- linux-2.6.39.1/drivers/net/usb/sierra_net.c 2011-05-19 00:06:34.000000000 -0400
35560+++ linux-2.6.39.1/drivers/net/usb/sierra_net.c 2011-05-22 19:36:31.000000000 -0400
35561@@ -618,7 +618,7 @@ static u32 sierra_net_get_link(struct ne
35562 return sierra_net_get_private(dev)->link_up && netif_running(net);
35563 }
35564
35565-static struct ethtool_ops sierra_net_ethtool_ops = {
35566+static const struct ethtool_ops sierra_net_ethtool_ops = {
35567 .get_drvinfo = sierra_net_get_drvinfo,
35568 .get_link = sierra_net_get_link,
35569 .get_msglevel = usbnet_get_msglevel,
35570diff -urNp linux-2.6.39.1/drivers/net/vmxnet3/vmxnet3_ethtool.c linux-2.6.39.1/drivers/net/vmxnet3/vmxnet3_ethtool.c
35571--- linux-2.6.39.1/drivers/net/vmxnet3/vmxnet3_ethtool.c 2011-05-19 00:06:34.000000000 -0400
35572+++ linux-2.6.39.1/drivers/net/vmxnet3/vmxnet3_ethtool.c 2011-05-22 19:36:31.000000000 -0400
35573@@ -631,8 +631,7 @@ vmxnet3_set_rss_indir(struct net_device
35574 * Return with error code if any of the queue indices
35575 * is out of range
35576 */
35577- if (p->ring_index[i] < 0 ||
35578- p->ring_index[i] >= adapter->num_rx_queues)
35579+ if (p->ring_index[i] >= adapter->num_rx_queues)
35580 return -EINVAL;
35581 }
35582
35583diff -urNp linux-2.6.39.1/drivers/net/vxge/vxge-config.h linux-2.6.39.1/drivers/net/vxge/vxge-config.h
35584--- linux-2.6.39.1/drivers/net/vxge/vxge-config.h 2011-05-19 00:06:34.000000000 -0400
35585+++ linux-2.6.39.1/drivers/net/vxge/vxge-config.h 2011-05-22 19:36:31.000000000 -0400
35586@@ -834,7 +834,7 @@ struct vxge_hw_device_hw_info {
35587 struct vxge_hw_device_attr {
35588 void __iomem *bar0;
35589 struct pci_dev *pdev;
35590- struct vxge_hw_uld_cbs uld_callbacks;
35591+ struct vxge_hw_uld_cbs uld_callbacks;
35592 };
35593
35594 #define VXGE_HW_DEVICE_LINK_STATE_SET(hldev, ls) (hldev->link_state = ls)
35595diff -urNp linux-2.6.39.1/drivers/net/vxge/vxge-main.c linux-2.6.39.1/drivers/net/vxge/vxge-main.c
35596--- linux-2.6.39.1/drivers/net/vxge/vxge-main.c 2011-05-19 00:06:34.000000000 -0400
35597+++ linux-2.6.39.1/drivers/net/vxge/vxge-main.c 2011-05-22 19:36:31.000000000 -0400
35598@@ -97,6 +97,8 @@ static inline void VXGE_COMPLETE_VPATH_T
35599 struct sk_buff *completed[NR_SKB_COMPLETED];
35600 int more;
35601
35602+ pax_track_stack();
35603+
35604 do {
35605 more = 0;
35606 skb_ptr = completed;
35607@@ -1927,6 +1929,8 @@ static enum vxge_hw_status vxge_rth_conf
35608 u8 mtable[256] = {0}; /* CPU to vpath mapping */
35609 int index;
35610
35611+ pax_track_stack();
35612+
35613 /*
35614 * Filling
35615 * - itable with bucket numbers
35616diff -urNp linux-2.6.39.1/drivers/net/wan/cycx_x25.c linux-2.6.39.1/drivers/net/wan/cycx_x25.c
35617--- linux-2.6.39.1/drivers/net/wan/cycx_x25.c 2011-05-19 00:06:34.000000000 -0400
35618+++ linux-2.6.39.1/drivers/net/wan/cycx_x25.c 2011-05-22 19:36:31.000000000 -0400
35619@@ -1018,6 +1018,8 @@ static void hex_dump(char *msg, unsigned
35620 unsigned char hex[1024],
35621 * phex = hex;
35622
35623+ pax_track_stack();
35624+
35625 if (len >= (sizeof(hex) / 2))
35626 len = (sizeof(hex) / 2) - 1;
35627
35628diff -urNp linux-2.6.39.1/drivers/net/wan/lapbether.c linux-2.6.39.1/drivers/net/wan/lapbether.c
35629--- linux-2.6.39.1/drivers/net/wan/lapbether.c 2011-05-19 00:06:34.000000000 -0400
35630+++ linux-2.6.39.1/drivers/net/wan/lapbether.c 2011-05-22 19:36:31.000000000 -0400
35631@@ -259,7 +259,7 @@ static int lapbeth_set_mac_address(struc
35632 }
35633
35634
35635-static struct lapb_register_struct lapbeth_callbacks = {
35636+static const struct lapb_register_struct lapbeth_callbacks = {
35637 .connect_confirmation = lapbeth_connected,
35638 .connect_indication = lapbeth_connected,
35639 .disconnect_confirmation = lapbeth_disconnected,
35640diff -urNp linux-2.6.39.1/drivers/net/wan/x25_asy.c linux-2.6.39.1/drivers/net/wan/x25_asy.c
35641--- linux-2.6.39.1/drivers/net/wan/x25_asy.c 2011-05-19 00:06:34.000000000 -0400
35642+++ linux-2.6.39.1/drivers/net/wan/x25_asy.c 2011-05-22 19:36:31.000000000 -0400
35643@@ -434,7 +434,7 @@ static void x25_asy_disconnected(struct
35644 netif_rx(skb);
35645 }
35646
35647-static struct lapb_register_struct x25_asy_callbacks = {
35648+static const struct lapb_register_struct x25_asy_callbacks = {
35649 .connect_confirmation = x25_asy_connected,
35650 .connect_indication = x25_asy_connected,
35651 .disconnect_confirmation = x25_asy_disconnected,
35652diff -urNp linux-2.6.39.1/drivers/net/wimax/i2400m/usb-fw.c linux-2.6.39.1/drivers/net/wimax/i2400m/usb-fw.c
35653--- linux-2.6.39.1/drivers/net/wimax/i2400m/usb-fw.c 2011-05-19 00:06:34.000000000 -0400
35654+++ linux-2.6.39.1/drivers/net/wimax/i2400m/usb-fw.c 2011-05-22 19:36:31.000000000 -0400
35655@@ -287,6 +287,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(stru
35656 int do_autopm = 1;
35657 DECLARE_COMPLETION_ONSTACK(notif_completion);
35658
35659+ pax_track_stack();
35660+
35661 d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
35662 i2400m, ack, ack_size);
35663 BUG_ON(_ack == i2400m->bm_ack_buf);
35664diff -urNp linux-2.6.39.1/drivers/net/wireless/airo.c linux-2.6.39.1/drivers/net/wireless/airo.c
35665--- linux-2.6.39.1/drivers/net/wireless/airo.c 2011-05-19 00:06:34.000000000 -0400
35666+++ linux-2.6.39.1/drivers/net/wireless/airo.c 2011-05-22 19:36:31.000000000 -0400
35667@@ -3001,6 +3001,8 @@ static void airo_process_scan_results (s
35668 BSSListElement * loop_net;
35669 BSSListElement * tmp_net;
35670
35671+ pax_track_stack();
35672+
35673 /* Blow away current list of scan results */
35674 list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
35675 list_move_tail (&loop_net->list, &ai->network_free_list);
35676@@ -3792,6 +3794,8 @@ static u16 setup_card(struct airo_info *
35677 WepKeyRid wkr;
35678 int rc;
35679
35680+ pax_track_stack();
35681+
35682 memset( &mySsid, 0, sizeof( mySsid ) );
35683 kfree (ai->flash);
35684 ai->flash = NULL;
35685@@ -4760,6 +4764,8 @@ static int proc_stats_rid_open( struct i
35686 __le32 *vals = stats.vals;
35687 int len;
35688
35689+ pax_track_stack();
35690+
35691 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
35692 return -ENOMEM;
35693 data = file->private_data;
35694@@ -5483,6 +5489,8 @@ static int proc_BSSList_open( struct ino
35695 /* If doLoseSync is not 1, we won't do a Lose Sync */
35696 int doLoseSync = -1;
35697
35698+ pax_track_stack();
35699+
35700 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
35701 return -ENOMEM;
35702 data = file->private_data;
35703@@ -7190,6 +7198,8 @@ static int airo_get_aplist(struct net_de
35704 int i;
35705 int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
35706
35707+ pax_track_stack();
35708+
35709 qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
35710 if (!qual)
35711 return -ENOMEM;
35712@@ -7750,6 +7760,8 @@ static void airo_read_wireless_stats(str
35713 CapabilityRid cap_rid;
35714 __le32 *vals = stats_rid.vals;
35715
35716+ pax_track_stack();
35717+
35718 /* Get stats out of the card */
35719 clear_bit(JOB_WSTATS, &local->jobs);
35720 if (local->power.event) {
35721diff -urNp linux-2.6.39.1/drivers/net/wireless/ath/ath5k/debug.c linux-2.6.39.1/drivers/net/wireless/ath/ath5k/debug.c
35722--- linux-2.6.39.1/drivers/net/wireless/ath/ath5k/debug.c 2011-05-19 00:06:34.000000000 -0400
35723+++ linux-2.6.39.1/drivers/net/wireless/ath/ath5k/debug.c 2011-05-22 19:36:31.000000000 -0400
35724@@ -204,6 +204,8 @@ static ssize_t read_file_beacon(struct f
35725 unsigned int v;
35726 u64 tsf;
35727
35728+ pax_track_stack();
35729+
35730 v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON);
35731 len += snprintf(buf+len, sizeof(buf)-len,
35732 "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
35733@@ -323,6 +325,8 @@ static ssize_t read_file_debug(struct fi
35734 unsigned int len = 0;
35735 unsigned int i;
35736
35737+ pax_track_stack();
35738+
35739 len += snprintf(buf+len, sizeof(buf)-len,
35740 "DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
35741
35742@@ -384,6 +388,8 @@ static ssize_t read_file_antenna(struct
35743 unsigned int i;
35744 unsigned int v;
35745
35746+ pax_track_stack();
35747+
35748 len += snprintf(buf+len, sizeof(buf)-len, "antenna mode\t%d\n",
35749 sc->ah->ah_ant_mode);
35750 len += snprintf(buf+len, sizeof(buf)-len, "default antenna\t%d\n",
35751@@ -494,6 +500,8 @@ static ssize_t read_file_misc(struct fil
35752 unsigned int len = 0;
35753 u32 filt = ath5k_hw_get_rx_filter(sc->ah);
35754
35755+ pax_track_stack();
35756+
35757 len += snprintf(buf+len, sizeof(buf)-len, "bssid-mask: %pM\n",
35758 sc->bssidmask);
35759 len += snprintf(buf+len, sizeof(buf)-len, "filter-flags: 0x%x ",
35760@@ -550,6 +558,8 @@ static ssize_t read_file_frameerrors(str
35761 unsigned int len = 0;
35762 int i;
35763
35764+ pax_track_stack();
35765+
35766 len += snprintf(buf+len, sizeof(buf)-len,
35767 "RX\n---------------------\n");
35768 len += snprintf(buf+len, sizeof(buf)-len, "CRC\t%u\t(%u%%)\n",
35769@@ -667,6 +677,8 @@ static ssize_t read_file_ani(struct file
35770 char buf[700];
35771 unsigned int len = 0;
35772
35773+ pax_track_stack();
35774+
35775 len += snprintf(buf+len, sizeof(buf)-len,
35776 "HW has PHY error counters:\t%s\n",
35777 sc->ah->ah_capabilities.cap_has_phyerr_counters ?
35778@@ -827,6 +839,8 @@ static ssize_t read_file_queue(struct fi
35779 struct ath5k_buf *bf, *bf0;
35780 int i, n;
35781
35782+ pax_track_stack();
35783+
35784 len += snprintf(buf+len, sizeof(buf)-len,
35785 "available txbuffers: %d\n", sc->txbuf_len);
35786
35787diff -urNp linux-2.6.39.1/drivers/net/wireless/ath/ath9k/ar9003_calib.c linux-2.6.39.1/drivers/net/wireless/ath/ath9k/ar9003_calib.c
35788--- linux-2.6.39.1/drivers/net/wireless/ath/ath9k/ar9003_calib.c 2011-05-19 00:06:34.000000000 -0400
35789+++ linux-2.6.39.1/drivers/net/wireless/ath/ath9k/ar9003_calib.c 2011-05-22 19:36:31.000000000 -0400
35790@@ -734,6 +734,8 @@ static void ar9003_hw_tx_iq_cal(struct a
35791 s32 i, j, ip, im, nmeasurement;
35792 u8 nchains = get_streams(common->tx_chainmask);
35793
35794+ pax_track_stack();
35795+
35796 for (ip = 0; ip < MPASS; ip++) {
35797 REG_RMW_FIELD(ah, AR_PHY_TX_IQCAL_CONTROL_1,
35798 AR_PHY_TX_IQCAQL_CONTROL_1_IQCORR_I_Q_COFF_DELPT,
35799@@ -856,6 +858,8 @@ static void ar9003_hw_tx_iq_cal_post_pro
35800 int i, ip, im, j;
35801 int nmeasurement;
35802
35803+ pax_track_stack();
35804+
35805 for (i = 0; i < AR9300_MAX_CHAINS; i++) {
35806 if (ah->txchainmask & (1 << i))
35807 num_chains++;
35808diff -urNp linux-2.6.39.1/drivers/net/wireless/ath/ath9k/ar9003_paprd.c linux-2.6.39.1/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
35809--- linux-2.6.39.1/drivers/net/wireless/ath/ath9k/ar9003_paprd.c 2011-05-19 00:06:34.000000000 -0400
35810+++ linux-2.6.39.1/drivers/net/wireless/ath/ath9k/ar9003_paprd.c 2011-05-22 19:36:31.000000000 -0400
35811@@ -356,6 +356,8 @@ static bool create_pa_curve(u32 *data_L,
35812 int theta_low_bin = 0;
35813 int i;
35814
35815+ pax_track_stack();
35816+
35817 /* disregard any bin that contains <= 16 samples */
35818 thresh_accum_cnt = 16;
35819 scale_factor = 5;
35820diff -urNp linux-2.6.39.1/drivers/net/wireless/ath/ath9k/debug.c linux-2.6.39.1/drivers/net/wireless/ath/ath9k/debug.c
35821--- linux-2.6.39.1/drivers/net/wireless/ath/ath9k/debug.c 2011-05-19 00:06:34.000000000 -0400
35822+++ linux-2.6.39.1/drivers/net/wireless/ath/ath9k/debug.c 2011-05-22 19:36:31.000000000 -0400
35823@@ -335,6 +335,8 @@ static ssize_t read_file_interrupt(struc
35824 char buf[512];
35825 unsigned int len = 0;
35826
35827+ pax_track_stack();
35828+
35829 if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
35830 len += snprintf(buf + len, sizeof(buf) - len,
35831 "%8s: %10u\n", "RXLP", sc->debug.stats.istats.rxlp);
35832@@ -422,6 +424,8 @@ static ssize_t read_file_wiphy(struct fi
35833 u8 addr[ETH_ALEN];
35834 u32 tmp;
35835
35836+ pax_track_stack();
35837+
35838 len += snprintf(buf + len, sizeof(buf) - len,
35839 "%s (chan=%d center-freq: %d MHz channel-type: %d (%s))\n",
35840 wiphy_name(sc->hw->wiphy),
35841diff -urNp linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc_drv_main.c linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc_drv_main.c
35842--- linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc_drv_main.c 2011-05-19 00:06:34.000000000 -0400
35843+++ linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc_drv_main.c 2011-05-22 19:36:31.000000000 -0400
35844@@ -737,6 +737,8 @@ static ssize_t read_file_tgt_stats(struc
35845 unsigned int len = 0;
35846 int ret = 0;
35847
35848+ pax_track_stack();
35849+
35850 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
35851
35852 WMI_CMD(WMI_TGT_STATS_CMDID);
35853@@ -782,6 +784,8 @@ static ssize_t read_file_xmit(struct fil
35854 char buf[512];
35855 unsigned int len = 0;
35856
35857+ pax_track_stack();
35858+
35859 len += snprintf(buf + len, sizeof(buf) - len,
35860 "%20s : %10u\n", "Buffers queued",
35861 priv->debug.tx_stats.buf_queued);
35862@@ -831,6 +835,8 @@ static ssize_t read_file_recv(struct fil
35863 char buf[512];
35864 unsigned int len = 0;
35865
35866+ pax_track_stack();
35867+
35868 len += snprintf(buf + len, sizeof(buf) - len,
35869 "%20s : %10u\n", "SKBs allocated",
35870 priv->debug.rx_stats.skb_allocated);
35871@@ -1816,7 +1822,7 @@ static void ath9k_htc_set_coverage_class
35872 mutex_unlock(&priv->mutex);
35873 }
35874
35875-struct ieee80211_ops ath9k_htc_ops = {
35876+const struct ieee80211_ops ath9k_htc_ops = {
35877 .tx = ath9k_htc_tx,
35878 .start = ath9k_htc_start,
35879 .stop = ath9k_htc_stop,
35880diff -urNp linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc.h linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc.h
35881--- linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc.h 2011-05-19 00:06:34.000000000 -0400
35882+++ linux-2.6.39.1/drivers/net/wireless/ath/ath9k/htc.h 2011-05-22 19:36:31.000000000 -0400
35883@@ -42,7 +42,7 @@
35884 #define TSF_TO_TU(_h, _l) \
35885 ((((u32)(_h)) << 22) | (((u32)(_l)) >> 10))
35886
35887-extern struct ieee80211_ops ath9k_htc_ops;
35888+extern const struct ieee80211_ops ath9k_htc_ops;
35889 extern int htc_modparam_nohwcrypt;
35890
35891 enum htc_phymode {
35892diff -urNp linux-2.6.39.1/drivers/net/wireless/ath/ath9k/hw.h linux-2.6.39.1/drivers/net/wireless/ath/ath9k/hw.h
35893--- linux-2.6.39.1/drivers/net/wireless/ath/ath9k/hw.h 2011-05-19 00:06:34.000000000 -0400
35894+++ linux-2.6.39.1/drivers/net/wireless/ath/ath9k/hw.h 2011-05-22 19:36:31.000000000 -0400
35895@@ -753,9 +753,7 @@ struct ath_hw {
35896 } enable_32kHz_clock;
35897
35898 /* Private to hardware code */
35899- struct ath_hw_private_ops private_ops;
35900- /* Accessed by the lower level driver */
35901- struct ath_hw_ops ops;
35902+ struct ath_hw_private_ops private_ops;struct ath_hw_ops ops;
35903
35904 /* Used to program the radio on non single-chip devices */
35905 u32 *analogBank0Data;
35906diff -urNp linux-2.6.39.1/drivers/net/wireless/b43/debugfs.c linux-2.6.39.1/drivers/net/wireless/b43/debugfs.c
35907--- linux-2.6.39.1/drivers/net/wireless/b43/debugfs.c 2011-05-19 00:06:34.000000000 -0400
35908+++ linux-2.6.39.1/drivers/net/wireless/b43/debugfs.c 2011-05-22 19:36:31.000000000 -0400
35909@@ -43,7 +43,7 @@ static struct dentry *rootdir;
35910 struct b43_debugfs_fops {
35911 ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
35912 int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
35913- struct file_operations fops;
35914+ const struct file_operations fops;
35915 /* Offset of struct b43_dfs_file in struct b43_dfsentry */
35916 size_t file_struct_offset;
35917 };
35918diff -urNp linux-2.6.39.1/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.39.1/drivers/net/wireless/b43legacy/debugfs.c
35919--- linux-2.6.39.1/drivers/net/wireless/b43legacy/debugfs.c 2011-05-19 00:06:34.000000000 -0400
35920+++ linux-2.6.39.1/drivers/net/wireless/b43legacy/debugfs.c 2011-05-22 19:36:31.000000000 -0400
35921@@ -44,7 +44,7 @@ static struct dentry *rootdir;
35922 struct b43legacy_debugfs_fops {
35923 ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
35924 int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
35925- struct file_operations fops;
35926+ const struct file_operations fops;
35927 /* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
35928 size_t file_struct_offset;
35929 /* Take wl->irq_lock before calling read/write? */
35930diff -urNp linux-2.6.39.1/drivers/net/wireless/ipw2x00/ipw2100.c linux-2.6.39.1/drivers/net/wireless/ipw2x00/ipw2100.c
35931--- linux-2.6.39.1/drivers/net/wireless/ipw2x00/ipw2100.c 2011-05-19 00:06:34.000000000 -0400
35932+++ linux-2.6.39.1/drivers/net/wireless/ipw2x00/ipw2100.c 2011-05-22 19:36:31.000000000 -0400
35933@@ -2100,6 +2100,8 @@ static int ipw2100_set_essid(struct ipw2
35934 int err;
35935 DECLARE_SSID_BUF(ssid);
35936
35937+ pax_track_stack();
35938+
35939 IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
35940
35941 if (ssid_len)
35942@@ -5449,6 +5451,8 @@ static int ipw2100_set_key(struct ipw210
35943 struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
35944 int err;
35945
35946+ pax_track_stack();
35947+
35948 IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
35949 idx, keylen, len);
35950
35951diff -urNp linux-2.6.39.1/drivers/net/wireless/ipw2x00/libipw_rx.c linux-2.6.39.1/drivers/net/wireless/ipw2x00/libipw_rx.c
35952--- linux-2.6.39.1/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-05-19 00:06:34.000000000 -0400
35953+++ linux-2.6.39.1/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-05-22 19:36:31.000000000 -0400
35954@@ -1565,6 +1565,8 @@ static void libipw_process_probe_respons
35955 unsigned long flags;
35956 DECLARE_SSID_BUF(ssid);
35957
35958+ pax_track_stack();
35959+
35960 LIBIPW_DEBUG_SCAN("'%s' (%pM"
35961 "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
35962 print_ssid(ssid, info_element->data, info_element->len),
35963diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-3945.c linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-3945.c
35964--- linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-3945.c 2011-05-19 00:06:34.000000000 -0400
35965+++ linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-3945.c 2011-05-22 19:36:31.000000000 -0400
35966@@ -2630,7 +2630,7 @@ static int iwl3945_load_bsm(struct iwl_p
35967 return 0;
35968 }
35969
35970-static struct iwl_hcmd_ops iwl3945_hcmd = {
35971+static const struct iwl_hcmd_ops iwl3945_hcmd = {
35972 .rxon_assoc = iwl3945_send_rxon_assoc,
35973 .commit_rxon = iwl3945_commit_rxon,
35974 };
35975@@ -2675,7 +2675,7 @@ static const struct iwl_legacy_ops iwl39
35976 .manage_ibss_station = iwl3945_manage_ibss_station,
35977 };
35978
35979-static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
35980+static const struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
35981 .get_hcmd_size = iwl3945_get_hcmd_size,
35982 .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
35983 .request_scan = iwl3945_request_scan,
35984diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-4965.c linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-4965.c
35985--- linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-4965.c 2011-05-19 00:06:34.000000000 -0400
35986+++ linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-4965.c 2011-05-22 19:36:32.000000000 -0400
35987@@ -1904,7 +1904,7 @@ static void iwl4965_rx_handler_setup(str
35988 priv->rx_handlers[BEACON_NOTIFICATION] = iwl4965_rx_beacon_notif;
35989 }
35990
35991-static struct iwl_hcmd_ops iwl4965_hcmd = {
35992+static const struct iwl_hcmd_ops iwl4965_hcmd = {
35993 .rxon_assoc = iwl4965_send_rxon_assoc,
35994 .commit_rxon = iwl4965_commit_rxon,
35995 .set_rxon_chain = iwl4965_set_rxon_chain,
35996@@ -2056,7 +2056,7 @@ static void iwl4965_config_ap(struct iwl
35997 iwl4965_send_beacon_cmd(priv);
35998 }
35999
36000-static struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
36001+static const struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
36002 .get_hcmd_size = iwl4965_get_hcmd_size,
36003 .build_addsta_hcmd = iwl4965_build_addsta_hcmd,
36004 .request_scan = iwl4965_request_scan,
36005@@ -2114,7 +2114,7 @@ static const struct iwl_legacy_ops iwl49
36006 .update_bcast_stations = iwl4965_update_bcast_stations,
36007 };
36008
36009-struct ieee80211_ops iwl4965_hw_ops = {
36010+const struct ieee80211_ops iwl4965_hw_ops = {
36011 .tx = iwl4965_mac_tx,
36012 .start = iwl4965_mac_start,
36013 .stop = iwl4965_mac_stop,
36014diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-4965.h linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-4965.h
36015--- linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-4965.h 2011-05-19 00:06:34.000000000 -0400
36016+++ linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-4965.h 2011-05-22 19:36:32.000000000 -0400
36017@@ -70,7 +70,7 @@ extern struct iwl_cfg iwl4965_cfg;
36018
36019 extern struct iwl_mod_params iwl4965_mod_params;
36020
36021-extern struct ieee80211_ops iwl4965_hw_ops;
36022+extern const struct ieee80211_ops iwl4965_hw_ops;
36023
36024 /* tx queue */
36025 void iwl4965_free_tfds_in_queue(struct iwl_priv *priv,
36026diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-core.h linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-core.h
36027--- linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-core.h 2011-05-19 00:06:34.000000000 -0400
36028+++ linux-2.6.39.1/drivers/net/wireless/iwlegacy/iwl-core.h 2011-05-22 19:36:32.000000000 -0400
36029@@ -150,7 +150,7 @@ struct iwl_lib_ops {
36030 int (*set_channel_switch)(struct iwl_priv *priv,
36031 struct ieee80211_channel_switch *ch_switch);
36032 /* power management */
36033- struct iwl_apm_ops apm_ops;
36034+ const struct iwl_apm_ops apm_ops;
36035
36036 /* power */
36037 int (*send_tx_power) (struct iwl_priv *priv);
36038@@ -160,12 +160,12 @@ struct iwl_lib_ops {
36039 struct iwl_eeprom_ops eeprom_ops;
36040
36041 /* temperature */
36042- struct iwl_temp_ops temp_ops;
36043+ const struct iwl_temp_ops temp_ops;
36044 /* check for plcp health */
36045 bool (*check_plcp_health)(struct iwl_priv *priv,
36046 struct iwl_rx_packet *pkt);
36047
36048- struct iwl_debugfs_ops debugfs_ops;
36049+ const struct iwl_debugfs_ops debugfs_ops;
36050
36051 };
36052
36053diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-6000.c
36054--- linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-05-19 00:06:34.000000000 -0400
36055+++ linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-05-22 19:36:32.000000000 -0400
36056@@ -422,11 +422,11 @@ static struct iwl_lib_ops iwl6030_lib =
36057 }
36058 };
36059
36060-static struct iwl_nic_ops iwl6050_nic_ops = {
36061+static const struct iwl_nic_ops iwl6050_nic_ops = {
36062 .additional_nic_config = &iwl6050_additional_nic_config,
36063 };
36064
36065-static struct iwl_nic_ops iwl6150_nic_ops = {
36066+static const struct iwl_nic_ops iwl6150_nic_ops = {
36067 .additional_nic_config = &iwl6150_additional_nic_config,
36068 };
36069
36070diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn.h linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn.h
36071--- linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn.h 2011-05-19 00:06:34.000000000 -0400
36072+++ linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn.h 2011-05-22 19:36:32.000000000 -0400
36073@@ -109,9 +109,9 @@ extern struct iwl_cfg iwl230_bg_cfg;
36074 extern struct iwl_cfg iwl230_bgn_cfg;
36075
36076 extern struct iwl_mod_params iwlagn_mod_params;
36077-extern struct iwl_hcmd_ops iwlagn_hcmd;
36078-extern struct iwl_hcmd_ops iwlagn_bt_hcmd;
36079-extern struct iwl_hcmd_utils_ops iwlagn_hcmd_utils;
36080+extern const struct iwl_hcmd_ops iwlagn_hcmd;
36081+extern const struct iwl_hcmd_ops iwlagn_bt_hcmd;
36082+extern const struct iwl_hcmd_utils_ops iwlagn_hcmd_utils;
36083
36084 extern struct ieee80211_ops iwlagn_hw_ops;
36085 extern struct ieee80211_ops iwl4965_hw_ops;
36086diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
36087--- linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c 2011-05-19 00:06:34.000000000 -0400
36088+++ linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c 2011-05-22 19:36:32.000000000 -0400
36089@@ -363,7 +363,7 @@ static int iwlagn_set_pan_params(struct
36090 return ret;
36091 }
36092
36093-struct iwl_hcmd_ops iwlagn_hcmd = {
36094+const struct iwl_hcmd_ops iwlagn_hcmd = {
36095 .rxon_assoc = iwlagn_send_rxon_assoc,
36096 .commit_rxon = iwlagn_commit_rxon,
36097 .set_rxon_chain = iwlagn_set_rxon_chain,
36098@@ -372,7 +372,7 @@ struct iwl_hcmd_ops iwlagn_hcmd = {
36099 .set_pan_params = iwlagn_set_pan_params,
36100 };
36101
36102-struct iwl_hcmd_ops iwlagn_bt_hcmd = {
36103+const struct iwl_hcmd_ops iwlagn_bt_hcmd = {
36104 .rxon_assoc = iwlagn_send_rxon_assoc,
36105 .commit_rxon = iwlagn_commit_rxon,
36106 .set_rxon_chain = iwlagn_set_rxon_chain,
36107@@ -381,7 +381,7 @@ struct iwl_hcmd_ops iwlagn_bt_hcmd = {
36108 .set_pan_params = iwlagn_set_pan_params,
36109 };
36110
36111-struct iwl_hcmd_utils_ops iwlagn_hcmd_utils = {
36112+const struct iwl_hcmd_utils_ops iwlagn_hcmd_utils = {
36113 .get_hcmd_size = iwlagn_get_hcmd_size,
36114 .build_addsta_hcmd = iwlagn_build_addsta_hcmd,
36115 .gain_computation = iwlagn_gain_computation,
36116diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
36117--- linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-05-19 00:06:34.000000000 -0400
36118+++ linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-05-22 19:36:32.000000000 -0400
36119@@ -883,6 +883,8 @@ static void rs_tx_status(void *priv_r, s
36120 struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
36121 struct iwl_rxon_context *ctx = sta_priv->common.ctx;
36122
36123+ pax_track_stack();
36124+
36125 IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
36126
36127 /* Treat uninitialized rate scaling data same as non-existing. */
36128@@ -2894,6 +2896,8 @@ static void rs_fill_link_cmd(struct iwl_
36129 container_of(lq_sta, struct iwl_station_priv, lq_sta);
36130 struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
36131
36132+ pax_track_stack();
36133+
36134 /* Override starting rate (index 0) if needed for debug purposes */
36135 rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
36136
36137diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-core.h linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-core.h
36138--- linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-core.h 2011-05-19 00:06:34.000000000 -0400
36139+++ linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-core.h 2011-05-22 19:36:32.000000000 -0400
36140@@ -198,28 +198,25 @@ struct iwl_lib_ops {
36141 int (*set_channel_switch)(struct iwl_priv *priv,
36142 struct ieee80211_channel_switch *ch_switch);
36143 /* power management */
36144- struct iwl_apm_ops apm_ops;
36145+ const struct iwl_apm_ops apm_ops;
36146
36147 /* power */
36148 int (*send_tx_power) (struct iwl_priv *priv);
36149 void (*update_chain_flags)(struct iwl_priv *priv);
36150
36151 /* isr */
36152- struct iwl_isr_ops isr_ops;
36153+ const struct iwl_isr_ops isr_ops;
36154
36155 /* eeprom operations (as defined in iwl-eeprom.h) */
36156 struct iwl_eeprom_ops eeprom_ops;
36157
36158 /* temperature */
36159- struct iwl_temp_ops temp_ops;
36160+ const struct iwl_temp_ops temp_ops;
36161
36162 int (*txfifo_flush)(struct iwl_priv *priv, u16 flush_control);
36163 void (*dev_txfifo_flush)(struct iwl_priv *priv, u16 flush_control);
36164
36165- struct iwl_debugfs_ops debugfs_ops;
36166-
36167- /* thermal throttling */
36168- struct iwl_tt_ops tt_ops;
36169+ const struct iwl_debugfs_ops debugfs_ops;const struct iwl_tt_ops tt_ops;
36170 };
36171
36172 struct iwl_led_ops {
36173diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-debugfs.c
36174--- linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-05-19 00:06:34.000000000 -0400
36175+++ linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-05-22 19:36:32.000000000 -0400
36176@@ -549,6 +549,8 @@ static ssize_t iwl_dbgfs_status_read(str
36177 int pos = 0;
36178 const size_t bufsz = sizeof(buf);
36179
36180+ pax_track_stack();
36181+
36182 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
36183 test_bit(STATUS_HCMD_ACTIVE, &priv->status));
36184 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INT_ENABLED:\t %d\n",
36185@@ -681,6 +683,8 @@ static ssize_t iwl_dbgfs_qos_read(struct
36186 char buf[256 * NUM_IWL_RXON_CTX];
36187 const size_t bufsz = sizeof(buf);
36188
36189+ pax_track_stack();
36190+
36191 for_each_context(priv, ctx) {
36192 pos += scnprintf(buf + pos, bufsz - pos, "context %d:\n",
36193 ctx->ctxid);
36194diff -urNp linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-debug.h
36195--- linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-05-19 00:06:34.000000000 -0400
36196+++ linux-2.6.39.1/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-05-22 19:36:32.000000000 -0400
36197@@ -68,8 +68,8 @@ do {
36198 } while (0)
36199
36200 #else
36201-#define IWL_DEBUG(__priv, level, fmt, args...)
36202-#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
36203+#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
36204+#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
36205 static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
36206 const void *p, u32 len)
36207 {}
36208diff -urNp linux-2.6.39.1/drivers/net/wireless/iwmc3200wifi/cfg80211.c linux-2.6.39.1/drivers/net/wireless/iwmc3200wifi/cfg80211.c
36209--- linux-2.6.39.1/drivers/net/wireless/iwmc3200wifi/cfg80211.c 2011-05-19 00:06:34.000000000 -0400
36210+++ linux-2.6.39.1/drivers/net/wireless/iwmc3200wifi/cfg80211.c 2011-05-22 19:36:32.000000000 -0400
36211@@ -763,7 +763,7 @@ static int iwm_cfg80211_flush_pmksa(stru
36212 }
36213
36214
36215-static struct cfg80211_ops iwm_cfg80211_ops = {
36216+static const struct cfg80211_ops iwm_cfg80211_ops = {
36217 .change_virtual_intf = iwm_cfg80211_change_iface,
36218 .add_key = iwm_cfg80211_add_key,
36219 .get_key = iwm_cfg80211_get_key,
36220diff -urNp linux-2.6.39.1/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-2.6.39.1/drivers/net/wireless/iwmc3200wifi/debugfs.c
36221--- linux-2.6.39.1/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-05-19 00:06:34.000000000 -0400
36222+++ linux-2.6.39.1/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-05-22 19:36:32.000000000 -0400
36223@@ -327,6 +327,8 @@ static ssize_t iwm_debugfs_fw_err_read(s
36224 int buf_len = 512;
36225 size_t len = 0;
36226
36227+ pax_track_stack();
36228+
36229 if (*ppos != 0)
36230 return 0;
36231 if (count < sizeof(buf))
36232diff -urNp linux-2.6.39.1/drivers/net/wireless/libertas/cfg.c linux-2.6.39.1/drivers/net/wireless/libertas/cfg.c
36233--- linux-2.6.39.1/drivers/net/wireless/libertas/cfg.c 2011-05-19 00:06:34.000000000 -0400
36234+++ linux-2.6.39.1/drivers/net/wireless/libertas/cfg.c 2011-05-22 19:36:32.000000000 -0400
36235@@ -2003,7 +2003,7 @@ static int lbs_leave_ibss(struct wiphy *
36236 * Initialization
36237 */
36238
36239-static struct cfg80211_ops lbs_cfg80211_ops = {
36240+static const struct cfg80211_ops lbs_cfg80211_ops = {
36241 .set_channel = lbs_cfg_set_channel,
36242 .scan = lbs_cfg_scan,
36243 .connect = lbs_cfg_connect,
36244diff -urNp linux-2.6.39.1/drivers/net/wireless/libertas/debugfs.c linux-2.6.39.1/drivers/net/wireless/libertas/debugfs.c
36245--- linux-2.6.39.1/drivers/net/wireless/libertas/debugfs.c 2011-05-19 00:06:34.000000000 -0400
36246+++ linux-2.6.39.1/drivers/net/wireless/libertas/debugfs.c 2011-05-22 19:36:32.000000000 -0400
36247@@ -702,7 +702,7 @@ out_unlock:
36248 struct lbs_debugfs_files {
36249 const char *name;
36250 int perm;
36251- struct file_operations fops;
36252+ const struct file_operations fops;
36253 };
36254
36255 static const struct lbs_debugfs_files debugfs_files[] = {
36256diff -urNp linux-2.6.39.1/drivers/net/wireless/rndis_wlan.c linux-2.6.39.1/drivers/net/wireless/rndis_wlan.c
36257--- linux-2.6.39.1/drivers/net/wireless/rndis_wlan.c 2011-05-19 00:06:34.000000000 -0400
36258+++ linux-2.6.39.1/drivers/net/wireless/rndis_wlan.c 2011-05-22 19:36:32.000000000 -0400
36259@@ -1277,7 +1277,7 @@ static int set_rts_threshold(struct usbn
36260
36261 netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
36262
36263- if (rts_threshold < 0 || rts_threshold > 2347)
36264+ if (rts_threshold > 2347)
36265 rts_threshold = 2347;
36266
36267 tmp = cpu_to_le32(rts_threshold);
36268diff -urNp linux-2.6.39.1/drivers/net/wireless/rtlwifi/pci.c linux-2.6.39.1/drivers/net/wireless/rtlwifi/pci.c
36269--- linux-2.6.39.1/drivers/net/wireless/rtlwifi/pci.c 2011-05-19 00:06:34.000000000 -0400
36270+++ linux-2.6.39.1/drivers/net/wireless/rtlwifi/pci.c 2011-05-22 19:36:32.000000000 -0400
36271@@ -1869,7 +1869,7 @@ int rtl_pci_resume(struct pci_dev *pdev)
36272 }
36273 EXPORT_SYMBOL(rtl_pci_resume);
36274
36275-struct rtl_intf_ops rtl_pci_ops = {
36276+const struct rtl_intf_ops rtl_pci_ops = {
36277 .adapter_start = rtl_pci_start,
36278 .adapter_stop = rtl_pci_stop,
36279 .adapter_tx = rtl_pci_tx,
36280diff -urNp linux-2.6.39.1/drivers/net/wireless/rtlwifi/pci.h linux-2.6.39.1/drivers/net/wireless/rtlwifi/pci.h
36281--- linux-2.6.39.1/drivers/net/wireless/rtlwifi/pci.h 2011-05-19 00:06:34.000000000 -0400
36282+++ linux-2.6.39.1/drivers/net/wireless/rtlwifi/pci.h 2011-05-22 19:36:32.000000000 -0400
36283@@ -234,7 +234,7 @@ struct rtl_pci_priv {
36284
36285 int rtl_pci_reset_trx_ring(struct ieee80211_hw *hw);
36286
36287-extern struct rtl_intf_ops rtl_pci_ops;
36288+extern const struct rtl_intf_ops rtl_pci_ops;
36289
36290 int __devinit rtl_pci_probe(struct pci_dev *pdev,
36291 const struct pci_device_id *id);
36292diff -urNp linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
36293--- linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c 2011-05-19 00:06:34.000000000 -0400
36294+++ linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c 2011-05-22 19:36:32.000000000 -0400
36295@@ -827,6 +827,8 @@ static bool _rtl92c_phy_sw_chnl_step_by_
36296 u8 rfpath;
36297 u8 num_total_rfpath = rtlphy->num_total_rfpath;
36298
36299+ pax_track_stack();
36300+
36301 precommoncmdcnt = 0;
36302 _rtl92c_phy_set_sw_chnl_cmdarray(precommoncmd, precommoncmdcnt++,
36303 MAX_PRECMD_CNT,
36304diff -urNp linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
36305--- linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c 2011-05-19 00:06:34.000000000 -0400
36306+++ linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c 2011-05-22 19:36:32.000000000 -0400
36307@@ -96,7 +96,7 @@ void rtl92c_deinit_sw_vars(struct ieee80
36308 }
36309 }
36310
36311-static struct rtl_hal_ops rtl8192ce_hal_ops = {
36312+static const struct rtl_hal_ops rtl8192ce_hal_ops = {
36313 .init_sw_vars = rtl92c_init_sw_vars,
36314 .deinit_sw_vars = rtl92c_deinit_sw_vars,
36315 .read_eeprom_info = rtl92ce_read_eeprom_info,
36316@@ -151,7 +151,7 @@ static struct rtl_mod_params rtl92ce_mod
36317 .sw_crypto = 0,
36318 };
36319
36320-static struct rtl_hal_cfg rtl92ce_hal_cfg = {
36321+static const struct rtl_hal_cfg rtl92ce_hal_cfg = {
36322 .name = "rtl92c_pci",
36323 .fw_name = "rtlwifi/rtl8192cfw.bin",
36324 .ops = &rtl8192ce_hal_ops,
36325diff -urNp linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
36326--- linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c 2011-05-19 00:06:34.000000000 -0400
36327+++ linux-2.6.39.1/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c 2011-05-22 19:36:32.000000000 -0400
36328@@ -77,7 +77,7 @@ static void rtl92cu_deinit_sw_vars(struc
36329 }
36330 }
36331
36332-static struct rtl_hal_ops rtl8192cu_hal_ops = {
36333+static const struct rtl_hal_ops rtl8192cu_hal_ops = {
36334 .init_sw_vars = rtl92cu_init_sw_vars,
36335 .deinit_sw_vars = rtl92cu_deinit_sw_vars,
36336 .read_chip_version = rtl92c_read_chip_version,
36337@@ -147,7 +147,7 @@ static struct rtl_hal_usbint_cfg rtl92cu
36338 .usb_mq_to_hwq = rtl8192cu_mq_to_hwq,
36339 };
36340
36341-static struct rtl_hal_cfg rtl92cu_hal_cfg = {
36342+static const struct rtl_hal_cfg rtl92cu_hal_cfg = {
36343 .name = "rtl92c_usb",
36344 .fw_name = "rtlwifi/rtl8192cufw.bin",
36345 .ops = &rtl8192cu_hal_ops,
36346diff -urNp linux-2.6.39.1/drivers/net/wireless/rtlwifi/usb.c linux-2.6.39.1/drivers/net/wireless/rtlwifi/usb.c
36347--- linux-2.6.39.1/drivers/net/wireless/rtlwifi/usb.c 2011-05-19 00:06:34.000000000 -0400
36348+++ linux-2.6.39.1/drivers/net/wireless/rtlwifi/usb.c 2011-05-22 19:36:32.000000000 -0400
36349@@ -913,7 +913,7 @@ static bool rtl_usb_tx_chk_waitq_insert(
36350 return false;
36351 }
36352
36353-static struct rtl_intf_ops rtl_usb_ops = {
36354+static const struct rtl_intf_ops rtl_usb_ops = {
36355 .adapter_start = rtl_usb_start,
36356 .adapter_stop = rtl_usb_stop,
36357 .adapter_tx = rtl_usb_tx,
36358diff -urNp linux-2.6.39.1/drivers/net/wireless/rtlwifi/wifi.h linux-2.6.39.1/drivers/net/wireless/rtlwifi/wifi.h
36359--- linux-2.6.39.1/drivers/net/wireless/rtlwifi/wifi.h 2011-05-19 00:06:34.000000000 -0400
36360+++ linux-2.6.39.1/drivers/net/wireless/rtlwifi/wifi.h 2011-05-22 19:36:32.000000000 -0400
36361@@ -1447,7 +1447,7 @@ struct rtl_hal_cfg {
36362 u8 bar_id;
36363 char *name;
36364 char *fw_name;
36365- struct rtl_hal_ops *ops;
36366+ const struct rtl_hal_ops *ops;
36367 struct rtl_mod_params *mod_params;
36368 struct rtl_hal_usbint_cfg *usb_interface_cfg;
36369
36370@@ -1533,7 +1533,7 @@ struct rtl_priv {
36371 *intf_ops : for diff interrface usb/pcie
36372 */
36373 struct rtl_hal_cfg *cfg;
36374- struct rtl_intf_ops *intf_ops;
36375+ const struct rtl_intf_ops *intf_ops;
36376
36377 /*this var will be set by set_bit,
36378 and was used to indicate status of
36379diff -urNp linux-2.6.39.1/drivers/net/wireless/wl12xx/spi.c linux-2.6.39.1/drivers/net/wireless/wl12xx/spi.c
36380--- linux-2.6.39.1/drivers/net/wireless/wl12xx/spi.c 2011-05-19 00:06:34.000000000 -0400
36381+++ linux-2.6.39.1/drivers/net/wireless/wl12xx/spi.c 2011-05-22 19:36:32.000000000 -0400
36382@@ -280,6 +280,8 @@ static void wl1271_spi_raw_write(struct
36383 u32 chunk_len;
36384 int i;
36385
36386+ pax_track_stack();
36387+
36388 WARN_ON(len > WL1271_AGGR_BUFFER_SIZE);
36389
36390 spi_message_init(&m);
36391diff -urNp linux-2.6.39.1/drivers/net/xen-netback/interface.c linux-2.6.39.1/drivers/net/xen-netback/interface.c
36392--- linux-2.6.39.1/drivers/net/xen-netback/interface.c 2011-05-19 00:06:34.000000000 -0400
36393+++ linux-2.6.39.1/drivers/net/xen-netback/interface.c 2011-05-22 19:36:32.000000000 -0400
36394@@ -273,7 +273,7 @@ static void xenvif_get_strings(struct ne
36395 }
36396 }
36397
36398-static struct ethtool_ops xenvif_ethtool_ops = {
36399+static const struct ethtool_ops xenvif_ethtool_ops = {
36400 .get_tx_csum = ethtool_op_get_tx_csum,
36401 .set_tx_csum = xenvif_set_tx_csum,
36402 .get_sg = ethtool_op_get_sg,
36403diff -urNp linux-2.6.39.1/drivers/net/xilinx_emaclite.c linux-2.6.39.1/drivers/net/xilinx_emaclite.c
36404--- linux-2.6.39.1/drivers/net/xilinx_emaclite.c 2011-05-19 00:06:34.000000000 -0400
36405+++ linux-2.6.39.1/drivers/net/xilinx_emaclite.c 2011-05-22 19:36:32.000000000 -0400
36406@@ -1085,7 +1085,7 @@ static bool get_bool(struct platform_dev
36407 }
36408 }
36409
36410-static struct net_device_ops xemaclite_netdev_ops;
36411+static const struct net_device_ops xemaclite_netdev_ops;
36412
36413 /**
36414 * xemaclite_of_probe - Probe method for the Emaclite device.
36415@@ -1264,7 +1264,7 @@ xemaclite_poll_controller(struct net_dev
36416 }
36417 #endif
36418
36419-static struct net_device_ops xemaclite_netdev_ops = {
36420+static const struct net_device_ops xemaclite_netdev_ops = {
36421 .ndo_open = xemaclite_open,
36422 .ndo_stop = xemaclite_close,
36423 .ndo_start_xmit = xemaclite_send,
36424diff -urNp linux-2.6.39.1/drivers/nfc/pn544.c linux-2.6.39.1/drivers/nfc/pn544.c
36425--- linux-2.6.39.1/drivers/nfc/pn544.c 2011-05-19 00:06:34.000000000 -0400
36426+++ linux-2.6.39.1/drivers/nfc/pn544.c 2011-05-22 19:36:32.000000000 -0400
36427@@ -89,7 +89,7 @@ static ssize_t pn544_test(struct device
36428
36429 static int pn544_enable(struct pn544_info *info, int mode)
36430 {
36431- struct pn544_nfc_platform_data *pdata;
36432+ const struct pn544_nfc_platform_data *pdata;
36433 struct i2c_client *client = info->i2c_dev;
36434
36435 int r;
36436@@ -118,7 +118,7 @@ static int pn544_enable(struct pn544_inf
36437
36438 static void pn544_disable(struct pn544_info *info)
36439 {
36440- struct pn544_nfc_platform_data *pdata;
36441+ const struct pn544_nfc_platform_data *pdata;
36442 struct i2c_client *client = info->i2c_dev;
36443
36444 pdata = client->dev.platform_data;
36445@@ -509,7 +509,7 @@ static long pn544_ioctl(struct file *fil
36446 struct pn544_info *info = container_of(file->private_data,
36447 struct pn544_info, miscdev);
36448 struct i2c_client *client = info->i2c_dev;
36449- struct pn544_nfc_platform_data *pdata;
36450+ const struct pn544_nfc_platform_data *pdata;
36451 unsigned int val;
36452 int r = 0;
36453
36454@@ -715,7 +715,7 @@ static int __devinit pn544_probe(struct
36455 const struct i2c_device_id *id)
36456 {
36457 struct pn544_info *info;
36458- struct pn544_nfc_platform_data *pdata;
36459+ const struct pn544_nfc_platform_data *pdata;
36460 int r = 0;
36461
36462 dev_dbg(&client->dev, "%s\n", __func__);
36463diff -urNp linux-2.6.39.1/drivers/of/pdt.c linux-2.6.39.1/drivers/of/pdt.c
36464--- linux-2.6.39.1/drivers/of/pdt.c 2011-05-19 00:06:34.000000000 -0400
36465+++ linux-2.6.39.1/drivers/of/pdt.c 2011-05-22 19:36:32.000000000 -0400
36466@@ -24,7 +24,7 @@
36467 #include <linux/of_pdt.h>
36468 #include <asm/prom.h>
36469
36470-static struct of_pdt_ops *of_pdt_prom_ops __initdata;
36471+static const struct of_pdt_ops *of_pdt_prom_ops;
36472
36473 void __initdata (*of_pdt_build_more)(struct device_node *dp,
36474 struct device_node ***nextp);
36475diff -urNp linux-2.6.39.1/drivers/oprofile/buffer_sync.c linux-2.6.39.1/drivers/oprofile/buffer_sync.c
36476--- linux-2.6.39.1/drivers/oprofile/buffer_sync.c 2011-05-19 00:06:34.000000000 -0400
36477+++ linux-2.6.39.1/drivers/oprofile/buffer_sync.c 2011-05-22 19:36:32.000000000 -0400
36478@@ -342,7 +342,7 @@ static void add_data(struct op_entry *en
36479 if (cookie == NO_COOKIE)
36480 offset = pc;
36481 if (cookie == INVALID_COOKIE) {
36482- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
36483+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
36484 offset = pc;
36485 }
36486 if (cookie != last_cookie) {
36487@@ -386,14 +386,14 @@ add_sample(struct mm_struct *mm, struct
36488 /* add userspace sample */
36489
36490 if (!mm) {
36491- atomic_inc(&oprofile_stats.sample_lost_no_mm);
36492+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
36493 return 0;
36494 }
36495
36496 cookie = lookup_dcookie(mm, s->eip, &offset);
36497
36498 if (cookie == INVALID_COOKIE) {
36499- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
36500+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
36501 return 0;
36502 }
36503
36504@@ -562,7 +562,7 @@ void sync_buffer(int cpu)
36505 /* ignore backtraces if failed to add a sample */
36506 if (state == sb_bt_start) {
36507 state = sb_bt_ignore;
36508- atomic_inc(&oprofile_stats.bt_lost_no_mapping);
36509+ atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
36510 }
36511 }
36512 release_mm(mm);
36513diff -urNp linux-2.6.39.1/drivers/oprofile/event_buffer.c linux-2.6.39.1/drivers/oprofile/event_buffer.c
36514--- linux-2.6.39.1/drivers/oprofile/event_buffer.c 2011-05-19 00:06:34.000000000 -0400
36515+++ linux-2.6.39.1/drivers/oprofile/event_buffer.c 2011-05-22 19:36:32.000000000 -0400
36516@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
36517 }
36518
36519 if (buffer_pos == buffer_size) {
36520- atomic_inc(&oprofile_stats.event_lost_overflow);
36521+ atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
36522 return;
36523 }
36524
36525diff -urNp linux-2.6.39.1/drivers/oprofile/oprof.c linux-2.6.39.1/drivers/oprofile/oprof.c
36526--- linux-2.6.39.1/drivers/oprofile/oprof.c 2011-05-19 00:06:34.000000000 -0400
36527+++ linux-2.6.39.1/drivers/oprofile/oprof.c 2011-05-22 19:36:32.000000000 -0400
36528@@ -110,7 +110,7 @@ static void switch_worker(struct work_st
36529 if (oprofile_ops.switch_events())
36530 return;
36531
36532- atomic_inc(&oprofile_stats.multiplex_counter);
36533+ atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
36534 start_switch_worker();
36535 }
36536
36537diff -urNp linux-2.6.39.1/drivers/oprofile/oprofilefs.c linux-2.6.39.1/drivers/oprofile/oprofilefs.c
36538--- linux-2.6.39.1/drivers/oprofile/oprofilefs.c 2011-05-19 00:06:34.000000000 -0400
36539+++ linux-2.6.39.1/drivers/oprofile/oprofilefs.c 2011-05-22 19:36:32.000000000 -0400
36540@@ -186,7 +186,7 @@ static const struct file_operations atom
36541
36542
36543 int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
36544- char const *name, atomic_t *val)
36545+ char const *name, atomic_unchecked_t *val)
36546 {
36547 return __oprofilefs_create_file(sb, root, name,
36548 &atomic_ro_fops, 0444, val);
36549diff -urNp linux-2.6.39.1/drivers/oprofile/oprofile_stats.c linux-2.6.39.1/drivers/oprofile/oprofile_stats.c
36550--- linux-2.6.39.1/drivers/oprofile/oprofile_stats.c 2011-05-19 00:06:34.000000000 -0400
36551+++ linux-2.6.39.1/drivers/oprofile/oprofile_stats.c 2011-05-22 19:36:32.000000000 -0400
36552@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
36553 cpu_buf->sample_invalid_eip = 0;
36554 }
36555
36556- atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
36557- atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
36558- atomic_set(&oprofile_stats.event_lost_overflow, 0);
36559- atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
36560- atomic_set(&oprofile_stats.multiplex_counter, 0);
36561+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
36562+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
36563+ atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
36564+ atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
36565+ atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
36566 }
36567
36568
36569diff -urNp linux-2.6.39.1/drivers/oprofile/oprofile_stats.h linux-2.6.39.1/drivers/oprofile/oprofile_stats.h
36570--- linux-2.6.39.1/drivers/oprofile/oprofile_stats.h 2011-05-19 00:06:34.000000000 -0400
36571+++ linux-2.6.39.1/drivers/oprofile/oprofile_stats.h 2011-05-22 19:36:32.000000000 -0400
36572@@ -13,11 +13,11 @@
36573 #include <asm/atomic.h>
36574
36575 struct oprofile_stat_struct {
36576- atomic_t sample_lost_no_mm;
36577- atomic_t sample_lost_no_mapping;
36578- atomic_t bt_lost_no_mapping;
36579- atomic_t event_lost_overflow;
36580- atomic_t multiplex_counter;
36581+ atomic_unchecked_t sample_lost_no_mm;
36582+ atomic_unchecked_t sample_lost_no_mapping;
36583+ atomic_unchecked_t bt_lost_no_mapping;
36584+ atomic_unchecked_t event_lost_overflow;
36585+ atomic_unchecked_t multiplex_counter;
36586 };
36587
36588 extern struct oprofile_stat_struct oprofile_stats;
36589diff -urNp linux-2.6.39.1/drivers/parisc/dino.c linux-2.6.39.1/drivers/parisc/dino.c
36590--- linux-2.6.39.1/drivers/parisc/dino.c 2011-05-19 00:06:34.000000000 -0400
36591+++ linux-2.6.39.1/drivers/parisc/dino.c 2011-05-22 19:36:32.000000000 -0400
36592@@ -238,7 +238,7 @@ static int dino_cfg_write(struct pci_bus
36593 return 0;
36594 }
36595
36596-static struct pci_ops dino_cfg_ops = {
36597+static const struct pci_ops dino_cfg_ops = {
36598 .read = dino_cfg_read,
36599 .write = dino_cfg_write,
36600 };
36601diff -urNp linux-2.6.39.1/drivers/parisc/lba_pci.c linux-2.6.39.1/drivers/parisc/lba_pci.c
36602--- linux-2.6.39.1/drivers/parisc/lba_pci.c 2011-05-19 00:06:34.000000000 -0400
36603+++ linux-2.6.39.1/drivers/parisc/lba_pci.c 2011-05-22 19:36:32.000000000 -0400
36604@@ -468,7 +468,7 @@ static int elroy_cfg_write(struct pci_bu
36605 }
36606
36607
36608-static struct pci_ops elroy_cfg_ops = {
36609+static const struct pci_ops elroy_cfg_ops = {
36610 .read = elroy_cfg_read,
36611 .write = elroy_cfg_write,
36612 };
36613@@ -541,7 +541,7 @@ static int mercury_cfg_write(struct pci_
36614 return 0;
36615 }
36616
36617-static struct pci_ops mercury_cfg_ops = {
36618+static const struct pci_ops mercury_cfg_ops = {
36619 .read = mercury_cfg_read,
36620 .write = mercury_cfg_write,
36621 };
36622@@ -1405,7 +1405,7 @@ lba_driver_probe(struct parisc_device *d
36623 {
36624 struct lba_device *lba_dev;
36625 struct pci_bus *lba_bus;
36626- struct pci_ops *cfg_ops;
36627+ const struct pci_ops *cfg_ops;
36628 u32 func_class;
36629 void *tmp_obj;
36630 char *version;
36631diff -urNp linux-2.6.39.1/drivers/parport/procfs.c linux-2.6.39.1/drivers/parport/procfs.c
36632--- linux-2.6.39.1/drivers/parport/procfs.c 2011-05-19 00:06:34.000000000 -0400
36633+++ linux-2.6.39.1/drivers/parport/procfs.c 2011-05-22 19:36:32.000000000 -0400
36634@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
36635
36636 *ppos += len;
36637
36638- return copy_to_user(result, buffer, len) ? -EFAULT : 0;
36639+ return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
36640 }
36641
36642 #ifdef CONFIG_PARPORT_1284
36643@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
36644
36645 *ppos += len;
36646
36647- return copy_to_user (result, buffer, len) ? -EFAULT : 0;
36648+ return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
36649 }
36650 #endif /* IEEE1284.3 support. */
36651
36652diff -urNp linux-2.6.39.1/drivers/pci/access.c linux-2.6.39.1/drivers/pci/access.c
36653--- linux-2.6.39.1/drivers/pci/access.c 2011-05-19 00:06:34.000000000 -0400
36654+++ linux-2.6.39.1/drivers/pci/access.c 2011-05-22 19:36:32.000000000 -0400
36655@@ -74,9 +74,9 @@ EXPORT_SYMBOL(pci_bus_write_config_dword
36656 *
36657 * Return previous raw operations
36658 */
36659-struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, struct pci_ops *ops)
36660+const struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, const struct pci_ops *ops)
36661 {
36662- struct pci_ops *old_ops;
36663+ const struct pci_ops *old_ops;
36664 unsigned long flags;
36665
36666 raw_spin_lock_irqsave(&pci_lock, flags);
36667diff -urNp linux-2.6.39.1/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.39.1/drivers/pci/hotplug/acpiphp_glue.c
36668--- linux-2.6.39.1/drivers/pci/hotplug/acpiphp_glue.c 2011-05-19 00:06:34.000000000 -0400
36669+++ linux-2.6.39.1/drivers/pci/hotplug/acpiphp_glue.c 2011-05-22 19:36:32.000000000 -0400
36670@@ -110,7 +110,7 @@ static int post_dock_fixups(struct notif
36671 }
36672
36673
36674-static struct acpi_dock_ops acpiphp_dock_ops = {
36675+static const struct acpi_dock_ops acpiphp_dock_ops = {
36676 .handler = handle_hotplug_event_func,
36677 };
36678
36679diff -urNp linux-2.6.39.1/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.39.1/drivers/pci/hotplug/cpqphp_nvram.c
36680--- linux-2.6.39.1/drivers/pci/hotplug/cpqphp_nvram.c 2011-05-19 00:06:34.000000000 -0400
36681+++ linux-2.6.39.1/drivers/pci/hotplug/cpqphp_nvram.c 2011-05-22 19:36:32.000000000 -0400
36682@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
36683
36684 void compaq_nvram_init (void __iomem *rom_start)
36685 {
36686+
36687+#ifndef CONFIG_PAX_KERNEXEC
36688 if (rom_start) {
36689 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
36690 }
36691+#endif
36692+
36693 dbg("int15 entry = %p\n", compaq_int15_entry_point);
36694
36695 /* initialize our int15 lock */
36696diff -urNp linux-2.6.39.1/drivers/pci/hotplug/shpchp.h linux-2.6.39.1/drivers/pci/hotplug/shpchp.h
36697--- linux-2.6.39.1/drivers/pci/hotplug/shpchp.h 2011-05-19 00:06:34.000000000 -0400
36698+++ linux-2.6.39.1/drivers/pci/hotplug/shpchp.h 2011-05-22 19:36:32.000000000 -0400
36699@@ -86,7 +86,7 @@ struct slot {
36700 u8 presence_save;
36701 u8 pwr_save;
36702 struct controller *ctrl;
36703- struct hpc_ops *hpc_ops;
36704+ const struct hpc_ops *hpc_ops;
36705 struct hotplug_slot *hotplug_slot;
36706 struct list_head slot_list;
36707 struct delayed_work work; /* work for button event */
36708@@ -107,7 +107,7 @@ struct controller {
36709 int slot_num_inc; /* 1 or -1 */
36710 struct pci_dev *pci_dev;
36711 struct list_head slot_list;
36712- struct hpc_ops *hpc_ops;
36713+ const struct hpc_ops *hpc_ops;
36714 wait_queue_head_t queue; /* sleep & wake process */
36715 u8 slot_device_offset;
36716 u32 pcix_misc2_reg; /* for amd pogo errata */
36717diff -urNp linux-2.6.39.1/drivers/pci/hotplug/shpchp_hpc.c linux-2.6.39.1/drivers/pci/hotplug/shpchp_hpc.c
36718--- linux-2.6.39.1/drivers/pci/hotplug/shpchp_hpc.c 2011-05-19 00:06:34.000000000 -0400
36719+++ linux-2.6.39.1/drivers/pci/hotplug/shpchp_hpc.c 2011-05-22 19:36:32.000000000 -0400
36720@@ -910,7 +910,7 @@ static int shpc_get_max_bus_speed(struct
36721 return retval;
36722 }
36723
36724-static struct hpc_ops shpchp_hpc_ops = {
36725+static const struct hpc_ops shpchp_hpc_ops = {
36726 .power_on_slot = hpc_power_on_slot,
36727 .slot_enable = hpc_slot_enable,
36728 .slot_disable = hpc_slot_disable,
36729diff -urNp linux-2.6.39.1/drivers/pci/intel-iommu.c linux-2.6.39.1/drivers/pci/intel-iommu.c
36730--- linux-2.6.39.1/drivers/pci/intel-iommu.c 2011-05-19 00:06:34.000000000 -0400
36731+++ linux-2.6.39.1/drivers/pci/intel-iommu.c 2011-05-22 19:36:32.000000000 -0400
36732@@ -391,7 +391,7 @@ static int intel_iommu_strict;
36733 static DEFINE_SPINLOCK(device_domain_lock);
36734 static LIST_HEAD(device_domain_list);
36735
36736-static struct iommu_ops intel_iommu_ops;
36737+static const struct iommu_ops intel_iommu_ops;
36738
36739 static int __init intel_iommu_setup(char *str)
36740 {
36741@@ -2945,7 +2945,7 @@ static int intel_mapping_error(struct de
36742 return !dma_addr;
36743 }
36744
36745-struct dma_map_ops intel_dma_ops = {
36746+const struct dma_map_ops intel_dma_ops = {
36747 .alloc_coherent = intel_alloc_coherent,
36748 .free_coherent = intel_free_coherent,
36749 .map_sg = intel_map_sg,
36750@@ -3739,7 +3739,7 @@ static int intel_iommu_domain_has_cap(st
36751 return 0;
36752 }
36753
36754-static struct iommu_ops intel_iommu_ops = {
36755+static const struct iommu_ops intel_iommu_ops = {
36756 .domain_init = intel_iommu_domain_init,
36757 .domain_destroy = intel_iommu_domain_destroy,
36758 .attach_dev = intel_iommu_attach_device,
36759diff -urNp linux-2.6.39.1/drivers/pci/pci-acpi.c linux-2.6.39.1/drivers/pci/pci-acpi.c
36760--- linux-2.6.39.1/drivers/pci/pci-acpi.c 2011-05-19 00:06:34.000000000 -0400
36761+++ linux-2.6.39.1/drivers/pci/pci-acpi.c 2011-05-22 19:36:32.000000000 -0400
36762@@ -332,7 +332,7 @@ static int acpi_pci_run_wake(struct pci_
36763 return 0;
36764 }
36765
36766-static struct pci_platform_pm_ops acpi_pci_platform_pm = {
36767+static const struct pci_platform_pm_ops acpi_pci_platform_pm = {
36768 .is_manageable = acpi_pci_power_manageable,
36769 .set_state = acpi_pci_set_power_state,
36770 .choose_state = acpi_pci_choose_state,
36771diff -urNp linux-2.6.39.1/drivers/pci/pci.c linux-2.6.39.1/drivers/pci/pci.c
36772--- linux-2.6.39.1/drivers/pci/pci.c 2011-05-19 00:06:34.000000000 -0400
36773+++ linux-2.6.39.1/drivers/pci/pci.c 2011-05-22 19:36:32.000000000 -0400
36774@@ -480,9 +480,9 @@ pci_restore_bars(struct pci_dev *dev)
36775 pci_update_resource(dev, i);
36776 }
36777
36778-static struct pci_platform_pm_ops *pci_platform_pm;
36779+static const struct pci_platform_pm_ops *pci_platform_pm;
36780
36781-int pci_set_platform_pm(struct pci_platform_pm_ops *ops)
36782+int pci_set_platform_pm(const struct pci_platform_pm_ops *ops)
36783 {
36784 if (!ops->is_manageable || !ops->set_state || !ops->choose_state
36785 || !ops->sleep_wake || !ops->can_wakeup)
36786diff -urNp linux-2.6.39.1/drivers/pci/pcie/aer/aerdrv_core.c linux-2.6.39.1/drivers/pci/pcie/aer/aerdrv_core.c
36787--- linux-2.6.39.1/drivers/pci/pcie/aer/aerdrv_core.c 2011-05-19 00:06:34.000000000 -0400
36788+++ linux-2.6.39.1/drivers/pci/pcie/aer/aerdrv_core.c 2011-05-22 19:36:32.000000000 -0400
36789@@ -239,7 +239,7 @@ static bool find_source_device(struct pc
36790 static int report_error_detected(struct pci_dev *dev, void *data)
36791 {
36792 pci_ers_result_t vote;
36793- struct pci_error_handlers *err_handler;
36794+ const struct pci_error_handlers *err_handler;
36795 struct aer_broadcast_data *result_data;
36796 result_data = (struct aer_broadcast_data *) data;
36797
36798@@ -273,7 +273,7 @@ static int report_error_detected(struct
36799 static int report_mmio_enabled(struct pci_dev *dev, void *data)
36800 {
36801 pci_ers_result_t vote;
36802- struct pci_error_handlers *err_handler;
36803+ const struct pci_error_handlers *err_handler;
36804 struct aer_broadcast_data *result_data;
36805 result_data = (struct aer_broadcast_data *) data;
36806
36807@@ -291,7 +291,7 @@ static int report_mmio_enabled(struct pc
36808 static int report_slot_reset(struct pci_dev *dev, void *data)
36809 {
36810 pci_ers_result_t vote;
36811- struct pci_error_handlers *err_handler;
36812+ const struct pci_error_handlers *err_handler;
36813 struct aer_broadcast_data *result_data;
36814 result_data = (struct aer_broadcast_data *) data;
36815
36816@@ -308,7 +308,7 @@ static int report_slot_reset(struct pci_
36817
36818 static int report_resume(struct pci_dev *dev, void *data)
36819 {
36820- struct pci_error_handlers *err_handler;
36821+ const struct pci_error_handlers *err_handler;
36822
36823 dev->error_state = pci_channel_io_normal;
36824
36825diff -urNp linux-2.6.39.1/drivers/pci/pcie/aer/aer_inject.c linux-2.6.39.1/drivers/pci/pcie/aer/aer_inject.c
36826--- linux-2.6.39.1/drivers/pci/pcie/aer/aer_inject.c 2011-05-19 00:06:34.000000000 -0400
36827+++ linux-2.6.39.1/drivers/pci/pcie/aer/aer_inject.c 2011-05-22 19:36:32.000000000 -0400
36828@@ -64,7 +64,7 @@ struct aer_error {
36829 struct pci_bus_ops {
36830 struct list_head list;
36831 struct pci_bus *bus;
36832- struct pci_ops *ops;
36833+ const struct pci_ops *ops;
36834 };
36835
36836 static LIST_HEAD(einjected);
36837@@ -110,7 +110,7 @@ static struct aer_error *__find_aer_erro
36838 }
36839
36840 /* inject_lock must be held before calling */
36841-static struct pci_ops *__find_pci_bus_ops(struct pci_bus *bus)
36842+static const struct pci_ops *__find_pci_bus_ops(struct pci_bus *bus)
36843 {
36844 struct pci_bus_ops *bus_ops;
36845
36846@@ -187,7 +187,7 @@ static int pci_read_aer(struct pci_bus *
36847 u32 *sim;
36848 struct aer_error *err;
36849 unsigned long flags;
36850- struct pci_ops *ops;
36851+ const struct pci_ops *ops;
36852 int domain;
36853
36854 spin_lock_irqsave(&inject_lock, flags);
36855@@ -219,7 +219,7 @@ int pci_write_aer(struct pci_bus *bus, u
36856 struct aer_error *err;
36857 unsigned long flags;
36858 int rw1cs;
36859- struct pci_ops *ops;
36860+ const struct pci_ops *ops;
36861 int domain;
36862
36863 spin_lock_irqsave(&inject_lock, flags);
36864@@ -254,7 +254,7 @@ static struct pci_ops pci_ops_aer = {
36865
36866 static void pci_bus_ops_init(struct pci_bus_ops *bus_ops,
36867 struct pci_bus *bus,
36868- struct pci_ops *ops)
36869+ const struct pci_ops *ops)
36870 {
36871 INIT_LIST_HEAD(&bus_ops->list);
36872 bus_ops->bus = bus;
36873@@ -263,7 +263,7 @@ static void pci_bus_ops_init(struct pci_
36874
36875 static int pci_bus_set_aer_ops(struct pci_bus *bus)
36876 {
36877- struct pci_ops *ops;
36878+ const struct pci_ops *ops;
36879 struct pci_bus_ops *bus_ops;
36880 unsigned long flags;
36881
36882diff -urNp linux-2.6.39.1/drivers/pci/pcie/aspm.c linux-2.6.39.1/drivers/pci/pcie/aspm.c
36883--- linux-2.6.39.1/drivers/pci/pcie/aspm.c 2011-05-19 00:06:34.000000000 -0400
36884+++ linux-2.6.39.1/drivers/pci/pcie/aspm.c 2011-05-22 19:36:32.000000000 -0400
36885@@ -27,9 +27,9 @@
36886 #define MODULE_PARAM_PREFIX "pcie_aspm."
36887
36888 /* Note: those are not register definitions */
36889-#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
36890-#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
36891-#define ASPM_STATE_L1 (4) /* L1 state */
36892+#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
36893+#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
36894+#define ASPM_STATE_L1 (4U) /* L1 state */
36895 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
36896 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
36897
36898diff -urNp linux-2.6.39.1/drivers/pci/pci.h linux-2.6.39.1/drivers/pci/pci.h
36899--- linux-2.6.39.1/drivers/pci/pci.h 2011-05-19 00:06:34.000000000 -0400
36900+++ linux-2.6.39.1/drivers/pci/pci.h 2011-05-22 19:36:32.000000000 -0400
36901@@ -65,7 +65,7 @@ struct pci_platform_pm_ops {
36902 int (*run_wake)(struct pci_dev *dev, bool enable);
36903 };
36904
36905-extern int pci_set_platform_pm(struct pci_platform_pm_ops *ops);
36906+extern int pci_set_platform_pm(const struct pci_platform_pm_ops *ops);
36907 extern void pci_update_current_state(struct pci_dev *dev, pci_power_t state);
36908 extern void pci_disable_enabled_device(struct pci_dev *dev);
36909 extern int pci_finish_runtime_suspend(struct pci_dev *dev);
36910diff -urNp linux-2.6.39.1/drivers/pci/probe.c linux-2.6.39.1/drivers/pci/probe.c
36911--- linux-2.6.39.1/drivers/pci/probe.c 2011-05-19 00:06:34.000000000 -0400
36912+++ linux-2.6.39.1/drivers/pci/probe.c 2011-05-22 19:36:32.000000000 -0400
36913@@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(
36914 return ret;
36915 }
36916
36917-static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
36918+static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
36919 struct device_attribute *attr,
36920 char *buf)
36921 {
36922 return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
36923 }
36924
36925-static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
36926+static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
36927 struct device_attribute *attr,
36928 char *buf)
36929 {
36930@@ -165,7 +165,7 @@ int __pci_read_base(struct pci_dev *dev,
36931 u32 l, sz, mask;
36932 u16 orig_cmd;
36933
36934- mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
36935+ mask = type ? (u32)PCI_ROM_ADDRESS_MASK : ~0;
36936
36937 if (!dev->mmio_always_on) {
36938 pci_read_config_word(dev, PCI_COMMAND, &orig_cmd);
36939@@ -1407,7 +1407,7 @@ unsigned int __devinit pci_scan_child_bu
36940 }
36941
36942 struct pci_bus * pci_create_bus(struct device *parent,
36943- int bus, struct pci_ops *ops, void *sysdata)
36944+ int bus, const struct pci_ops *ops, void *sysdata)
36945 {
36946 int error;
36947 struct pci_bus *b, *b2;
36948@@ -1483,7 +1483,7 @@ err_out:
36949 }
36950
36951 struct pci_bus * __devinit pci_scan_bus_parented(struct device *parent,
36952- int bus, struct pci_ops *ops, void *sysdata)
36953+ int bus, const struct pci_ops *ops, void *sysdata)
36954 {
36955 struct pci_bus *b;
36956
36957diff -urNp linux-2.6.39.1/drivers/pci/proc.c linux-2.6.39.1/drivers/pci/proc.c
36958--- linux-2.6.39.1/drivers/pci/proc.c 2011-05-19 00:06:34.000000000 -0400
36959+++ linux-2.6.39.1/drivers/pci/proc.c 2011-05-22 19:41:37.000000000 -0400
36960@@ -476,7 +476,16 @@ static const struct file_operations proc
36961 static int __init pci_proc_init(void)
36962 {
36963 struct pci_dev *dev = NULL;
36964+
36965+#ifdef CONFIG_GRKERNSEC_PROC_ADD
36966+#ifdef CONFIG_GRKERNSEC_PROC_USER
36967+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
36968+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
36969+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
36970+#endif
36971+#else
36972 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
36973+#endif
36974 proc_create("devices", 0, proc_bus_pci_dir,
36975 &proc_bus_pci_dev_operations);
36976 proc_initialized = 1;
36977diff -urNp linux-2.6.39.1/drivers/pci/xen-pcifront.c linux-2.6.39.1/drivers/pci/xen-pcifront.c
36978--- linux-2.6.39.1/drivers/pci/xen-pcifront.c 2011-05-19 00:06:34.000000000 -0400
36979+++ linux-2.6.39.1/drivers/pci/xen-pcifront.c 2011-05-22 19:36:32.000000000 -0400
36980@@ -187,6 +187,8 @@ static int pcifront_bus_read(struct pci_
36981 struct pcifront_sd *sd = bus->sysdata;
36982 struct pcifront_device *pdev = pcifront_get_pdev(sd);
36983
36984+ pax_track_stack();
36985+
36986 if (verbose_request)
36987 dev_info(&pdev->xdev->dev,
36988 "read dev=%04x:%02x:%02x.%01x - offset %x size %d\n",
36989@@ -226,6 +228,8 @@ static int pcifront_bus_write(struct pci
36990 struct pcifront_sd *sd = bus->sysdata;
36991 struct pcifront_device *pdev = pcifront_get_pdev(sd);
36992
36993+ pax_track_stack();
36994+
36995 if (verbose_request)
36996 dev_info(&pdev->xdev->dev,
36997 "write dev=%04x:%02x:%02x.%01x - "
36998@@ -236,7 +240,7 @@ static int pcifront_bus_write(struct pci
36999 return errno_to_pcibios_err(do_pci_op(pdev, &op));
37000 }
37001
37002-struct pci_ops pcifront_bus_ops = {
37003+const struct pci_ops pcifront_bus_ops = {
37004 .read = pcifront_bus_read,
37005 .write = pcifront_bus_write,
37006 };
37007@@ -258,6 +262,8 @@ static int pci_frontend_enable_msix(stru
37008 struct pcifront_device *pdev = pcifront_get_pdev(sd);
37009 struct msi_desc *entry;
37010
37011+ pax_track_stack();
37012+
37013 if (nvec > SH_INFO_MAX_VEC) {
37014 dev_err(&dev->dev, "too much vector for pci frontend: %x."
37015 " Increase SH_INFO_MAX_VEC.\n", nvec);
37016@@ -309,6 +315,8 @@ static void pci_frontend_disable_msix(st
37017 struct pcifront_sd *sd = dev->bus->sysdata;
37018 struct pcifront_device *pdev = pcifront_get_pdev(sd);
37019
37020+ pax_track_stack();
37021+
37022 err = do_pci_op(pdev, &op);
37023
37024 /* What should do for error ? */
37025@@ -328,6 +336,8 @@ static int pci_frontend_enable_msi(struc
37026 struct pcifront_sd *sd = dev->bus->sysdata;
37027 struct pcifront_device *pdev = pcifront_get_pdev(sd);
37028
37029+ pax_track_stack();
37030+
37031 err = do_pci_op(pdev, &op);
37032 if (likely(!err)) {
37033 vector[0] = op.value;
37034@@ -368,7 +378,7 @@ static void pci_frontend_disable_msi(str
37035 printk(KERN_DEBUG "get fake response frombackend\n");
37036 }
37037
37038-static struct xen_pci_frontend_ops pci_frontend_ops = {
37039+static const struct xen_pci_frontend_ops pci_frontend_ops = {
37040 .enable_msi = pci_frontend_enable_msi,
37041 .disable_msi = pci_frontend_disable_msi,
37042 .enable_msix = pci_frontend_enable_msix,
37043diff -urNp linux-2.6.39.1/drivers/pcmcia/at91_cf.c linux-2.6.39.1/drivers/pcmcia/at91_cf.c
37044--- linux-2.6.39.1/drivers/pcmcia/at91_cf.c 2011-05-19 00:06:34.000000000 -0400
37045+++ linux-2.6.39.1/drivers/pcmcia/at91_cf.c 2011-05-22 19:36:32.000000000 -0400
37046@@ -203,7 +203,7 @@ at91_cf_set_mem_map(struct pcmcia_socket
37047 return 0;
37048 }
37049
37050-static struct pccard_operations at91_cf_ops = {
37051+static const struct pccard_operations at91_cf_ops = {
37052 .init = at91_cf_ss_init,
37053 .suspend = at91_cf_ss_suspend,
37054 .get_status = at91_cf_get_status,
37055diff -urNp linux-2.6.39.1/drivers/pcmcia/bfin_cf_pcmcia.c linux-2.6.39.1/drivers/pcmcia/bfin_cf_pcmcia.c
37056--- linux-2.6.39.1/drivers/pcmcia/bfin_cf_pcmcia.c 2011-05-19 00:06:34.000000000 -0400
37057+++ linux-2.6.39.1/drivers/pcmcia/bfin_cf_pcmcia.c 2011-05-22 19:36:32.000000000 -0400
37058@@ -184,7 +184,7 @@ bfin_cf_set_mem_map(struct pcmcia_socket
37059 return 0;
37060 }
37061
37062-static struct pccard_operations bfin_cf_ops = {
37063+static const struct pccard_operations bfin_cf_ops = {
37064 .init = bfin_cf_ss_init,
37065 .suspend = bfin_cf_ss_suspend,
37066 .get_status = bfin_cf_get_status,
37067diff -urNp linux-2.6.39.1/drivers/pcmcia/db1xxx_ss.c linux-2.6.39.1/drivers/pcmcia/db1xxx_ss.c
37068--- linux-2.6.39.1/drivers/pcmcia/db1xxx_ss.c 2011-05-19 00:06:34.000000000 -0400
37069+++ linux-2.6.39.1/drivers/pcmcia/db1xxx_ss.c 2011-05-22 19:36:32.000000000 -0400
37070@@ -384,7 +384,7 @@ static int au1x00_pcmcia_set_mem_map(str
37071 return 0;
37072 }
37073
37074-static struct pccard_operations db1x_pcmcia_operations = {
37075+static const struct pccard_operations db1x_pcmcia_operations = {
37076 .init = db1x_pcmcia_sock_init,
37077 .suspend = db1x_pcmcia_sock_suspend,
37078 .get_status = db1x_pcmcia_get_status,
37079diff -urNp linux-2.6.39.1/drivers/pcmcia/electra_cf.c linux-2.6.39.1/drivers/pcmcia/electra_cf.c
37080--- linux-2.6.39.1/drivers/pcmcia/electra_cf.c 2011-05-19 00:06:34.000000000 -0400
37081+++ linux-2.6.39.1/drivers/pcmcia/electra_cf.c 2011-05-22 19:36:32.000000000 -0400
37082@@ -173,7 +173,7 @@ static int electra_cf_set_mem_map(struct
37083 return 0;
37084 }
37085
37086-static struct pccard_operations electra_cf_ops = {
37087+static const struct pccard_operations electra_cf_ops = {
37088 .init = electra_cf_ss_init,
37089 .get_status = electra_cf_get_status,
37090 .set_socket = electra_cf_set_socket,
37091diff -urNp linux-2.6.39.1/drivers/pcmcia/m32r_cfc.c linux-2.6.39.1/drivers/pcmcia/m32r_cfc.c
37092--- linux-2.6.39.1/drivers/pcmcia/m32r_cfc.c 2011-05-19 00:06:34.000000000 -0400
37093+++ linux-2.6.39.1/drivers/pcmcia/m32r_cfc.c 2011-05-22 19:36:32.000000000 -0400
37094@@ -674,7 +674,7 @@ static int pcc_init(struct pcmcia_socket
37095 return 0;
37096 }
37097
37098-static struct pccard_operations pcc_operations = {
37099+static const struct pccard_operations pcc_operations = {
37100 .init = pcc_init,
37101 .get_status = pcc_get_status,
37102 .set_socket = pcc_set_socket,
37103diff -urNp linux-2.6.39.1/drivers/pcmcia/m32r_pcc.c linux-2.6.39.1/drivers/pcmcia/m32r_pcc.c
37104--- linux-2.6.39.1/drivers/pcmcia/m32r_pcc.c 2011-05-19 00:06:34.000000000 -0400
37105+++ linux-2.6.39.1/drivers/pcmcia/m32r_pcc.c 2011-05-22 19:36:32.000000000 -0400
37106@@ -652,7 +652,7 @@ static int pcc_init(struct pcmcia_socket
37107 return 0;
37108 }
37109
37110-static struct pccard_operations pcc_operations = {
37111+static const struct pccard_operations pcc_operations = {
37112 .init = pcc_init,
37113 .get_status = pcc_get_status,
37114 .set_socket = pcc_set_socket,
37115diff -urNp linux-2.6.39.1/drivers/pcmcia/m8xx_pcmcia.c linux-2.6.39.1/drivers/pcmcia/m8xx_pcmcia.c
37116--- linux-2.6.39.1/drivers/pcmcia/m8xx_pcmcia.c 2011-05-19 00:06:34.000000000 -0400
37117+++ linux-2.6.39.1/drivers/pcmcia/m8xx_pcmcia.c 2011-05-22 19:36:32.000000000 -0400
37118@@ -1139,7 +1139,7 @@ static int m8xx_sock_suspend(struct pcmc
37119 return m8xx_set_socket(sock, &dead_socket);
37120 }
37121
37122-static struct pccard_operations m8xx_services = {
37123+static const struct pccard_operations m8xx_services = {
37124 .init = m8xx_sock_init,
37125 .suspend = m8xx_sock_suspend,
37126 .get_status = m8xx_get_status,
37127diff -urNp linux-2.6.39.1/drivers/pcmcia/omap_cf.c linux-2.6.39.1/drivers/pcmcia/omap_cf.c
37128--- linux-2.6.39.1/drivers/pcmcia/omap_cf.c 2011-05-19 00:06:34.000000000 -0400
37129+++ linux-2.6.39.1/drivers/pcmcia/omap_cf.c 2011-05-22 19:36:32.000000000 -0400
37130@@ -185,7 +185,7 @@ omap_cf_set_mem_map(struct pcmcia_socket
37131 return 0;
37132 }
37133
37134-static struct pccard_operations omap_cf_ops = {
37135+static const struct pccard_operations omap_cf_ops = {
37136 .init = omap_cf_ss_init,
37137 .suspend = omap_cf_ss_suspend,
37138 .get_status = omap_cf_get_status,
37139diff -urNp linux-2.6.39.1/drivers/pcmcia/rsrc_iodyn.c linux-2.6.39.1/drivers/pcmcia/rsrc_iodyn.c
37140--- linux-2.6.39.1/drivers/pcmcia/rsrc_iodyn.c 2011-05-19 00:06:34.000000000 -0400
37141+++ linux-2.6.39.1/drivers/pcmcia/rsrc_iodyn.c 2011-05-22 19:36:32.000000000 -0400
37142@@ -161,7 +161,7 @@ static int iodyn_find_io(struct pcmcia_s
37143 }
37144
37145
37146-struct pccard_resource_ops pccard_iodyn_ops = {
37147+const struct pccard_resource_ops pccard_iodyn_ops = {
37148 .validate_mem = NULL,
37149 .find_io = iodyn_find_io,
37150 .find_mem = NULL,
37151diff -urNp linux-2.6.39.1/drivers/pcmcia/rsrc_mgr.c linux-2.6.39.1/drivers/pcmcia/rsrc_mgr.c
37152--- linux-2.6.39.1/drivers/pcmcia/rsrc_mgr.c 2011-05-19 00:06:34.000000000 -0400
37153+++ linux-2.6.39.1/drivers/pcmcia/rsrc_mgr.c 2011-05-22 19:36:32.000000000 -0400
37154@@ -57,7 +57,7 @@ static int static_find_io(struct pcmcia_
37155 }
37156
37157
37158-struct pccard_resource_ops pccard_static_ops = {
37159+const struct pccard_resource_ops pccard_static_ops = {
37160 .validate_mem = NULL,
37161 .find_io = static_find_io,
37162 .find_mem = NULL,
37163diff -urNp linux-2.6.39.1/drivers/pcmcia/vrc4171_card.c linux-2.6.39.1/drivers/pcmcia/vrc4171_card.c
37164--- linux-2.6.39.1/drivers/pcmcia/vrc4171_card.c 2011-05-19 00:06:34.000000000 -0400
37165+++ linux-2.6.39.1/drivers/pcmcia/vrc4171_card.c 2011-05-22 19:36:32.000000000 -0400
37166@@ -479,7 +479,7 @@ static int pccard_set_mem_map(struct pcm
37167 return 0;
37168 }
37169
37170-static struct pccard_operations vrc4171_pccard_operations = {
37171+static const struct pccard_operations vrc4171_pccard_operations = {
37172 .init = pccard_init,
37173 .get_status = pccard_get_status,
37174 .set_socket = pccard_set_socket,
37175diff -urNp linux-2.6.39.1/drivers/pcmcia/vrc4173_cardu.c linux-2.6.39.1/drivers/pcmcia/vrc4173_cardu.c
37176--- linux-2.6.39.1/drivers/pcmcia/vrc4173_cardu.c 2011-05-19 00:06:34.000000000 -0400
37177+++ linux-2.6.39.1/drivers/pcmcia/vrc4173_cardu.c 2011-05-22 19:36:32.000000000 -0400
37178@@ -384,7 +384,7 @@ static void cardu_proc_setup(unsigned in
37179 {
37180 }
37181
37182-static struct pccard_operations cardu_operations = {
37183+static const struct pccard_operations cardu_operations = {
37184 .init = cardu_init,
37185 .register_callback = cardu_register_callback,
37186 .inquire_socket = cardu_inquire_socket,
37187diff -urNp linux-2.6.39.1/drivers/pcmcia/xxs1500_ss.c linux-2.6.39.1/drivers/pcmcia/xxs1500_ss.c
37188--- linux-2.6.39.1/drivers/pcmcia/xxs1500_ss.c 2011-05-19 00:06:34.000000000 -0400
37189+++ linux-2.6.39.1/drivers/pcmcia/xxs1500_ss.c 2011-05-22 19:36:32.000000000 -0400
37190@@ -196,7 +196,7 @@ static int au1x00_pcmcia_set_mem_map(str
37191 return 0;
37192 }
37193
37194-static struct pccard_operations xxs1500_pcmcia_operations = {
37195+static const struct pccard_operations xxs1500_pcmcia_operations = {
37196 .init = xxs1500_pcmcia_sock_init,
37197 .suspend = xxs1500_pcmcia_sock_suspend,
37198 .get_status = xxs1500_pcmcia_get_status,
37199diff -urNp linux-2.6.39.1/drivers/platform/x86/acerhdf.c linux-2.6.39.1/drivers/platform/x86/acerhdf.c
37200--- linux-2.6.39.1/drivers/platform/x86/acerhdf.c 2011-05-19 00:06:34.000000000 -0400
37201+++ linux-2.6.39.1/drivers/platform/x86/acerhdf.c 2011-05-22 19:36:32.000000000 -0400
37202@@ -406,7 +406,7 @@ static int acerhdf_get_crit_temp(struct
37203 }
37204
37205 /* bind callback functions to thermalzone */
37206-static struct thermal_zone_device_ops acerhdf_dev_ops = {
37207+static const struct thermal_zone_device_ops acerhdf_dev_ops = {
37208 .bind = acerhdf_bind,
37209 .unbind = acerhdf_unbind,
37210 .get_temp = acerhdf_get_ec_temp,
37211@@ -481,7 +481,7 @@ err_out:
37212 }
37213
37214 /* bind fan callbacks to fan device */
37215-static struct thermal_cooling_device_ops acerhdf_cooling_ops = {
37216+static const struct thermal_cooling_device_ops acerhdf_cooling_ops = {
37217 .get_max_state = acerhdf_get_max_state,
37218 .get_cur_state = acerhdf_get_cur_state,
37219 .set_cur_state = acerhdf_set_cur_state,
37220diff -urNp linux-2.6.39.1/drivers/platform/x86/ideapad-laptop.c linux-2.6.39.1/drivers/platform/x86/ideapad-laptop.c
37221--- linux-2.6.39.1/drivers/platform/x86/ideapad-laptop.c 2011-05-19 00:06:34.000000000 -0400
37222+++ linux-2.6.39.1/drivers/platform/x86/ideapad-laptop.c 2011-05-22 19:36:32.000000000 -0400
37223@@ -207,7 +207,7 @@ static int ideapad_rfk_set(void *data, b
37224 return write_ec_cmd(ideapad_handle, opcode, !blocked);
37225 }
37226
37227-static struct rfkill_ops ideapad_rfk_ops = {
37228+static const struct rfkill_ops ideapad_rfk_ops = {
37229 .set_block = ideapad_rfk_set,
37230 };
37231
37232diff -urNp linux-2.6.39.1/drivers/platform/x86/intel_menlow.c linux-2.6.39.1/drivers/platform/x86/intel_menlow.c
37233--- linux-2.6.39.1/drivers/platform/x86/intel_menlow.c 2011-05-19 00:06:34.000000000 -0400
37234+++ linux-2.6.39.1/drivers/platform/x86/intel_menlow.c 2011-05-22 19:36:32.000000000 -0400
37235@@ -143,7 +143,7 @@ static int memory_set_cur_bandwidth(stru
37236 return 0;
37237 }
37238
37239-static struct thermal_cooling_device_ops memory_cooling_ops = {
37240+static const struct thermal_cooling_device_ops memory_cooling_ops = {
37241 .get_max_state = memory_get_max_bandwidth,
37242 .get_cur_state = memory_get_cur_bandwidth,
37243 .set_cur_state = memory_set_cur_bandwidth,
37244diff -urNp linux-2.6.39.1/drivers/platform/x86/intel_mid_thermal.c linux-2.6.39.1/drivers/platform/x86/intel_mid_thermal.c
37245--- linux-2.6.39.1/drivers/platform/x86/intel_mid_thermal.c 2011-05-19 00:06:34.000000000 -0400
37246+++ linux-2.6.39.1/drivers/platform/x86/intel_mid_thermal.c 2011-05-22 19:36:32.000000000 -0400
37247@@ -458,7 +458,7 @@ static int read_curr_temp(struct thermal
37248 }
37249
37250 /* Can't be const */
37251-static struct thermal_zone_device_ops tzd_ops = {
37252+static const struct thermal_zone_device_ops tzd_ops = {
37253 .get_temp = read_curr_temp,
37254 };
37255
37256diff -urNp linux-2.6.39.1/drivers/platform/x86/samsung-laptop.c linux-2.6.39.1/drivers/platform/x86/samsung-laptop.c
37257--- linux-2.6.39.1/drivers/platform/x86/samsung-laptop.c 2011-05-19 00:06:34.000000000 -0400
37258+++ linux-2.6.39.1/drivers/platform/x86/samsung-laptop.c 2011-05-22 19:36:32.000000000 -0400
37259@@ -419,7 +419,7 @@ static int rfkill_set(void *data, bool b
37260 return 0;
37261 }
37262
37263-static struct rfkill_ops rfkill_ops = {
37264+static const struct rfkill_ops rfkill_ops = {
37265 .set_block = rfkill_set,
37266 };
37267
37268diff -urNp linux-2.6.39.1/drivers/pnp/pnpbios/bioscalls.c linux-2.6.39.1/drivers/pnp/pnpbios/bioscalls.c
37269--- linux-2.6.39.1/drivers/pnp/pnpbios/bioscalls.c 2011-05-19 00:06:34.000000000 -0400
37270+++ linux-2.6.39.1/drivers/pnp/pnpbios/bioscalls.c 2011-05-22 19:36:32.000000000 -0400
37271@@ -59,7 +59,7 @@ do { \
37272 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
37273 } while(0)
37274
37275-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
37276+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
37277 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
37278
37279 /*
37280@@ -96,7 +96,10 @@ static inline u16 call_pnp_bios(u16 func
37281
37282 cpu = get_cpu();
37283 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
37284+
37285+ pax_open_kernel();
37286 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
37287+ pax_close_kernel();
37288
37289 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
37290 spin_lock_irqsave(&pnp_bios_lock, flags);
37291@@ -134,7 +137,10 @@ static inline u16 call_pnp_bios(u16 func
37292 :"memory");
37293 spin_unlock_irqrestore(&pnp_bios_lock, flags);
37294
37295+ pax_open_kernel();
37296 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
37297+ pax_close_kernel();
37298+
37299 put_cpu();
37300
37301 /* If we get here and this is set then the PnP BIOS faulted on us. */
37302@@ -468,7 +474,7 @@ int pnp_bios_read_escd(char *data, u32 n
37303 return status;
37304 }
37305
37306-void pnpbios_calls_init(union pnp_bios_install_struct *header)
37307+void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
37308 {
37309 int i;
37310
37311@@ -476,6 +482,8 @@ void pnpbios_calls_init(union pnp_bios_i
37312 pnp_bios_callpoint.offset = header->fields.pm16offset;
37313 pnp_bios_callpoint.segment = PNP_CS16;
37314
37315+ pax_open_kernel();
37316+
37317 for_each_possible_cpu(i) {
37318 struct desc_struct *gdt = get_cpu_gdt_table(i);
37319 if (!gdt)
37320@@ -487,4 +495,6 @@ void pnpbios_calls_init(union pnp_bios_i
37321 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
37322 (unsigned long)__va(header->fields.pm16dseg));
37323 }
37324+
37325+ pax_close_kernel();
37326 }
37327diff -urNp linux-2.6.39.1/drivers/pnp/resource.c linux-2.6.39.1/drivers/pnp/resource.c
37328--- linux-2.6.39.1/drivers/pnp/resource.c 2011-05-19 00:06:34.000000000 -0400
37329+++ linux-2.6.39.1/drivers/pnp/resource.c 2011-05-22 19:36:32.000000000 -0400
37330@@ -360,7 +360,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
37331 return 1;
37332
37333 /* check if the resource is valid */
37334- if (*irq < 0 || *irq > 15)
37335+ if (*irq > 15)
37336 return 0;
37337
37338 /* check if the resource is reserved */
37339@@ -424,7 +424,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
37340 return 1;
37341
37342 /* check if the resource is valid */
37343- if (*dma < 0 || *dma == 4 || *dma > 7)
37344+ if (*dma == 4 || *dma > 7)
37345 return 0;
37346
37347 /* check if the resource is reserved */
37348diff -urNp linux-2.6.39.1/drivers/power/max8925_power.c linux-2.6.39.1/drivers/power/max8925_power.c
37349--- linux-2.6.39.1/drivers/power/max8925_power.c 2011-05-19 00:06:34.000000000 -0400
37350+++ linux-2.6.39.1/drivers/power/max8925_power.c 2011-05-22 19:36:32.000000000 -0400
37351@@ -426,7 +426,7 @@ static __devinit int max8925_power_probe
37352 {
37353 struct max8925_chip *chip = dev_get_drvdata(pdev->dev.parent);
37354 struct max8925_platform_data *max8925_pdata;
37355- struct max8925_power_pdata *pdata = NULL;
37356+ const struct max8925_power_pdata *pdata = NULL;
37357 struct max8925_power_info *info;
37358 int ret;
37359
37360diff -urNp linux-2.6.39.1/drivers/regulator/core.c linux-2.6.39.1/drivers/regulator/core.c
37361--- linux-2.6.39.1/drivers/regulator/core.c 2011-05-19 00:06:34.000000000 -0400
37362+++ linux-2.6.39.1/drivers/regulator/core.c 2011-05-22 19:36:32.000000000 -0400
37363@@ -2883,7 +2883,7 @@ core_initcall(regulator_init);
37364 static int __init regulator_init_complete(void)
37365 {
37366 struct regulator_dev *rdev;
37367- struct regulator_ops *ops;
37368+ const struct regulator_ops *ops;
37369 struct regulation_constraints *c;
37370 int enabled, ret;
37371
37372diff -urNp linux-2.6.39.1/drivers/rtc/rtc-at32ap700x.c linux-2.6.39.1/drivers/rtc/rtc-at32ap700x.c
37373--- linux-2.6.39.1/drivers/rtc/rtc-at32ap700x.c 2011-05-19 00:06:34.000000000 -0400
37374+++ linux-2.6.39.1/drivers/rtc/rtc-at32ap700x.c 2011-05-22 19:36:32.000000000 -0400
37375@@ -187,7 +187,7 @@ static irqreturn_t at32_rtc_interrupt(in
37376 return ret;
37377 }
37378
37379-static struct rtc_class_ops at32_rtc_ops = {
37380+static const struct rtc_class_ops at32_rtc_ops = {
37381 .read_time = at32_rtc_readtime,
37382 .set_time = at32_rtc_settime,
37383 .read_alarm = at32_rtc_readalarm,
37384diff -urNp linux-2.6.39.1/drivers/rtc/rtc-au1xxx.c linux-2.6.39.1/drivers/rtc/rtc-au1xxx.c
37385--- linux-2.6.39.1/drivers/rtc/rtc-au1xxx.c 2011-05-19 00:06:34.000000000 -0400
37386+++ linux-2.6.39.1/drivers/rtc/rtc-au1xxx.c 2011-05-22 19:36:32.000000000 -0400
37387@@ -57,7 +57,7 @@ static int au1xtoy_rtc_set_time(struct d
37388 return 0;
37389 }
37390
37391-static struct rtc_class_ops au1xtoy_rtc_ops = {
37392+static const struct rtc_class_ops au1xtoy_rtc_ops = {
37393 .read_time = au1xtoy_rtc_read_time,
37394 .set_time = au1xtoy_rtc_set_time,
37395 };
37396diff -urNp linux-2.6.39.1/drivers/rtc/rtc-bfin.c linux-2.6.39.1/drivers/rtc/rtc-bfin.c
37397--- linux-2.6.39.1/drivers/rtc/rtc-bfin.c 2011-05-19 00:06:34.000000000 -0400
37398+++ linux-2.6.39.1/drivers/rtc/rtc-bfin.c 2011-05-22 19:36:32.000000000 -0400
37399@@ -333,7 +333,7 @@ static int bfin_rtc_proc(struct device *
37400 #undef yesno
37401 }
37402
37403-static struct rtc_class_ops bfin_rtc_ops = {
37404+static const struct rtc_class_ops bfin_rtc_ops = {
37405 .read_time = bfin_rtc_read_time,
37406 .set_time = bfin_rtc_set_time,
37407 .read_alarm = bfin_rtc_read_alarm,
37408diff -urNp linux-2.6.39.1/drivers/rtc/rtc-coh901331.c linux-2.6.39.1/drivers/rtc/rtc-coh901331.c
37409--- linux-2.6.39.1/drivers/rtc/rtc-coh901331.c 2011-05-19 00:06:34.000000000 -0400
37410+++ linux-2.6.39.1/drivers/rtc/rtc-coh901331.c 2011-05-22 19:36:32.000000000 -0400
37411@@ -142,7 +142,7 @@ static int coh901331_alarm_irq_enable(st
37412 return 0;
37413 }
37414
37415-static struct rtc_class_ops coh901331_ops = {
37416+static const struct rtc_class_ops coh901331_ops = {
37417 .read_time = coh901331_read_time,
37418 .set_mmss = coh901331_set_mmss,
37419 .read_alarm = coh901331_read_alarm,
37420diff -urNp linux-2.6.39.1/drivers/rtc/rtc-davinci.c linux-2.6.39.1/drivers/rtc/rtc-davinci.c
37421--- linux-2.6.39.1/drivers/rtc/rtc-davinci.c 2011-05-19 00:06:34.000000000 -0400
37422+++ linux-2.6.39.1/drivers/rtc/rtc-davinci.c 2011-05-22 19:36:32.000000000 -0400
37423@@ -469,7 +469,7 @@ static int davinci_rtc_set_alarm(struct
37424 return 0;
37425 }
37426
37427-static struct rtc_class_ops davinci_rtc_ops = {
37428+static const struct rtc_class_ops davinci_rtc_ops = {
37429 .ioctl = davinci_rtc_ioctl,
37430 .read_time = davinci_rtc_read_time,
37431 .set_time = davinci_rtc_set_time,
37432diff -urNp linux-2.6.39.1/drivers/rtc/rtc-dev.c linux-2.6.39.1/drivers/rtc/rtc-dev.c
37433--- linux-2.6.39.1/drivers/rtc/rtc-dev.c 2011-05-19 00:06:34.000000000 -0400
37434+++ linux-2.6.39.1/drivers/rtc/rtc-dev.c 2011-05-22 19:41:37.000000000 -0400
37435@@ -14,6 +14,7 @@
37436 #include <linux/module.h>
37437 #include <linux/rtc.h>
37438 #include <linux/sched.h>
37439+#include <linux/grsecurity.h>
37440 #include "rtc-core.h"
37441
37442 static dev_t rtc_devt;
37443@@ -345,6 +346,8 @@ static long rtc_dev_ioctl(struct file *f
37444 if (copy_from_user(&tm, uarg, sizeof(tm)))
37445 return -EFAULT;
37446
37447+ gr_log_timechange();
37448+
37449 return rtc_set_time(rtc, &tm);
37450
37451 case RTC_PIE_ON:
37452diff -urNp linux-2.6.39.1/drivers/rtc/rtc-dm355evm.c linux-2.6.39.1/drivers/rtc/rtc-dm355evm.c
37453--- linux-2.6.39.1/drivers/rtc/rtc-dm355evm.c 2011-05-19 00:06:34.000000000 -0400
37454+++ linux-2.6.39.1/drivers/rtc/rtc-dm355evm.c 2011-05-22 19:36:32.000000000 -0400
37455@@ -115,7 +115,7 @@ static int dm355evm_rtc_set_time(struct
37456 return 0;
37457 }
37458
37459-static struct rtc_class_ops dm355evm_rtc_ops = {
37460+static const struct rtc_class_ops dm355evm_rtc_ops = {
37461 .read_time = dm355evm_rtc_read_time,
37462 .set_time = dm355evm_rtc_set_time,
37463 };
37464diff -urNp linux-2.6.39.1/drivers/rtc/rtc-ds1302.c linux-2.6.39.1/drivers/rtc/rtc-ds1302.c
37465--- linux-2.6.39.1/drivers/rtc/rtc-ds1302.c 2011-05-19 00:06:34.000000000 -0400
37466+++ linux-2.6.39.1/drivers/rtc/rtc-ds1302.c 2011-05-22 19:36:32.000000000 -0400
37467@@ -199,7 +199,7 @@ static int ds1302_rtc_ioctl(struct devic
37468 return -ENOIOCTLCMD;
37469 }
37470
37471-static struct rtc_class_ops ds1302_rtc_ops = {
37472+static const struct rtc_class_ops ds1302_rtc_ops = {
37473 .read_time = ds1302_rtc_read_time,
37474 .set_time = ds1302_rtc_set_time,
37475 .ioctl = ds1302_rtc_ioctl,
37476diff -urNp linux-2.6.39.1/drivers/rtc/rtc-imxdi.c linux-2.6.39.1/drivers/rtc/rtc-imxdi.c
37477--- linux-2.6.39.1/drivers/rtc/rtc-imxdi.c 2011-05-19 00:06:34.000000000 -0400
37478+++ linux-2.6.39.1/drivers/rtc/rtc-imxdi.c 2011-05-22 19:36:32.000000000 -0400
37479@@ -290,7 +290,7 @@ static int dryice_rtc_set_alarm(struct d
37480 return 0;
37481 }
37482
37483-static struct rtc_class_ops dryice_rtc_ops = {
37484+static const struct rtc_class_ops dryice_rtc_ops = {
37485 .read_time = dryice_rtc_read_time,
37486 .set_mmss = dryice_rtc_set_mmss,
37487 .alarm_irq_enable = dryice_rtc_alarm_irq_enable,
37488diff -urNp linux-2.6.39.1/drivers/rtc/rtc-jz4740.c linux-2.6.39.1/drivers/rtc/rtc-jz4740.c
37489--- linux-2.6.39.1/drivers/rtc/rtc-jz4740.c 2011-05-19 00:06:34.000000000 -0400
37490+++ linux-2.6.39.1/drivers/rtc/rtc-jz4740.c 2011-05-22 19:36:32.000000000 -0400
37491@@ -174,7 +174,7 @@ static int jz4740_rtc_alarm_irq_enable(s
37492 return jz4740_rtc_ctrl_set_bits(rtc, JZ_RTC_CTRL_AF_IRQ, enable);
37493 }
37494
37495-static struct rtc_class_ops jz4740_rtc_ops = {
37496+static const struct rtc_class_ops jz4740_rtc_ops = {
37497 .read_time = jz4740_rtc_read_time,
37498 .set_mmss = jz4740_rtc_set_mmss,
37499 .read_alarm = jz4740_rtc_read_alarm,
37500diff -urNp linux-2.6.39.1/drivers/rtc/rtc-m41t80.c linux-2.6.39.1/drivers/rtc/rtc-m41t80.c
37501--- linux-2.6.39.1/drivers/rtc/rtc-m41t80.c 2011-05-19 00:06:34.000000000 -0400
37502+++ linux-2.6.39.1/drivers/rtc/rtc-m41t80.c 2011-05-22 19:36:32.000000000 -0400
37503@@ -354,7 +354,7 @@ static int m41t80_rtc_read_alarm(struct
37504 return 0;
37505 }
37506
37507-static struct rtc_class_ops m41t80_rtc_ops = {
37508+static const struct rtc_class_ops m41t80_rtc_ops = {
37509 .read_time = m41t80_rtc_read_time,
37510 .set_time = m41t80_rtc_set_time,
37511 .read_alarm = m41t80_rtc_read_alarm,
37512diff -urNp linux-2.6.39.1/drivers/rtc/rtc-mxc.c linux-2.6.39.1/drivers/rtc/rtc-mxc.c
37513--- linux-2.6.39.1/drivers/rtc/rtc-mxc.c 2011-05-19 00:06:34.000000000 -0400
37514+++ linux-2.6.39.1/drivers/rtc/rtc-mxc.c 2011-05-22 19:36:32.000000000 -0400
37515@@ -355,7 +355,7 @@ static int mxc_rtc_set_alarm(struct devi
37516 }
37517
37518 /* RTC layer */
37519-static struct rtc_class_ops mxc_rtc_ops = {
37520+static const struct rtc_class_ops mxc_rtc_ops = {
37521 .release = mxc_rtc_release,
37522 .read_time = mxc_rtc_read_time,
37523 .set_mmss = mxc_rtc_set_mmss,
37524diff -urNp linux-2.6.39.1/drivers/rtc/rtc-nuc900.c linux-2.6.39.1/drivers/rtc/rtc-nuc900.c
37525--- linux-2.6.39.1/drivers/rtc/rtc-nuc900.c 2011-05-19 00:06:34.000000000 -0400
37526+++ linux-2.6.39.1/drivers/rtc/rtc-nuc900.c 2011-05-22 19:36:32.000000000 -0400
37527@@ -214,7 +214,7 @@ static int nuc900_rtc_set_alarm(struct d
37528 return 0;
37529 }
37530
37531-static struct rtc_class_ops nuc900_rtc_ops = {
37532+static const struct rtc_class_ops nuc900_rtc_ops = {
37533 .read_time = nuc900_rtc_read_time,
37534 .set_time = nuc900_rtc_set_time,
37535 .read_alarm = nuc900_rtc_read_alarm,
37536diff -urNp linux-2.6.39.1/drivers/rtc/rtc-omap.c linux-2.6.39.1/drivers/rtc/rtc-omap.c
37537--- linux-2.6.39.1/drivers/rtc/rtc-omap.c 2011-05-19 00:06:34.000000000 -0400
37538+++ linux-2.6.39.1/drivers/rtc/rtc-omap.c 2011-05-22 19:36:32.000000000 -0400
37539@@ -274,7 +274,7 @@ static int omap_rtc_set_alarm(struct dev
37540 return 0;
37541 }
37542
37543-static struct rtc_class_ops omap_rtc_ops = {
37544+static const struct rtc_class_ops omap_rtc_ops = {
37545 .read_time = omap_rtc_read_time,
37546 .set_time = omap_rtc_set_time,
37547 .read_alarm = omap_rtc_read_alarm,
37548diff -urNp linux-2.6.39.1/drivers/rtc/rtc-pcf50633.c linux-2.6.39.1/drivers/rtc/rtc-pcf50633.c
37549--- linux-2.6.39.1/drivers/rtc/rtc-pcf50633.c 2011-05-19 00:06:34.000000000 -0400
37550+++ linux-2.6.39.1/drivers/rtc/rtc-pcf50633.c 2011-05-22 19:36:32.000000000 -0400
37551@@ -238,7 +238,7 @@ static int pcf50633_rtc_set_alarm(struct
37552 return ret;
37553 }
37554
37555-static struct rtc_class_ops pcf50633_rtc_ops = {
37556+static const struct rtc_class_ops pcf50633_rtc_ops = {
37557 .read_time = pcf50633_rtc_read_time,
37558 .set_time = pcf50633_rtc_set_time,
37559 .read_alarm = pcf50633_rtc_read_alarm,
37560diff -urNp linux-2.6.39.1/drivers/rtc/rtc-pl031.c linux-2.6.39.1/drivers/rtc/rtc-pl031.c
37561--- linux-2.6.39.1/drivers/rtc/rtc-pl031.c 2011-05-19 00:06:34.000000000 -0400
37562+++ linux-2.6.39.1/drivers/rtc/rtc-pl031.c 2011-05-22 19:36:32.000000000 -0400
37563@@ -374,7 +374,7 @@ err_req:
37564 }
37565
37566 /* Operations for the original ARM version */
37567-static struct rtc_class_ops arm_pl031_ops = {
37568+static const struct rtc_class_ops arm_pl031_ops = {
37569 .read_time = pl031_read_time,
37570 .set_time = pl031_set_time,
37571 .read_alarm = pl031_read_alarm,
37572@@ -383,7 +383,7 @@ static struct rtc_class_ops arm_pl031_op
37573 };
37574
37575 /* The First ST derivative */
37576-static struct rtc_class_ops stv1_pl031_ops = {
37577+static const struct rtc_class_ops stv1_pl031_ops = {
37578 .read_time = pl031_read_time,
37579 .set_time = pl031_set_time,
37580 .read_alarm = pl031_read_alarm,
37581@@ -392,7 +392,7 @@ static struct rtc_class_ops stv1_pl031_o
37582 };
37583
37584 /* And the second ST derivative */
37585-static struct rtc_class_ops stv2_pl031_ops = {
37586+static const struct rtc_class_ops stv2_pl031_ops = {
37587 .read_time = pl031_stv2_read_time,
37588 .set_time = pl031_stv2_set_time,
37589 .read_alarm = pl031_stv2_read_alarm,
37590diff -urNp linux-2.6.39.1/drivers/rtc/rtc-rx8025.c linux-2.6.39.1/drivers/rtc/rtc-rx8025.c
37591--- linux-2.6.39.1/drivers/rtc/rtc-rx8025.c 2011-05-19 00:06:34.000000000 -0400
37592+++ linux-2.6.39.1/drivers/rtc/rtc-rx8025.c 2011-05-22 19:36:32.000000000 -0400
37593@@ -424,7 +424,7 @@ static int rx8025_alarm_irq_enable(struc
37594 return 0;
37595 }
37596
37597-static struct rtc_class_ops rx8025_rtc_ops = {
37598+static const struct rtc_class_ops rx8025_rtc_ops = {
37599 .read_time = rx8025_get_time,
37600 .set_time = rx8025_set_time,
37601 .read_alarm = rx8025_read_alarm,
37602diff -urNp linux-2.6.39.1/drivers/rtc/rtc-sh.c linux-2.6.39.1/drivers/rtc/rtc-sh.c
37603--- linux-2.6.39.1/drivers/rtc/rtc-sh.c 2011-05-19 00:06:34.000000000 -0400
37604+++ linux-2.6.39.1/drivers/rtc/rtc-sh.c 2011-05-22 19:36:32.000000000 -0400
37605@@ -576,7 +576,7 @@ static int sh_rtc_set_alarm(struct devic
37606 return 0;
37607 }
37608
37609-static struct rtc_class_ops sh_rtc_ops = {
37610+static const struct rtc_class_ops sh_rtc_ops = {
37611 .read_time = sh_rtc_read_time,
37612 .set_time = sh_rtc_set_time,
37613 .read_alarm = sh_rtc_read_alarm,
37614diff -urNp linux-2.6.39.1/drivers/rtc/rtc-stmp3xxx.c linux-2.6.39.1/drivers/rtc/rtc-stmp3xxx.c
37615--- linux-2.6.39.1/drivers/rtc/rtc-stmp3xxx.c 2011-05-19 00:06:34.000000000 -0400
37616+++ linux-2.6.39.1/drivers/rtc/rtc-stmp3xxx.c 2011-05-22 19:36:32.000000000 -0400
37617@@ -133,7 +133,7 @@ static int stmp3xxx_rtc_set_alarm(struct
37618 return 0;
37619 }
37620
37621-static struct rtc_class_ops stmp3xxx_rtc_ops = {
37622+static const struct rtc_class_ops stmp3xxx_rtc_ops = {
37623 .alarm_irq_enable =
37624 stmp3xxx_alarm_irq_enable,
37625 .read_time = stmp3xxx_rtc_gettime,
37626diff -urNp linux-2.6.39.1/drivers/rtc/rtc-tegra.c linux-2.6.39.1/drivers/rtc/rtc-tegra.c
37627--- linux-2.6.39.1/drivers/rtc/rtc-tegra.c 2011-05-19 00:06:34.000000000 -0400
37628+++ linux-2.6.39.1/drivers/rtc/rtc-tegra.c 2011-05-22 19:36:32.000000000 -0400
37629@@ -294,7 +294,7 @@ static irqreturn_t tegra_rtc_irq_handler
37630 return IRQ_HANDLED;
37631 }
37632
37633-static struct rtc_class_ops tegra_rtc_ops = {
37634+static const struct rtc_class_ops tegra_rtc_ops = {
37635 .read_time = tegra_rtc_read_time,
37636 .set_time = tegra_rtc_set_time,
37637 .read_alarm = tegra_rtc_read_alarm,
37638diff -urNp linux-2.6.39.1/drivers/rtc/rtc-twl.c linux-2.6.39.1/drivers/rtc/rtc-twl.c
37639--- linux-2.6.39.1/drivers/rtc/rtc-twl.c 2011-05-19 00:06:34.000000000 -0400
37640+++ linux-2.6.39.1/drivers/rtc/rtc-twl.c 2011-05-22 19:36:32.000000000 -0400
37641@@ -415,7 +415,7 @@ out:
37642 return ret;
37643 }
37644
37645-static struct rtc_class_ops twl_rtc_ops = {
37646+static const struct rtc_class_ops twl_rtc_ops = {
37647 .read_time = twl_rtc_read_time,
37648 .set_time = twl_rtc_set_time,
37649 .read_alarm = twl_rtc_read_alarm,
37650diff -urNp linux-2.6.39.1/drivers/rtc/rtc-v3020.c linux-2.6.39.1/drivers/rtc/rtc-v3020.c
37651--- linux-2.6.39.1/drivers/rtc/rtc-v3020.c 2011-05-19 00:06:34.000000000 -0400
37652+++ linux-2.6.39.1/drivers/rtc/rtc-v3020.c 2011-05-22 19:36:32.000000000 -0400
37653@@ -62,7 +62,7 @@ struct v3020 {
37654 /* GPIO access */
37655 struct v3020_gpio *gpio;
37656
37657- struct v3020_chip_ops *ops;
37658+ const struct v3020_chip_ops *ops;
37659
37660 struct rtc_device *rtc;
37661 };
37662@@ -100,7 +100,7 @@ static unsigned char v3020_mmio_read_bit
37663 return !!(readl(chip->ioaddress) & (1 << chip->leftshift));
37664 }
37665
37666-static struct v3020_chip_ops v3020_mmio_ops = {
37667+static const struct v3020_chip_ops v3020_mmio_ops = {
37668 .map_io = v3020_mmio_map,
37669 .unmap_io = v3020_mmio_unmap,
37670 .read_bit = v3020_mmio_read_bit,
37671@@ -177,7 +177,7 @@ static unsigned char v3020_gpio_read_bit
37672 return bit;
37673 }
37674
37675-static struct v3020_chip_ops v3020_gpio_ops = {
37676+static const struct v3020_chip_ops v3020_gpio_ops = {
37677 .map_io = v3020_gpio_map,
37678 .unmap_io = v3020_gpio_unmap,
37679 .read_bit = v3020_gpio_read_bit,
37680diff -urNp linux-2.6.39.1/drivers/s390/char/con3270.c linux-2.6.39.1/drivers/s390/char/con3270.c
37681--- linux-2.6.39.1/drivers/s390/char/con3270.c 2011-05-19 00:06:34.000000000 -0400
37682+++ linux-2.6.39.1/drivers/s390/char/con3270.c 2011-05-22 19:36:32.000000000 -0400
37683@@ -28,7 +28,7 @@
37684 #define CON3270_OUTPUT_BUFFER_SIZE 1024
37685 #define CON3270_STRING_PAGES 4
37686
37687-static struct raw3270_fn con3270_fn;
37688+static const struct raw3270_fn con3270_fn;
37689
37690 /*
37691 * Main 3270 console view data structure.
37692@@ -413,7 +413,7 @@ con3270_irq(struct con3270 *cp, struct r
37693 }
37694
37695 /* Console view to a 3270 device. */
37696-static struct raw3270_fn con3270_fn = {
37697+static const struct raw3270_fn con3270_fn = {
37698 .activate = con3270_activate,
37699 .deactivate = con3270_deactivate,
37700 .intv = (void *) con3270_irq
37701diff -urNp linux-2.6.39.1/drivers/s390/char/fs3270.c linux-2.6.39.1/drivers/s390/char/fs3270.c
37702--- linux-2.6.39.1/drivers/s390/char/fs3270.c 2011-05-19 00:06:34.000000000 -0400
37703+++ linux-2.6.39.1/drivers/s390/char/fs3270.c 2011-05-22 19:36:32.000000000 -0400
37704@@ -24,7 +24,7 @@
37705 #include "raw3270.h"
37706 #include "ctrlchar.h"
37707
37708-static struct raw3270_fn fs3270_fn;
37709+static const struct raw3270_fn fs3270_fn;
37710
37711 struct fs3270 {
37712 struct raw3270_view view;
37713@@ -413,7 +413,7 @@ fs3270_release(struct raw3270_view *view
37714 }
37715
37716 /* View to a 3270 device. Can be console, tty or fullscreen. */
37717-static struct raw3270_fn fs3270_fn = {
37718+static const struct raw3270_fn fs3270_fn = {
37719 .activate = fs3270_activate,
37720 .deactivate = fs3270_deactivate,
37721 .intv = (void *) fs3270_irq,
37722diff -urNp linux-2.6.39.1/drivers/s390/char/raw3270.c linux-2.6.39.1/drivers/s390/char/raw3270.c
37723--- linux-2.6.39.1/drivers/s390/char/raw3270.c 2011-05-19 00:06:34.000000000 -0400
37724+++ linux-2.6.39.1/drivers/s390/char/raw3270.c 2011-05-22 19:36:32.000000000 -0400
37725@@ -488,7 +488,7 @@ raw3270_init_irq(struct raw3270_view *vi
37726 return RAW3270_IO_DONE;
37727 }
37728
37729-static struct raw3270_fn raw3270_init_fn = {
37730+static const struct raw3270_fn raw3270_init_fn = {
37731 .intv = raw3270_init_irq
37732 };
37733
37734diff -urNp linux-2.6.39.1/drivers/s390/char/tty3270.c linux-2.6.39.1/drivers/s390/char/tty3270.c
37735--- linux-2.6.39.1/drivers/s390/char/tty3270.c 2011-05-19 00:06:34.000000000 -0400
37736+++ linux-2.6.39.1/drivers/s390/char/tty3270.c 2011-05-22 19:36:32.000000000 -0400
37737@@ -37,7 +37,7 @@
37738 struct tty_driver *tty3270_driver;
37739 static int tty3270_max_index;
37740
37741-static struct raw3270_fn tty3270_fn;
37742+static const struct raw3270_fn tty3270_fn;
37743
37744 struct tty3270_cell {
37745 unsigned char character;
37746@@ -834,7 +834,7 @@ tty3270_del_views(void)
37747 }
37748 }
37749
37750-static struct raw3270_fn tty3270_fn = {
37751+static const struct raw3270_fn tty3270_fn = {
37752 .activate = tty3270_activate,
37753 .deactivate = tty3270_deactivate,
37754 .intv = (void *) tty3270_irq,
37755diff -urNp linux-2.6.39.1/drivers/s390/cio/qdio_debug.c linux-2.6.39.1/drivers/s390/cio/qdio_debug.c
37756--- linux-2.6.39.1/drivers/s390/cio/qdio_debug.c 2011-05-19 00:06:34.000000000 -0400
37757+++ linux-2.6.39.1/drivers/s390/cio/qdio_debug.c 2011-05-22 19:36:32.000000000 -0400
37758@@ -225,7 +225,7 @@ static int qperf_seq_open(struct inode *
37759 filp->f_path.dentry->d_inode->i_private);
37760 }
37761
37762-static struct file_operations debugfs_perf_fops = {
37763+static const struct file_operations debugfs_perf_fops = {
37764 .owner = THIS_MODULE,
37765 .open = qperf_seq_open,
37766 .read = seq_read,
37767diff -urNp linux-2.6.39.1/drivers/s390/crypto/zcrypt_cex2a.c linux-2.6.39.1/drivers/s390/crypto/zcrypt_cex2a.c
37768--- linux-2.6.39.1/drivers/s390/crypto/zcrypt_cex2a.c 2011-05-19 00:06:34.000000000 -0400
37769+++ linux-2.6.39.1/drivers/s390/crypto/zcrypt_cex2a.c 2011-05-22 19:36:32.000000000 -0400
37770@@ -415,7 +415,7 @@ out_free:
37771 /**
37772 * The crypto operations for a CEX2A card.
37773 */
37774-static struct zcrypt_ops zcrypt_cex2a_ops = {
37775+static const struct zcrypt_ops zcrypt_cex2a_ops = {
37776 .rsa_modexpo = zcrypt_cex2a_modexpo,
37777 .rsa_modexpo_crt = zcrypt_cex2a_modexpo_crt,
37778 };
37779diff -urNp linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcica.c linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcica.c
37780--- linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcica.c 2011-05-19 00:06:34.000000000 -0400
37781+++ linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcica.c 2011-05-22 19:36:32.000000000 -0400
37782@@ -347,7 +347,7 @@ out_free:
37783 /**
37784 * The crypto operations for a PCICA card.
37785 */
37786-static struct zcrypt_ops zcrypt_pcica_ops = {
37787+static const struct zcrypt_ops zcrypt_pcica_ops = {
37788 .rsa_modexpo = zcrypt_pcica_modexpo,
37789 .rsa_modexpo_crt = zcrypt_pcica_modexpo_crt,
37790 };
37791diff -urNp linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcicc.c linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcicc.c
37792--- linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcicc.c 2011-05-19 00:06:34.000000000 -0400
37793+++ linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcicc.c 2011-05-22 19:36:32.000000000 -0400
37794@@ -553,7 +553,7 @@ out_free:
37795 /**
37796 * The crypto operations for a PCICC card.
37797 */
37798-static struct zcrypt_ops zcrypt_pcicc_ops = {
37799+static const struct zcrypt_ops zcrypt_pcicc_ops = {
37800 .rsa_modexpo = zcrypt_pcicc_modexpo,
37801 .rsa_modexpo_crt = zcrypt_pcicc_modexpo_crt,
37802 };
37803diff -urNp linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcixcc.c linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcixcc.c
37804--- linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcixcc.c 2011-05-19 00:06:34.000000000 -0400
37805+++ linux-2.6.39.1/drivers/s390/crypto/zcrypt_pcixcc.c 2011-05-22 19:36:32.000000000 -0400
37806@@ -851,13 +851,13 @@ static long zcrypt_pcixcc_rng(struct zcr
37807 /**
37808 * The crypto operations for a PCIXCC/CEX2C card.
37809 */
37810-static struct zcrypt_ops zcrypt_pcixcc_ops = {
37811+static const struct zcrypt_ops zcrypt_pcixcc_ops = {
37812 .rsa_modexpo = zcrypt_pcixcc_modexpo,
37813 .rsa_modexpo_crt = zcrypt_pcixcc_modexpo_crt,
37814 .send_cprb = zcrypt_pcixcc_send_cprb,
37815 };
37816
37817-static struct zcrypt_ops zcrypt_pcixcc_with_rng_ops = {
37818+static const struct zcrypt_ops zcrypt_pcixcc_with_rng_ops = {
37819 .rsa_modexpo = zcrypt_pcixcc_modexpo,
37820 .rsa_modexpo_crt = zcrypt_pcixcc_modexpo_crt,
37821 .send_cprb = zcrypt_pcixcc_send_cprb,
37822diff -urNp linux-2.6.39.1/drivers/s390/kvm/kvm_virtio.c linux-2.6.39.1/drivers/s390/kvm/kvm_virtio.c
37823--- linux-2.6.39.1/drivers/s390/kvm/kvm_virtio.c 2011-05-19 00:06:34.000000000 -0400
37824+++ linux-2.6.39.1/drivers/s390/kvm/kvm_virtio.c 2011-05-22 19:36:32.000000000 -0400
37825@@ -266,7 +266,7 @@ error:
37826 /*
37827 * The config ops structure as defined by virtio config
37828 */
37829-static struct virtio_config_ops kvm_vq_configspace_ops = {
37830+static const struct virtio_config_ops kvm_vq_configspace_ops = {
37831 .get_features = kvm_get_features,
37832 .finalize_features = kvm_finalize_features,
37833 .get = kvm_get,
37834diff -urNp linux-2.6.39.1/drivers/s390/net/qeth_core.h linux-2.6.39.1/drivers/s390/net/qeth_core.h
37835--- linux-2.6.39.1/drivers/s390/net/qeth_core.h 2011-05-19 00:06:34.000000000 -0400
37836+++ linux-2.6.39.1/drivers/s390/net/qeth_core.h 2011-05-22 19:36:32.000000000 -0400
37837@@ -743,7 +743,7 @@ struct qeth_card {
37838 struct qeth_qdio_info qdio;
37839 struct qeth_perf_stats perf_stats;
37840 int read_or_write_problem;
37841- struct qeth_osn_info osn_info;
37842+ const struct qeth_osn_info osn_info;
37843 struct qeth_discipline discipline;
37844 atomic_t force_alloc_skb;
37845 struct service_level qeth_service_level;
37846diff -urNp linux-2.6.39.1/drivers/scsi/53c700.c linux-2.6.39.1/drivers/scsi/53c700.c
37847--- linux-2.6.39.1/drivers/scsi/53c700.c 2011-05-19 00:06:34.000000000 -0400
37848+++ linux-2.6.39.1/drivers/scsi/53c700.c 2011-05-22 19:36:32.000000000 -0400
37849@@ -2153,7 +2153,7 @@ EXPORT_SYMBOL(NCR_700_detect);
37850 EXPORT_SYMBOL(NCR_700_release);
37851 EXPORT_SYMBOL(NCR_700_intr);
37852
37853-static struct spi_function_template NCR_700_transport_functions = {
37854+static struct spi_function_template NCR_700_transport_functions = {
37855 .set_period = NCR_700_set_period,
37856 .show_period = 1,
37857 .set_offset = NCR_700_set_offset,
37858diff -urNp linux-2.6.39.1/drivers/scsi/aacraid/commctrl.c linux-2.6.39.1/drivers/scsi/aacraid/commctrl.c
37859--- linux-2.6.39.1/drivers/scsi/aacraid/commctrl.c 2011-05-19 00:06:34.000000000 -0400
37860+++ linux-2.6.39.1/drivers/scsi/aacraid/commctrl.c 2011-05-22 19:36:32.000000000 -0400
37861@@ -482,6 +482,7 @@ static int aac_send_raw_srb(struct aac_d
37862 u32 actual_fibsize64, actual_fibsize = 0;
37863 int i;
37864
37865+ pax_track_stack();
37866
37867 if (dev->in_reset) {
37868 dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
37869diff -urNp linux-2.6.39.1/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.39.1/drivers/scsi/aic94xx/aic94xx_init.c
37870--- linux-2.6.39.1/drivers/scsi/aic94xx/aic94xx_init.c 2011-05-19 00:06:34.000000000 -0400
37871+++ linux-2.6.39.1/drivers/scsi/aic94xx/aic94xx_init.c 2011-05-22 19:41:37.000000000 -0400
37872@@ -486,7 +486,7 @@ static ssize_t asd_show_update_bios(stru
37873 flash_error_table[i].reason);
37874 }
37875
37876-static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUGO,
37877+static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUSR,
37878 asd_show_update_bios, asd_store_update_bios);
37879
37880 static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
37881diff -urNp linux-2.6.39.1/drivers/scsi/bfa/bfa_core.c linux-2.6.39.1/drivers/scsi/bfa/bfa_core.c
37882--- linux-2.6.39.1/drivers/scsi/bfa/bfa_core.c 2011-05-19 00:06:34.000000000 -0400
37883+++ linux-2.6.39.1/drivers/scsi/bfa/bfa_core.c 2011-05-22 19:36:32.000000000 -0400
37884@@ -24,7 +24,7 @@ BFA_TRC_FILE(HAL, CORE);
37885 /*
37886 * BFA module list terminated by NULL
37887 */
37888-static struct bfa_module_s *hal_mods[] = {
37889+static const struct bfa_module_s *hal_mods[] = {
37890 &hal_mod_sgpg,
37891 &hal_mod_fcport,
37892 &hal_mod_fcxp,
37893diff -urNp linux-2.6.39.1/drivers/scsi/bfa/bfad.c linux-2.6.39.1/drivers/scsi/bfa/bfad.c
37894--- linux-2.6.39.1/drivers/scsi/bfa/bfad.c 2011-05-19 00:06:34.000000000 -0400
37895+++ linux-2.6.39.1/drivers/scsi/bfa/bfad.c 2011-05-22 19:36:32.000000000 -0400
37896@@ -1027,6 +1027,8 @@ bfad_start_ops(struct bfad_s *bfad) {
37897 struct bfad_vport_s *vport, *vport_new;
37898 struct bfa_fcs_driver_info_s driver_info;
37899
37900+ pax_track_stack();
37901+
37902 /* Fill the driver_info info to fcs*/
37903 memset(&driver_info, 0, sizeof(driver_info));
37904 strncpy(driver_info.version, BFAD_DRIVER_VERSION,
37905diff -urNp linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs.c linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs.c
37906--- linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs.c 2011-05-19 00:06:34.000000000 -0400
37907+++ linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs.c 2011-05-22 19:36:32.000000000 -0400
37908@@ -70,7 +70,7 @@ bfa_fcs_attach(struct bfa_fcs_s *fcs, st
37909 bfa_boolean_t min_cfg)
37910 {
37911 int i;
37912- struct bfa_fcs_mod_s *mod;
37913+ const struct bfa_fcs_mod_s *mod;
37914
37915 fcs->bfa = bfa;
37916 fcs->bfad = bfad;
37917@@ -93,7 +93,7 @@ void
37918 bfa_fcs_init(struct bfa_fcs_s *fcs)
37919 {
37920 int i, npbc_vports;
37921- struct bfa_fcs_mod_s *mod;
37922+ const struct bfa_fcs_mod_s *mod;
37923 struct bfi_pbc_vport_s pbc_vports[BFI_PBC_MAX_VPORTS];
37924
37925 for (i = 0; i < sizeof(fcs_modules) / sizeof(fcs_modules[0]); i++) {
37926@@ -140,7 +140,7 @@ bfa_fcs_driver_info_init(struct bfa_fcs_
37927 void
37928 bfa_fcs_exit(struct bfa_fcs_s *fcs)
37929 {
37930- struct bfa_fcs_mod_s *mod;
37931+ const struct bfa_fcs_mod_s *mod;
37932 int nmods, i;
37933
37934 bfa_wc_init(&fcs->wc, bfa_fcs_exit_comp, fcs);
37935diff -urNp linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs_lport.c linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs_lport.c
37936--- linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs_lport.c 2011-05-19 00:06:34.000000000 -0400
37937+++ linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs_lport.c 2011-05-22 19:36:32.000000000 -0400
37938@@ -1559,6 +1559,8 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
37939 u16 len, count;
37940 u16 templen;
37941
37942+ pax_track_stack();
37943+
37944 /*
37945 * get hba attributes
37946 */
37947@@ -1836,6 +1838,8 @@ bfa_fcs_lport_fdmi_build_portattr_block(
37948 u8 count = 0;
37949 u16 templen;
37950
37951+ pax_track_stack();
37952+
37953 /*
37954 * get port attributes
37955 */
37956diff -urNp linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs_rport.c linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs_rport.c
37957--- linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs_rport.c 2011-05-19 00:06:34.000000000 -0400
37958+++ linux-2.6.39.1/drivers/scsi/bfa/bfa_fcs_rport.c 2011-05-22 19:36:32.000000000 -0400
37959@@ -1844,6 +1844,8 @@ bfa_fcs_rport_process_rpsc(struct bfa_fc
37960 struct fc_rpsc_speed_info_s speeds;
37961 struct bfa_port_attr_s pport_attr;
37962
37963+ pax_track_stack();
37964+
37965 bfa_trc(port->fcs, rx_fchs->s_id);
37966 bfa_trc(port->fcs, rx_fchs->d_id);
37967
37968diff -urNp linux-2.6.39.1/drivers/scsi/bfa/bfa_modules.h linux-2.6.39.1/drivers/scsi/bfa/bfa_modules.h
37969--- linux-2.6.39.1/drivers/scsi/bfa/bfa_modules.h 2011-05-19 00:06:34.000000000 -0400
37970+++ linux-2.6.39.1/drivers/scsi/bfa/bfa_modules.h 2011-05-22 19:36:32.000000000 -0400
37971@@ -68,8 +68,8 @@ enum {
37972 static void bfa_ ## __mod ## _stop(struct bfa_s *bfa); \
37973 static void bfa_ ## __mod ## _iocdisable(struct bfa_s *bfa); \
37974 \
37975- extern struct bfa_module_s hal_mod_ ## __mod; \
37976- struct bfa_module_s hal_mod_ ## __mod = { \
37977+ extern const struct bfa_module_s hal_mod_ ## __mod; \
37978+ const struct bfa_module_s hal_mod_ ## __mod = { \
37979 bfa_ ## __mod ## _meminfo, \
37980 bfa_ ## __mod ## _attach, \
37981 bfa_ ## __mod ## _detach, \
37982@@ -116,12 +116,12 @@ struct bfa_s {
37983 };
37984
37985 extern bfa_boolean_t bfa_auto_recover;
37986-extern struct bfa_module_s hal_mod_sgpg;
37987-extern struct bfa_module_s hal_mod_fcport;
37988-extern struct bfa_module_s hal_mod_fcxp;
37989-extern struct bfa_module_s hal_mod_lps;
37990-extern struct bfa_module_s hal_mod_uf;
37991-extern struct bfa_module_s hal_mod_rport;
37992-extern struct bfa_module_s hal_mod_fcpim;
37993+extern const struct bfa_module_s hal_mod_sgpg;
37994+extern const struct bfa_module_s hal_mod_fcport;
37995+extern const struct bfa_module_s hal_mod_fcxp;
37996+extern const struct bfa_module_s hal_mod_lps;
37997+extern const struct bfa_module_s hal_mod_uf;
37998+extern const struct bfa_module_s hal_mod_rport;
37999+extern const struct bfa_module_s hal_mod_fcpim;
38000
38001 #endif /* __BFA_MODULES_H__ */
38002diff -urNp linux-2.6.39.1/drivers/scsi/BusLogic.c linux-2.6.39.1/drivers/scsi/BusLogic.c
38003--- linux-2.6.39.1/drivers/scsi/BusLogic.c 2011-05-19 00:06:34.000000000 -0400
38004+++ linux-2.6.39.1/drivers/scsi/BusLogic.c 2011-05-22 19:36:32.000000000 -0400
38005@@ -962,6 +962,8 @@ static int __init BusLogic_InitializeFla
38006 static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
38007 *PrototypeHostAdapter)
38008 {
38009+ pax_track_stack();
38010+
38011 /*
38012 If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
38013 Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
38014diff -urNp linux-2.6.39.1/drivers/scsi/dpt_i2o.c linux-2.6.39.1/drivers/scsi/dpt_i2o.c
38015--- linux-2.6.39.1/drivers/scsi/dpt_i2o.c 2011-05-19 00:06:34.000000000 -0400
38016+++ linux-2.6.39.1/drivers/scsi/dpt_i2o.c 2011-05-22 19:36:32.000000000 -0400
38017@@ -1811,6 +1811,8 @@ static int adpt_i2o_passthru(adpt_hba* p
38018 dma_addr_t addr;
38019 ulong flags = 0;
38020
38021+ pax_track_stack();
38022+
38023 memset(&msg, 0, MAX_MESSAGE_SIZE*4);
38024 // get user msg size in u32s
38025 if(get_user(size, &user_msg[0])){
38026@@ -2317,6 +2319,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pH
38027 s32 rcode;
38028 dma_addr_t addr;
38029
38030+ pax_track_stack();
38031+
38032 memset(msg, 0 , sizeof(msg));
38033 len = scsi_bufflen(cmd);
38034 direction = 0x00000000;
38035diff -urNp linux-2.6.39.1/drivers/scsi/eata.c linux-2.6.39.1/drivers/scsi/eata.c
38036--- linux-2.6.39.1/drivers/scsi/eata.c 2011-05-19 00:06:34.000000000 -0400
38037+++ linux-2.6.39.1/drivers/scsi/eata.c 2011-05-22 19:36:32.000000000 -0400
38038@@ -1087,6 +1087,8 @@ static int port_detect(unsigned long por
38039 struct hostdata *ha;
38040 char name[16];
38041
38042+ pax_track_stack();
38043+
38044 sprintf(name, "%s%d", driver_name, j);
38045
38046 if (!request_region(port_base, REGION_SIZE, driver_name)) {
38047diff -urNp linux-2.6.39.1/drivers/scsi/esp_scsi.c linux-2.6.39.1/drivers/scsi/esp_scsi.c
38048--- linux-2.6.39.1/drivers/scsi/esp_scsi.c 2011-05-19 00:06:34.000000000 -0400
38049+++ linux-2.6.39.1/drivers/scsi/esp_scsi.c 2011-05-22 19:36:32.000000000 -0400
38050@@ -2680,7 +2680,7 @@ static void esp_set_width(struct scsi_ta
38051 tp->flags |= ESP_TGT_CHECK_NEGO;
38052 }
38053
38054-static struct spi_function_template esp_transport_ops = {
38055+static const struct spi_function_template esp_transport_ops = {
38056 .set_offset = esp_set_offset,
38057 .show_offset = 1,
38058 .set_period = esp_set_period,
38059diff -urNp linux-2.6.39.1/drivers/scsi/fcoe/fcoe.c linux-2.6.39.1/drivers/scsi/fcoe/fcoe.c
38060--- linux-2.6.39.1/drivers/scsi/fcoe/fcoe.c 2011-05-19 00:06:34.000000000 -0400
38061+++ linux-2.6.39.1/drivers/scsi/fcoe/fcoe.c 2011-05-22 19:36:32.000000000 -0400
38062@@ -138,7 +138,7 @@ static int fcoe_vport_disable(struct fc_
38063 static void fcoe_set_vport_symbolic_name(struct fc_vport *);
38064 static void fcoe_set_port_id(struct fc_lport *, u32, struct fc_frame *);
38065
38066-static struct libfc_function_template fcoe_libfc_fcn_templ = {
38067+static const struct libfc_function_template fcoe_libfc_fcn_templ = {
38068 .frame_send = fcoe_xmit,
38069 .ddp_setup = fcoe_ddp_setup,
38070 .ddp_done = fcoe_ddp_done,
38071diff -urNp linux-2.6.39.1/drivers/scsi/fcoe/fcoe_ctlr.c linux-2.6.39.1/drivers/scsi/fcoe/fcoe_ctlr.c
38072--- linux-2.6.39.1/drivers/scsi/fcoe/fcoe_ctlr.c 2011-05-19 00:06:34.000000000 -0400
38073+++ linux-2.6.39.1/drivers/scsi/fcoe/fcoe_ctlr.c 2011-05-22 19:36:32.000000000 -0400
38074@@ -1912,7 +1912,7 @@ static void fcoe_ctlr_vn_rport_callback(
38075 mutex_unlock(&fip->ctlr_mutex);
38076 }
38077
38078-static struct fc_rport_operations fcoe_ctlr_vn_rport_ops = {
38079+static const struct fc_rport_operations fcoe_ctlr_vn_rport_ops = {
38080 .event_callback = fcoe_ctlr_vn_rport_callback,
38081 };
38082
38083@@ -2458,6 +2458,8 @@ static int fcoe_ctlr_vn_recv(struct fcoe
38084 } buf;
38085 int rc;
38086
38087+ pax_track_stack();
38088+
38089 fiph = (struct fip_header *)skb->data;
38090 sub = fiph->fip_subcode;
38091
38092diff -urNp linux-2.6.39.1/drivers/scsi/fnic/fnic_main.c linux-2.6.39.1/drivers/scsi/fnic/fnic_main.c
38093--- linux-2.6.39.1/drivers/scsi/fnic/fnic_main.c 2011-05-19 00:06:34.000000000 -0400
38094+++ linux-2.6.39.1/drivers/scsi/fnic/fnic_main.c 2011-05-22 19:36:32.000000000 -0400
38095@@ -69,7 +69,7 @@ module_param(fnic_log_level, int, S_IRUG
38096 MODULE_PARM_DESC(fnic_log_level, "bit mask of fnic logging levels");
38097
38098
38099-static struct libfc_function_template fnic_transport_template = {
38100+static const struct libfc_function_template fnic_transport_template = {
38101 .frame_send = fnic_send,
38102 .lport_set_port_id = fnic_set_port_id,
38103 .fcp_abort_io = fnic_empty_scsi_cleanup,
38104diff -urNp linux-2.6.39.1/drivers/scsi/gdth.c linux-2.6.39.1/drivers/scsi/gdth.c
38105--- linux-2.6.39.1/drivers/scsi/gdth.c 2011-05-19 00:06:34.000000000 -0400
38106+++ linux-2.6.39.1/drivers/scsi/gdth.c 2011-05-22 19:36:32.000000000 -0400
38107@@ -4107,6 +4107,8 @@ static int ioc_lockdrv(void __user *arg)
38108 unsigned long flags;
38109 gdth_ha_str *ha;
38110
38111+ pax_track_stack();
38112+
38113 if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
38114 return -EFAULT;
38115 ha = gdth_find_ha(ldrv.ionode);
38116@@ -4139,6 +4141,8 @@ static int ioc_resetdrv(void __user *arg
38117 gdth_ha_str *ha;
38118 int rval;
38119
38120+ pax_track_stack();
38121+
38122 if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
38123 res.number >= MAX_HDRIVES)
38124 return -EFAULT;
38125@@ -4174,6 +4178,8 @@ static int ioc_general(void __user *arg,
38126 gdth_ha_str *ha;
38127 int rval;
38128
38129+ pax_track_stack();
38130+
38131 if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
38132 return -EFAULT;
38133 ha = gdth_find_ha(gen.ionode);
38134@@ -4642,6 +4648,9 @@ static void gdth_flush(gdth_ha_str *ha)
38135 int i;
38136 gdth_cmd_str gdtcmd;
38137 char cmnd[MAX_COMMAND_SIZE];
38138+
38139+ pax_track_stack();
38140+
38141 memset(cmnd, 0xff, MAX_COMMAND_SIZE);
38142
38143 TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
38144diff -urNp linux-2.6.39.1/drivers/scsi/gdth_proc.c linux-2.6.39.1/drivers/scsi/gdth_proc.c
38145--- linux-2.6.39.1/drivers/scsi/gdth_proc.c 2011-05-19 00:06:34.000000000 -0400
38146+++ linux-2.6.39.1/drivers/scsi/gdth_proc.c 2011-05-22 19:36:32.000000000 -0400
38147@@ -47,6 +47,9 @@ static int gdth_set_asc_info(struct Scsi
38148 u64 paddr;
38149
38150 char cmnd[MAX_COMMAND_SIZE];
38151+
38152+ pax_track_stack();
38153+
38154 memset(cmnd, 0xff, 12);
38155 memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
38156
38157@@ -175,6 +178,8 @@ static int gdth_get_info(char *buffer,ch
38158 gdth_hget_str *phg;
38159 char cmnd[MAX_COMMAND_SIZE];
38160
38161+ pax_track_stack();
38162+
38163 gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
38164 estr = kmalloc(sizeof(*estr), GFP_KERNEL);
38165 if (!gdtcmd || !estr)
38166diff -urNp linux-2.6.39.1/drivers/scsi/hosts.c linux-2.6.39.1/drivers/scsi/hosts.c
38167--- linux-2.6.39.1/drivers/scsi/hosts.c 2011-05-19 00:06:34.000000000 -0400
38168+++ linux-2.6.39.1/drivers/scsi/hosts.c 2011-05-22 19:36:32.000000000 -0400
38169@@ -42,7 +42,7 @@
38170 #include "scsi_logging.h"
38171
38172
38173-static atomic_t scsi_host_next_hn; /* host_no for next new host */
38174+static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
38175
38176
38177 static void scsi_host_cls_release(struct device *dev)
38178@@ -354,7 +354,7 @@ struct Scsi_Host *scsi_host_alloc(struct
38179 * subtract one because we increment first then return, but we need to
38180 * know what the next host number was before increment
38181 */
38182- shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
38183+ shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
38184 shost->dma_channel = 0xff;
38185
38186 /* These three are default values which can be overridden */
38187diff -urNp linux-2.6.39.1/drivers/scsi/hpsa.h linux-2.6.39.1/drivers/scsi/hpsa.h
38188--- linux-2.6.39.1/drivers/scsi/hpsa.h 2011-05-19 00:06:34.000000000 -0400
38189+++ linux-2.6.39.1/drivers/scsi/hpsa.h 2011-05-22 19:36:32.000000000 -0400
38190@@ -347,7 +347,7 @@ static struct access_method SA5_access =
38191 SA5_completed,
38192 };
38193
38194-static struct access_method SA5_performant_access = {
38195+static const struct access_method SA5_performant_access = {
38196 SA5_submit_command,
38197 SA5_performant_intr_mask,
38198 SA5_fifo_full,
38199diff -urNp linux-2.6.39.1/drivers/scsi/hptiop.c linux-2.6.39.1/drivers/scsi/hptiop.c
38200--- linux-2.6.39.1/drivers/scsi/hptiop.c 2011-05-19 00:06:34.000000000 -0400
38201+++ linux-2.6.39.1/drivers/scsi/hptiop.c 2011-05-22 19:36:32.000000000 -0400
38202@@ -1226,7 +1226,7 @@ static void hptiop_remove(struct pci_dev
38203 scsi_host_put(host);
38204 }
38205
38206-static struct hptiop_adapter_ops hptiop_itl_ops = {
38207+static const struct hptiop_adapter_ops hptiop_itl_ops = {
38208 .iop_wait_ready = iop_wait_ready_itl,
38209 .internal_memalloc = NULL,
38210 .internal_memfree = NULL,
38211@@ -1241,7 +1241,7 @@ static struct hptiop_adapter_ops hptiop_
38212 .post_req = hptiop_post_req_itl,
38213 };
38214
38215-static struct hptiop_adapter_ops hptiop_mv_ops = {
38216+static const struct hptiop_adapter_ops hptiop_mv_ops = {
38217 .iop_wait_ready = iop_wait_ready_mv,
38218 .internal_memalloc = hptiop_internal_memalloc_mv,
38219 .internal_memfree = hptiop_internal_memfree_mv,
38220diff -urNp linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvfc.c linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvfc.c
38221--- linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvfc.c 2011-05-19 00:06:34.000000000 -0400
38222+++ linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvfc.c 2011-05-22 19:36:32.000000000 -0400
38223@@ -4881,7 +4881,7 @@ static struct vio_device_id ibmvfc_devic
38224 };
38225 MODULE_DEVICE_TABLE(vio, ibmvfc_device_table);
38226
38227-static struct dev_pm_ops ibmvfc_pm_ops = {
38228+static const struct dev_pm_ops ibmvfc_pm_ops = {
38229 .resume = ibmvfc_resume
38230 };
38231
38232diff -urNp linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvscsi.c linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvscsi.c
38233--- linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvscsi.c 2011-05-19 00:06:34.000000000 -0400
38234+++ linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvscsi.c 2011-05-22 19:36:32.000000000 -0400
38235@@ -104,7 +104,7 @@ static struct scsi_transport_template *i
38236
38237 #define IBMVSCSI_VERSION "1.5.9"
38238
38239-static struct ibmvscsi_ops *ibmvscsi_ops;
38240+static const struct ibmvscsi_ops *ibmvscsi_ops;
38241
38242 MODULE_DESCRIPTION("IBM Virtual SCSI");
38243 MODULE_AUTHOR("Dave Boutcher");
38244@@ -2059,7 +2059,7 @@ static struct vio_device_id ibmvscsi_dev
38245 };
38246 MODULE_DEVICE_TABLE(vio, ibmvscsi_device_table);
38247
38248-static struct dev_pm_ops ibmvscsi_pm_ops = {
38249+static const struct dev_pm_ops ibmvscsi_pm_ops = {
38250 .resume = ibmvscsi_resume
38251 };
38252
38253@@ -2075,7 +2075,7 @@ static struct vio_driver ibmvscsi_driver
38254 }
38255 };
38256
38257-static struct srp_function_template ibmvscsi_transport_functions = {
38258+static const struct srp_function_template ibmvscsi_transport_functions = {
38259 };
38260
38261 int __init ibmvscsi_module_init(void)
38262diff -urNp linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvscsi.h linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvscsi.h
38263--- linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvscsi.h 2011-05-19 00:06:34.000000000 -0400
38264+++ linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvscsi.h 2011-05-22 19:36:32.000000000 -0400
38265@@ -127,7 +127,7 @@ struct ibmvscsi_ops {
38266 int (*resume) (struct ibmvscsi_host_data *hostdata);
38267 };
38268
38269-extern struct ibmvscsi_ops iseriesvscsi_ops;
38270-extern struct ibmvscsi_ops rpavscsi_ops;
38271+extern const struct ibmvscsi_ops iseriesvscsi_ops;
38272+extern const struct ibmvscsi_ops rpavscsi_ops;
38273
38274 #endif /* IBMVSCSI_H */
38275diff -urNp linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvstgt.c linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvstgt.c
38276--- linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvstgt.c 2011-05-19 00:06:34.000000000 -0400
38277+++ linux-2.6.39.1/drivers/scsi/ibmvscsi/ibmvstgt.c 2011-05-22 19:36:32.000000000 -0400
38278@@ -951,7 +951,7 @@ static int get_system_info(void)
38279 return 0;
38280 }
38281
38282-static struct srp_function_template ibmvstgt_transport_functions = {
38283+static const struct srp_function_template ibmvstgt_transport_functions = {
38284 .tsk_mgmt_response = ibmvstgt_tsk_mgmt_response,
38285 .it_nexus_response = ibmvstgt_it_nexus_response,
38286 };
38287diff -urNp linux-2.6.39.1/drivers/scsi/ibmvscsi/iseries_vscsi.c linux-2.6.39.1/drivers/scsi/ibmvscsi/iseries_vscsi.c
38288--- linux-2.6.39.1/drivers/scsi/ibmvscsi/iseries_vscsi.c 2011-05-19 00:06:34.000000000 -0400
38289+++ linux-2.6.39.1/drivers/scsi/ibmvscsi/iseries_vscsi.c 2011-05-22 19:36:32.000000000 -0400
38290@@ -163,7 +163,7 @@ static int iseriesvscsi_resume(struct ib
38291 return 0;
38292 }
38293
38294-struct ibmvscsi_ops iseriesvscsi_ops = {
38295+const struct ibmvscsi_ops iseriesvscsi_ops = {
38296 .init_crq_queue = iseriesvscsi_init_crq_queue,
38297 .release_crq_queue = iseriesvscsi_release_crq_queue,
38298 .reset_crq_queue = iseriesvscsi_reset_crq_queue,
38299diff -urNp linux-2.6.39.1/drivers/scsi/ibmvscsi/rpa_vscsi.c linux-2.6.39.1/drivers/scsi/ibmvscsi/rpa_vscsi.c
38300--- linux-2.6.39.1/drivers/scsi/ibmvscsi/rpa_vscsi.c 2011-05-19 00:06:34.000000000 -0400
38301+++ linux-2.6.39.1/drivers/scsi/ibmvscsi/rpa_vscsi.c 2011-05-22 19:36:32.000000000 -0400
38302@@ -358,7 +358,7 @@ static int rpavscsi_resume(struct ibmvsc
38303 return 0;
38304 }
38305
38306-struct ibmvscsi_ops rpavscsi_ops = {
38307+const struct ibmvscsi_ops rpavscsi_ops = {
38308 .init_crq_queue = rpavscsi_init_crq_queue,
38309 .release_crq_queue = rpavscsi_release_crq_queue,
38310 .reset_crq_queue = rpavscsi_reset_crq_queue,
38311diff -urNp linux-2.6.39.1/drivers/scsi/ipr.c linux-2.6.39.1/drivers/scsi/ipr.c
38312--- linux-2.6.39.1/drivers/scsi/ipr.c 2011-05-19 00:06:34.000000000 -0400
38313+++ linux-2.6.39.1/drivers/scsi/ipr.c 2011-05-22 19:36:32.000000000 -0400
38314@@ -6210,7 +6210,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
38315 return true;
38316 }
38317
38318-static struct ata_port_operations ipr_sata_ops = {
38319+static const struct ata_port_operations ipr_sata_ops = {
38320 .phy_reset = ipr_ata_phy_reset,
38321 .hardreset = ipr_sata_reset,
38322 .post_internal_cmd = ipr_ata_post_internal,
38323diff -urNp linux-2.6.39.1/drivers/scsi/libfc/fc_exch.c linux-2.6.39.1/drivers/scsi/libfc/fc_exch.c
38324--- linux-2.6.39.1/drivers/scsi/libfc/fc_exch.c 2011-05-19 00:06:34.000000000 -0400
38325+++ linux-2.6.39.1/drivers/scsi/libfc/fc_exch.c 2011-05-22 19:36:32.000000000 -0400
38326@@ -105,12 +105,12 @@ struct fc_exch_mgr {
38327 * all together if not used XXX
38328 */
38329 struct {
38330- atomic_t no_free_exch;
38331- atomic_t no_free_exch_xid;
38332- atomic_t xid_not_found;
38333- atomic_t xid_busy;
38334- atomic_t seq_not_found;
38335- atomic_t non_bls_resp;
38336+ atomic_unchecked_t no_free_exch;
38337+ atomic_unchecked_t no_free_exch_xid;
38338+ atomic_unchecked_t xid_not_found;
38339+ atomic_unchecked_t xid_busy;
38340+ atomic_unchecked_t seq_not_found;
38341+ atomic_unchecked_t non_bls_resp;
38342 } stats;
38343 };
38344
38345@@ -700,7 +700,7 @@ static struct fc_exch *fc_exch_em_alloc(
38346 /* allocate memory for exchange */
38347 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
38348 if (!ep) {
38349- atomic_inc(&mp->stats.no_free_exch);
38350+ atomic_inc_unchecked(&mp->stats.no_free_exch);
38351 goto out;
38352 }
38353 memset(ep, 0, sizeof(*ep));
38354@@ -761,7 +761,7 @@ out:
38355 return ep;
38356 err:
38357 spin_unlock_bh(&pool->lock);
38358- atomic_inc(&mp->stats.no_free_exch_xid);
38359+ atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
38360 mempool_free(ep, mp->ep_pool);
38361 return NULL;
38362 }
38363@@ -906,7 +906,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38364 xid = ntohs(fh->fh_ox_id); /* we originated exch */
38365 ep = fc_exch_find(mp, xid);
38366 if (!ep) {
38367- atomic_inc(&mp->stats.xid_not_found);
38368+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38369 reject = FC_RJT_OX_ID;
38370 goto out;
38371 }
38372@@ -936,7 +936,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38373 ep = fc_exch_find(mp, xid);
38374 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
38375 if (ep) {
38376- atomic_inc(&mp->stats.xid_busy);
38377+ atomic_inc_unchecked(&mp->stats.xid_busy);
38378 reject = FC_RJT_RX_ID;
38379 goto rel;
38380 }
38381@@ -947,7 +947,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38382 }
38383 xid = ep->xid; /* get our XID */
38384 } else if (!ep) {
38385- atomic_inc(&mp->stats.xid_not_found);
38386+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38387 reject = FC_RJT_RX_ID; /* XID not found */
38388 goto out;
38389 }
38390@@ -964,7 +964,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38391 } else {
38392 sp = &ep->seq;
38393 if (sp->id != fh->fh_seq_id) {
38394- atomic_inc(&mp->stats.seq_not_found);
38395+ atomic_inc_unchecked(&mp->stats.seq_not_found);
38396 reject = FC_RJT_SEQ_ID; /* sequence/exch should exist */
38397 goto rel;
38398 }
38399@@ -1392,22 +1392,22 @@ static void fc_exch_recv_seq_resp(struct
38400
38401 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
38402 if (!ep) {
38403- atomic_inc(&mp->stats.xid_not_found);
38404+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38405 goto out;
38406 }
38407 if (ep->esb_stat & ESB_ST_COMPLETE) {
38408- atomic_inc(&mp->stats.xid_not_found);
38409+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38410 goto rel;
38411 }
38412 if (ep->rxid == FC_XID_UNKNOWN)
38413 ep->rxid = ntohs(fh->fh_rx_id);
38414 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
38415- atomic_inc(&mp->stats.xid_not_found);
38416+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38417 goto rel;
38418 }
38419 if (ep->did != ntoh24(fh->fh_s_id) &&
38420 ep->did != FC_FID_FLOGI) {
38421- atomic_inc(&mp->stats.xid_not_found);
38422+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38423 goto rel;
38424 }
38425 sof = fr_sof(fp);
38426@@ -1416,7 +1416,7 @@ static void fc_exch_recv_seq_resp(struct
38427 sp->ssb_stat |= SSB_ST_RESP;
38428 sp->id = fh->fh_seq_id;
38429 } else if (sp->id != fh->fh_seq_id) {
38430- atomic_inc(&mp->stats.seq_not_found);
38431+ atomic_inc_unchecked(&mp->stats.seq_not_found);
38432 goto rel;
38433 }
38434
38435@@ -1479,9 +1479,9 @@ static void fc_exch_recv_resp(struct fc_
38436 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
38437
38438 if (!sp)
38439- atomic_inc(&mp->stats.xid_not_found);
38440+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38441 else
38442- atomic_inc(&mp->stats.non_bls_resp);
38443+ atomic_inc_unchecked(&mp->stats.non_bls_resp);
38444
38445 fc_frame_free(fp);
38446 }
38447diff -urNp linux-2.6.39.1/drivers/scsi/libfc/fc_lport.c linux-2.6.39.1/drivers/scsi/libfc/fc_lport.c
38448--- linux-2.6.39.1/drivers/scsi/libfc/fc_lport.c 2011-05-19 00:06:34.000000000 -0400
38449+++ linux-2.6.39.1/drivers/scsi/libfc/fc_lport.c 2011-05-22 19:36:32.000000000 -0400
38450@@ -1299,7 +1299,7 @@ static void fc_lport_enter_ns(struct fc_
38451 fc_lport_error(lport, fp);
38452 }
38453
38454-static struct fc_rport_operations fc_lport_rport_ops = {
38455+static const struct fc_rport_operations fc_lport_rport_ops = {
38456 .event_callback = fc_lport_rport_callback,
38457 };
38458
38459diff -urNp linux-2.6.39.1/drivers/scsi/libfc/fc_rport.c linux-2.6.39.1/drivers/scsi/libfc/fc_rport.c
38460--- linux-2.6.39.1/drivers/scsi/libfc/fc_rport.c 2011-05-19 00:06:34.000000000 -0400
38461+++ linux-2.6.39.1/drivers/scsi/libfc/fc_rport.c 2011-05-22 19:36:32.000000000 -0400
38462@@ -256,7 +256,7 @@ static void fc_rport_work(struct work_st
38463 struct fc_rport_libfc_priv *rpriv;
38464 enum fc_rport_event event;
38465 struct fc_lport *lport = rdata->local_port;
38466- struct fc_rport_operations *rport_ops;
38467+ const struct fc_rport_operations *rport_ops;
38468 struct fc_rport_identifiers ids;
38469 struct fc_rport *rport;
38470 struct fc4_prov *prov;
38471diff -urNp linux-2.6.39.1/drivers/scsi/libsas/sas_ata.c linux-2.6.39.1/drivers/scsi/libsas/sas_ata.c
38472--- linux-2.6.39.1/drivers/scsi/libsas/sas_ata.c 2011-05-19 00:06:34.000000000 -0400
38473+++ linux-2.6.39.1/drivers/scsi/libsas/sas_ata.c 2011-05-22 19:36:32.000000000 -0400
38474@@ -307,14 +307,14 @@ static void sas_ata_post_internal(struct
38475 }
38476 }
38477
38478-static struct ata_port_operations sas_sata_ops = {
38479+static const struct ata_port_operations sas_sata_ops = {
38480 .prereset = ata_std_prereset,
38481 .softreset = NULL,
38482 .hardreset = sas_ata_hard_reset,
38483 .postreset = ata_std_postreset,
38484 .error_handler = ata_std_error_handler,
38485 .post_internal_cmd = sas_ata_post_internal,
38486- .qc_defer = ata_std_qc_defer,
38487+ .qc_defer = ata_std_qc_defer,
38488 .qc_prep = ata_noop_qc_prep,
38489 .qc_issue = sas_ata_qc_issue,
38490 .qc_fill_rtf = sas_ata_qc_fill_rtf,
38491diff -urNp linux-2.6.39.1/drivers/scsi/lpfc/lpfc_debugfs.c linux-2.6.39.1/drivers/scsi/lpfc/lpfc_debugfs.c
38492--- linux-2.6.39.1/drivers/scsi/lpfc/lpfc_debugfs.c 2011-05-19 00:06:34.000000000 -0400
38493+++ linux-2.6.39.1/drivers/scsi/lpfc/lpfc_debugfs.c 2011-05-22 19:36:32.000000000 -0400
38494@@ -104,7 +104,7 @@ MODULE_PARM_DESC(lpfc_debugfs_mask_disc_
38495
38496 #include <linux/debugfs.h>
38497
38498-static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
38499+static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
38500 static unsigned long lpfc_debugfs_start_time = 0L;
38501
38502 /* iDiag */
38503@@ -141,7 +141,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_v
38504 lpfc_debugfs_enable = 0;
38505
38506 len = 0;
38507- index = (atomic_read(&vport->disc_trc_cnt) + 1) &
38508+ index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
38509 (lpfc_debugfs_max_disc_trc - 1);
38510 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
38511 dtp = vport->disc_trc + i;
38512@@ -202,7 +202,7 @@ lpfc_debugfs_slow_ring_trc_data(struct l
38513 lpfc_debugfs_enable = 0;
38514
38515 len = 0;
38516- index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
38517+ index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
38518 (lpfc_debugfs_max_slow_ring_trc - 1);
38519 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
38520 dtp = phba->slow_ring_trc + i;
38521@@ -380,6 +380,8 @@ lpfc_debugfs_dumpHBASlim_data(struct lpf
38522 uint32_t *ptr;
38523 char buffer[1024];
38524
38525+ pax_track_stack();
38526+
38527 off = 0;
38528 spin_lock_irq(&phba->hbalock);
38529
38530@@ -617,14 +619,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport
38531 !vport || !vport->disc_trc)
38532 return;
38533
38534- index = atomic_inc_return(&vport->disc_trc_cnt) &
38535+ index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
38536 (lpfc_debugfs_max_disc_trc - 1);
38537 dtp = vport->disc_trc + index;
38538 dtp->fmt = fmt;
38539 dtp->data1 = data1;
38540 dtp->data2 = data2;
38541 dtp->data3 = data3;
38542- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
38543+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
38544 dtp->jif = jiffies;
38545 #endif
38546 return;
38547@@ -655,14 +657,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_h
38548 !phba || !phba->slow_ring_trc)
38549 return;
38550
38551- index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
38552+ index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
38553 (lpfc_debugfs_max_slow_ring_trc - 1);
38554 dtp = phba->slow_ring_trc + index;
38555 dtp->fmt = fmt;
38556 dtp->data1 = data1;
38557 dtp->data2 = data2;
38558 dtp->data3 = data3;
38559- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
38560+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
38561 dtp->jif = jiffies;
38562 #endif
38563 return;
38564@@ -2145,7 +2147,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
38565 "slow_ring buffer\n");
38566 goto debug_failed;
38567 }
38568- atomic_set(&phba->slow_ring_trc_cnt, 0);
38569+ atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
38570 memset(phba->slow_ring_trc, 0,
38571 (sizeof(struct lpfc_debugfs_trc) *
38572 lpfc_debugfs_max_slow_ring_trc));
38573@@ -2191,7 +2193,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
38574 "buffer\n");
38575 goto debug_failed;
38576 }
38577- atomic_set(&vport->disc_trc_cnt, 0);
38578+ atomic_set_unchecked(&vport->disc_trc_cnt, 0);
38579
38580 snprintf(name, sizeof(name), "discovery_trace");
38581 vport->debug_disc_trc =
38582diff -urNp linux-2.6.39.1/drivers/scsi/lpfc/lpfc.h linux-2.6.39.1/drivers/scsi/lpfc/lpfc.h
38583--- linux-2.6.39.1/drivers/scsi/lpfc/lpfc.h 2011-05-19 00:06:34.000000000 -0400
38584+++ linux-2.6.39.1/drivers/scsi/lpfc/lpfc.h 2011-05-22 19:36:32.000000000 -0400
38585@@ -419,7 +419,7 @@ struct lpfc_vport {
38586 struct dentry *debug_nodelist;
38587 struct dentry *vport_debugfs_root;
38588 struct lpfc_debugfs_trc *disc_trc;
38589- atomic_t disc_trc_cnt;
38590+ atomic_unchecked_t disc_trc_cnt;
38591 #endif
38592 uint8_t stat_data_enabled;
38593 uint8_t stat_data_blocked;
38594@@ -785,8 +785,8 @@ struct lpfc_hba {
38595 struct timer_list fabric_block_timer;
38596 unsigned long bit_flags;
38597 #define FABRIC_COMANDS_BLOCKED 0
38598- atomic_t num_rsrc_err;
38599- atomic_t num_cmd_success;
38600+ atomic_unchecked_t num_rsrc_err;
38601+ atomic_unchecked_t num_cmd_success;
38602 unsigned long last_rsrc_error_time;
38603 unsigned long last_ramp_down_time;
38604 unsigned long last_ramp_up_time;
38605@@ -800,7 +800,7 @@ struct lpfc_hba {
38606 struct dentry *debug_dumpDif; /* BlockGuard BPL*/
38607 struct dentry *debug_slow_ring_trc;
38608 struct lpfc_debugfs_trc *slow_ring_trc;
38609- atomic_t slow_ring_trc_cnt;
38610+ atomic_unchecked_t slow_ring_trc_cnt;
38611 /* iDiag debugfs sub-directory */
38612 struct dentry *idiag_root;
38613 struct dentry *idiag_pci_cfg;
38614diff -urNp linux-2.6.39.1/drivers/scsi/lpfc/lpfc_scsi.c linux-2.6.39.1/drivers/scsi/lpfc/lpfc_scsi.c
38615--- linux-2.6.39.1/drivers/scsi/lpfc/lpfc_scsi.c 2011-05-19 00:06:34.000000000 -0400
38616+++ linux-2.6.39.1/drivers/scsi/lpfc/lpfc_scsi.c 2011-05-22 19:36:32.000000000 -0400
38617@@ -297,7 +297,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hb
38618 uint32_t evt_posted;
38619
38620 spin_lock_irqsave(&phba->hbalock, flags);
38621- atomic_inc(&phba->num_rsrc_err);
38622+ atomic_inc_unchecked(&phba->num_rsrc_err);
38623 phba->last_rsrc_error_time = jiffies;
38624
38625 if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
38626@@ -338,7 +338,7 @@ lpfc_rampup_queue_depth(struct lpfc_vpor
38627 unsigned long flags;
38628 struct lpfc_hba *phba = vport->phba;
38629 uint32_t evt_posted;
38630- atomic_inc(&phba->num_cmd_success);
38631+ atomic_inc_unchecked(&phba->num_cmd_success);
38632
38633 if (vport->cfg_lun_queue_depth <= queue_depth)
38634 return;
38635@@ -382,8 +382,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
38636 unsigned long num_rsrc_err, num_cmd_success;
38637 int i;
38638
38639- num_rsrc_err = atomic_read(&phba->num_rsrc_err);
38640- num_cmd_success = atomic_read(&phba->num_cmd_success);
38641+ num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
38642+ num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
38643
38644 vports = lpfc_create_vport_work_array(phba);
38645 if (vports != NULL)
38646@@ -403,8 +403,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
38647 }
38648 }
38649 lpfc_destroy_vport_work_array(phba, vports);
38650- atomic_set(&phba->num_rsrc_err, 0);
38651- atomic_set(&phba->num_cmd_success, 0);
38652+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
38653+ atomic_set_unchecked(&phba->num_cmd_success, 0);
38654 }
38655
38656 /**
38657@@ -438,8 +438,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_h
38658 }
38659 }
38660 lpfc_destroy_vport_work_array(phba, vports);
38661- atomic_set(&phba->num_rsrc_err, 0);
38662- atomic_set(&phba->num_cmd_success, 0);
38663+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
38664+ atomic_set_unchecked(&phba->num_cmd_success, 0);
38665 }
38666
38667 /**
38668diff -urNp linux-2.6.39.1/drivers/scsi/mac_esp.c linux-2.6.39.1/drivers/scsi/mac_esp.c
38669--- linux-2.6.39.1/drivers/scsi/mac_esp.c 2011-05-19 00:06:34.000000000 -0400
38670+++ linux-2.6.39.1/drivers/scsi/mac_esp.c 2011-05-22 19:36:32.000000000 -0400
38671@@ -473,7 +473,7 @@ static irqreturn_t mac_scsi_esp_intr(int
38672 return IRQ_HANDLED;
38673 }
38674
38675-static struct esp_driver_ops mac_esp_ops = {
38676+static const struct esp_driver_ops mac_esp_ops = {
38677 .esp_write8 = mac_esp_write8,
38678 .esp_read8 = mac_esp_read8,
38679 .map_single = mac_esp_map_single,
38680diff -urNp linux-2.6.39.1/drivers/scsi/megaraid/megaraid_mbox.c linux-2.6.39.1/drivers/scsi/megaraid/megaraid_mbox.c
38681--- linux-2.6.39.1/drivers/scsi/megaraid/megaraid_mbox.c 2011-05-19 00:06:34.000000000 -0400
38682+++ linux-2.6.39.1/drivers/scsi/megaraid/megaraid_mbox.c 2011-05-22 19:36:32.000000000 -0400
38683@@ -3510,6 +3510,8 @@ megaraid_cmm_register(adapter_t *adapter
38684 int rval;
38685 int i;
38686
38687+ pax_track_stack();
38688+
38689 // Allocate memory for the base list of scb for management module.
38690 adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
38691
38692diff -urNp linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas_base.c linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas_base.c
38693--- linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas_base.c 2011-05-19 00:06:34.000000000 -0400
38694+++ linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas_base.c 2011-05-22 19:36:32.000000000 -0400
38695@@ -366,7 +366,7 @@ megasas_check_reset_xscale(struct megasa
38696 return 0;
38697 }
38698
38699-static struct megasas_instance_template megasas_instance_template_xscale = {
38700+static const struct megasas_instance_template megasas_instance_template_xscale = {
38701
38702 .fire_cmd = megasas_fire_cmd_xscale,
38703 .enable_intr = megasas_enable_intr_xscale,
38704@@ -497,7 +497,7 @@ megasas_check_reset_ppc(struct megasas_i
38705 {
38706 return 0;
38707 }
38708-static struct megasas_instance_template megasas_instance_template_ppc = {
38709+static const struct megasas_instance_template megasas_instance_template_ppc = {
38710
38711 .fire_cmd = megasas_fire_cmd_ppc,
38712 .enable_intr = megasas_enable_intr_ppc,
38713@@ -623,7 +623,7 @@ megasas_check_reset_skinny(struct megasa
38714 return 0;
38715 }
38716
38717-static struct megasas_instance_template megasas_instance_template_skinny = {
38718+static const struct megasas_instance_template megasas_instance_template_skinny = {
38719
38720 .fire_cmd = megasas_fire_cmd_skinny,
38721 .enable_intr = megasas_enable_intr_skinny,
38722@@ -810,7 +810,7 @@ megasas_check_reset_gen2(struct megasas_
38723 return 0;
38724 }
38725
38726-static struct megasas_instance_template megasas_instance_template_gen2 = {
38727+static const struct megasas_instance_template megasas_instance_template_gen2 = {
38728
38729 .fire_cmd = megasas_fire_cmd_gen2,
38730 .enable_intr = megasas_enable_intr_gen2,
38731@@ -834,7 +834,7 @@ static struct megasas_instance_template
38732 /*
38733 * Template added for TB (Fusion)
38734 */
38735-extern struct megasas_instance_template megasas_instance_template_fusion;
38736+extern const struct megasas_instance_template megasas_instance_template_fusion;
38737
38738 /**
38739 * megasas_issue_polled - Issues a polling command
38740diff -urNp linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas_fusion.c linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas_fusion.c
38741--- linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas_fusion.c 2011-05-19 00:06:34.000000000 -0400
38742+++ linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas_fusion.c 2011-05-22 19:36:32.000000000 -0400
38743@@ -2236,7 +2236,7 @@ void megasas_fusion_ocr_wq(struct work_s
38744 megasas_reset_fusion(instance->host);
38745 }
38746
38747-struct megasas_instance_template megasas_instance_template_fusion = {
38748+const struct megasas_instance_template megasas_instance_template_fusion = {
38749 .fire_cmd = megasas_fire_cmd_fusion,
38750 .enable_intr = megasas_enable_intr_fusion,
38751 .disable_intr = megasas_disable_intr_fusion,
38752diff -urNp linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas.h linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas.h
38753--- linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas.h 2011-05-19 00:06:34.000000000 -0400
38754+++ linux-2.6.39.1/drivers/scsi/megaraid/megaraid_sas.h 2011-05-22 19:36:32.000000000 -0400
38755@@ -1330,7 +1330,7 @@ struct megasas_instance {
38756 atomic_t fw_outstanding;
38757 atomic_t fw_reset_no_pci_access;
38758
38759- struct megasas_instance_template *instancet;
38760+ const struct megasas_instance_template *instancet;
38761 struct tasklet_struct isr_tasklet;
38762 struct work_struct work_init;
38763
38764diff -urNp linux-2.6.39.1/drivers/scsi/ncr53c8xx.c linux-2.6.39.1/drivers/scsi/ncr53c8xx.c
38765--- linux-2.6.39.1/drivers/scsi/ncr53c8xx.c 2011-05-19 00:06:34.000000000 -0400
38766+++ linux-2.6.39.1/drivers/scsi/ncr53c8xx.c 2011-05-22 19:36:32.000000000 -0400
38767@@ -8606,7 +8606,7 @@ static void ncr53c8xx_get_signalling(str
38768 spi_signalling(shost) = type;
38769 }
38770
38771-static struct spi_function_template ncr53c8xx_transport_functions = {
38772+static struct spi_function_template ncr53c8xx_transport_functions = {
38773 .set_period = ncr53c8xx_set_period,
38774 .show_period = 1,
38775 .set_offset = ncr53c8xx_set_offset,
38776diff -urNp linux-2.6.39.1/drivers/scsi/osd/osd_initiator.c linux-2.6.39.1/drivers/scsi/osd/osd_initiator.c
38777--- linux-2.6.39.1/drivers/scsi/osd/osd_initiator.c 2011-05-19 00:06:34.000000000 -0400
38778+++ linux-2.6.39.1/drivers/scsi/osd/osd_initiator.c 2011-05-22 19:36:32.000000000 -0400
38779@@ -97,6 +97,8 @@ static int _osd_get_print_system_info(st
38780 int nelem = ARRAY_SIZE(get_attrs), a = 0;
38781 int ret;
38782
38783+ pax_track_stack();
38784+
38785 or = osd_start_request(od, GFP_KERNEL);
38786 if (!or)
38787 return -ENOMEM;
38788diff -urNp linux-2.6.39.1/drivers/scsi/pmcraid.c linux-2.6.39.1/drivers/scsi/pmcraid.c
38789--- linux-2.6.39.1/drivers/scsi/pmcraid.c 2011-05-19 00:06:34.000000000 -0400
38790+++ linux-2.6.39.1/drivers/scsi/pmcraid.c 2011-05-22 19:36:32.000000000 -0400
38791@@ -201,8 +201,8 @@ static int pmcraid_slave_alloc(struct sc
38792 res->scsi_dev = scsi_dev;
38793 scsi_dev->hostdata = res;
38794 res->change_detected = 0;
38795- atomic_set(&res->read_failures, 0);
38796- atomic_set(&res->write_failures, 0);
38797+ atomic_set_unchecked(&res->read_failures, 0);
38798+ atomic_set_unchecked(&res->write_failures, 0);
38799 rc = 0;
38800 }
38801 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
38802@@ -2677,9 +2677,9 @@ static int pmcraid_error_handler(struct
38803
38804 /* If this was a SCSI read/write command keep count of errors */
38805 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
38806- atomic_inc(&res->read_failures);
38807+ atomic_inc_unchecked(&res->read_failures);
38808 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
38809- atomic_inc(&res->write_failures);
38810+ atomic_inc_unchecked(&res->write_failures);
38811
38812 if (!RES_IS_GSCSI(res->cfg_entry) &&
38813 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
38814@@ -3535,7 +3535,7 @@ static int pmcraid_queuecommand_lck(
38815 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
38816 * hrrq_id assigned here in queuecommand
38817 */
38818- ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
38819+ ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
38820 pinstance->num_hrrq;
38821 cmd->cmd_done = pmcraid_io_done;
38822
38823@@ -3860,7 +3860,7 @@ static long pmcraid_ioctl_passthrough(
38824 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
38825 * hrrq_id assigned here in queuecommand
38826 */
38827- ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
38828+ ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
38829 pinstance->num_hrrq;
38830
38831 if (request_size) {
38832@@ -4495,7 +4495,7 @@ static void pmcraid_worker_function(stru
38833
38834 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
38835 /* add resources only after host is added into system */
38836- if (!atomic_read(&pinstance->expose_resources))
38837+ if (!atomic_read_unchecked(&pinstance->expose_resources))
38838 return;
38839
38840 fw_version = be16_to_cpu(pinstance->inq_data->fw_version);
38841@@ -5329,8 +5329,8 @@ static int __devinit pmcraid_init_instan
38842 init_waitqueue_head(&pinstance->reset_wait_q);
38843
38844 atomic_set(&pinstance->outstanding_cmds, 0);
38845- atomic_set(&pinstance->last_message_id, 0);
38846- atomic_set(&pinstance->expose_resources, 0);
38847+ atomic_set_unchecked(&pinstance->last_message_id, 0);
38848+ atomic_set_unchecked(&pinstance->expose_resources, 0);
38849
38850 INIT_LIST_HEAD(&pinstance->free_res_q);
38851 INIT_LIST_HEAD(&pinstance->used_res_q);
38852@@ -6045,7 +6045,7 @@ static int __devinit pmcraid_probe(
38853 /* Schedule worker thread to handle CCN and take care of adding and
38854 * removing devices to OS
38855 */
38856- atomic_set(&pinstance->expose_resources, 1);
38857+ atomic_set_unchecked(&pinstance->expose_resources, 1);
38858 schedule_work(&pinstance->worker_q);
38859 return rc;
38860
38861diff -urNp linux-2.6.39.1/drivers/scsi/pmcraid.h linux-2.6.39.1/drivers/scsi/pmcraid.h
38862--- linux-2.6.39.1/drivers/scsi/pmcraid.h 2011-05-19 00:06:34.000000000 -0400
38863+++ linux-2.6.39.1/drivers/scsi/pmcraid.h 2011-05-22 19:36:32.000000000 -0400
38864@@ -750,7 +750,7 @@ struct pmcraid_instance {
38865 struct pmcraid_isr_param hrrq_vector[PMCRAID_NUM_MSIX_VECTORS];
38866
38867 /* Message id as filled in last fired IOARCB, used to identify HRRQ */
38868- atomic_t last_message_id;
38869+ atomic_unchecked_t last_message_id;
38870
38871 /* configuration table */
38872 struct pmcraid_config_table *cfg_table;
38873@@ -779,7 +779,7 @@ struct pmcraid_instance {
38874 atomic_t outstanding_cmds;
38875
38876 /* should add/delete resources to mid-layer now ?*/
38877- atomic_t expose_resources;
38878+ atomic_unchecked_t expose_resources;
38879
38880
38881
38882@@ -815,8 +815,8 @@ struct pmcraid_resource_entry {
38883 struct pmcraid_config_table_entry_ext cfg_entry_ext;
38884 };
38885 struct scsi_device *scsi_dev; /* Link scsi_device structure */
38886- atomic_t read_failures; /* count of failed READ commands */
38887- atomic_t write_failures; /* count of failed WRITE commands */
38888+ atomic_unchecked_t read_failures; /* count of failed READ commands */
38889+ atomic_unchecked_t write_failures; /* count of failed WRITE commands */
38890
38891 /* To indicate add/delete/modify during CCN */
38892 u8 change_detected;
38893diff -urNp linux-2.6.39.1/drivers/scsi/qla2xxx/qla_os.c linux-2.6.39.1/drivers/scsi/qla2xxx/qla_os.c
38894--- linux-2.6.39.1/drivers/scsi/qla2xxx/qla_os.c 2011-06-03 00:04:14.000000000 -0400
38895+++ linux-2.6.39.1/drivers/scsi/qla2xxx/qla_os.c 2011-06-03 00:32:06.000000000 -0400
38896@@ -4103,7 +4103,7 @@ static struct pci_driver qla2xxx_pci_dri
38897 .err_handler = &qla2xxx_err_handler,
38898 };
38899
38900-static struct file_operations apidev_fops = {
38901+static const struct file_operations apidev_fops = {
38902 .owner = THIS_MODULE,
38903 .llseek = noop_llseek,
38904 };
38905diff -urNp linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_def.h linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_def.h
38906--- linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_def.h 2011-05-19 00:06:34.000000000 -0400
38907+++ linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_def.h 2011-05-22 19:36:32.000000000 -0400
38908@@ -256,7 +256,7 @@ struct ddb_entry {
38909 atomic_t retry_relogin_timer; /* Min Time between relogins
38910 * (4000 only) */
38911 atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
38912- atomic_t relogin_retry_count; /* Num of times relogin has been
38913+ atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
38914 * retried */
38915
38916 uint16_t port;
38917diff -urNp linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_init.c linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_init.c
38918--- linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_init.c 2011-05-19 00:06:34.000000000 -0400
38919+++ linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_init.c 2011-05-22 19:36:32.000000000 -0400
38920@@ -680,7 +680,7 @@ static struct ddb_entry * qla4xxx_alloc_
38921 ddb_entry->fw_ddb_index = fw_ddb_index;
38922 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
38923 atomic_set(&ddb_entry->relogin_timer, 0);
38924- atomic_set(&ddb_entry->relogin_retry_count, 0);
38925+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
38926 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
38927 list_add_tail(&ddb_entry->list, &ha->ddb_list);
38928 ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
38929@@ -1433,7 +1433,7 @@ int qla4xxx_process_ddb_changed(struct s
38930 if ((ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE) &&
38931 (atomic_read(&ddb_entry->state) != DDB_STATE_ONLINE)) {
38932 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
38933- atomic_set(&ddb_entry->relogin_retry_count, 0);
38934+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
38935 atomic_set(&ddb_entry->relogin_timer, 0);
38936 clear_bit(DF_RELOGIN, &ddb_entry->flags);
38937 iscsi_unblock_session(ddb_entry->sess);
38938diff -urNp linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_os.c linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_os.c
38939--- linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_os.c 2011-05-19 00:06:34.000000000 -0400
38940+++ linux-2.6.39.1/drivers/scsi/qla4xxx/ql4_os.c 2011-05-22 19:36:32.000000000 -0400
38941@@ -802,13 +802,13 @@ static void qla4xxx_timer(struct scsi_ql
38942 ddb_entry->fw_ddb_device_state ==
38943 DDB_DS_SESSION_FAILED) {
38944 /* Reset retry relogin timer */
38945- atomic_inc(&ddb_entry->relogin_retry_count);
38946+ atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
38947 DEBUG2(printk("scsi%ld: ddb [%d] relogin"
38948 " timed out-retrying"
38949 " relogin (%d)\n",
38950 ha->host_no,
38951 ddb_entry->fw_ddb_index,
38952- atomic_read(&ddb_entry->
38953+ atomic_read_unchecked(&ddb_entry->
38954 relogin_retry_count))
38955 );
38956 start_dpc++;
38957diff -urNp linux-2.6.39.1/drivers/scsi/scsi.c linux-2.6.39.1/drivers/scsi/scsi.c
38958--- linux-2.6.39.1/drivers/scsi/scsi.c 2011-05-19 00:06:34.000000000 -0400
38959+++ linux-2.6.39.1/drivers/scsi/scsi.c 2011-05-22 19:36:32.000000000 -0400
38960@@ -655,7 +655,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *
38961 unsigned long timeout;
38962 int rtn = 0;
38963
38964- atomic_inc(&cmd->device->iorequest_cnt);
38965+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
38966
38967 /* check if the device is still usable */
38968 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
38969diff -urNp linux-2.6.39.1/drivers/scsi/scsi_debug.c linux-2.6.39.1/drivers/scsi/scsi_debug.c
38970--- linux-2.6.39.1/drivers/scsi/scsi_debug.c 2011-05-19 00:06:34.000000000 -0400
38971+++ linux-2.6.39.1/drivers/scsi/scsi_debug.c 2011-05-22 19:36:32.000000000 -0400
38972@@ -1493,6 +1493,8 @@ static int resp_mode_select(struct scsi_
38973 unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
38974 unsigned char *cmd = (unsigned char *)scp->cmnd;
38975
38976+ pax_track_stack();
38977+
38978 if ((errsts = check_readiness(scp, 1, devip)))
38979 return errsts;
38980 memset(arr, 0, sizeof(arr));
38981@@ -1590,6 +1592,8 @@ static int resp_log_sense(struct scsi_cm
38982 unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
38983 unsigned char *cmd = (unsigned char *)scp->cmnd;
38984
38985+ pax_track_stack();
38986+
38987 if ((errsts = check_readiness(scp, 1, devip)))
38988 return errsts;
38989 memset(arr, 0, sizeof(arr));
38990diff -urNp linux-2.6.39.1/drivers/scsi/scsi_lib.c linux-2.6.39.1/drivers/scsi/scsi_lib.c
38991--- linux-2.6.39.1/drivers/scsi/scsi_lib.c 2011-05-19 00:06:34.000000000 -0400
38992+++ linux-2.6.39.1/drivers/scsi/scsi_lib.c 2011-05-22 19:36:32.000000000 -0400
38993@@ -1410,7 +1410,7 @@ static void scsi_kill_request(struct req
38994 shost = sdev->host;
38995 scsi_init_cmd_errh(cmd);
38996 cmd->result = DID_NO_CONNECT << 16;
38997- atomic_inc(&cmd->device->iorequest_cnt);
38998+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
38999
39000 /*
39001 * SCSI request completion path will do scsi_device_unbusy(),
39002@@ -1436,9 +1436,9 @@ static void scsi_softirq_done(struct req
39003
39004 INIT_LIST_HEAD(&cmd->eh_entry);
39005
39006- atomic_inc(&cmd->device->iodone_cnt);
39007+ atomic_inc_unchecked(&cmd->device->iodone_cnt);
39008 if (cmd->result)
39009- atomic_inc(&cmd->device->ioerr_cnt);
39010+ atomic_inc_unchecked(&cmd->device->ioerr_cnt);
39011
39012 disposition = scsi_decide_disposition(cmd);
39013 if (disposition != SUCCESS &&
39014diff -urNp linux-2.6.39.1/drivers/scsi/scsi_sysfs.c linux-2.6.39.1/drivers/scsi/scsi_sysfs.c
39015--- linux-2.6.39.1/drivers/scsi/scsi_sysfs.c 2011-05-19 00:06:34.000000000 -0400
39016+++ linux-2.6.39.1/drivers/scsi/scsi_sysfs.c 2011-05-22 19:36:32.000000000 -0400
39017@@ -621,7 +621,7 @@ show_iostat_##field(struct device *dev,
39018 char *buf) \
39019 { \
39020 struct scsi_device *sdev = to_scsi_device(dev); \
39021- unsigned long long count = atomic_read(&sdev->field); \
39022+ unsigned long long count = atomic_read_unchecked(&sdev->field); \
39023 return snprintf(buf, 20, "0x%llx\n", count); \
39024 } \
39025 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
39026diff -urNp linux-2.6.39.1/drivers/scsi/scsi_transport_fc.c linux-2.6.39.1/drivers/scsi/scsi_transport_fc.c
39027--- linux-2.6.39.1/drivers/scsi/scsi_transport_fc.c 2011-05-19 00:06:34.000000000 -0400
39028+++ linux-2.6.39.1/drivers/scsi/scsi_transport_fc.c 2011-05-22 19:36:32.000000000 -0400
39029@@ -485,7 +485,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_
39030 * Netlink Infrastructure
39031 */
39032
39033-static atomic_t fc_event_seq;
39034+static atomic_unchecked_t fc_event_seq;
39035
39036 /**
39037 * fc_get_event_number - Obtain the next sequential FC event number
39038@@ -498,7 +498,7 @@ static atomic_t fc_event_seq;
39039 u32
39040 fc_get_event_number(void)
39041 {
39042- return atomic_add_return(1, &fc_event_seq);
39043+ return atomic_add_return_unchecked(1, &fc_event_seq);
39044 }
39045 EXPORT_SYMBOL(fc_get_event_number);
39046
39047@@ -646,7 +646,7 @@ static __init int fc_transport_init(void
39048 {
39049 int error;
39050
39051- atomic_set(&fc_event_seq, 0);
39052+ atomic_set_unchecked(&fc_event_seq, 0);
39053
39054 error = transport_class_register(&fc_host_class);
39055 if (error)
39056@@ -836,7 +836,7 @@ static int fc_str_to_dev_loss(const char
39057 char *cp;
39058
39059 *val = simple_strtoul(buf, &cp, 0);
39060- if ((*cp && (*cp != '\n')) || (*val < 0))
39061+ if (*cp && (*cp != '\n'))
39062 return -EINVAL;
39063 /*
39064 * Check for overflow; dev_loss_tmo is u32
39065diff -urNp linux-2.6.39.1/drivers/scsi/scsi_transport_iscsi.c linux-2.6.39.1/drivers/scsi/scsi_transport_iscsi.c
39066--- linux-2.6.39.1/drivers/scsi/scsi_transport_iscsi.c 2011-05-19 00:06:34.000000000 -0400
39067+++ linux-2.6.39.1/drivers/scsi/scsi_transport_iscsi.c 2011-05-22 19:36:32.000000000 -0400
39068@@ -83,7 +83,7 @@ struct iscsi_internal {
39069 struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
39070 };
39071
39072-static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
39073+static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
39074 static struct workqueue_struct *iscsi_eh_timer_workq;
39075
39076 /*
39077@@ -761,7 +761,7 @@ int iscsi_add_session(struct iscsi_cls_s
39078 int err;
39079
39080 ihost = shost->shost_data;
39081- session->sid = atomic_add_return(1, &iscsi_session_nr);
39082+ session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
39083
39084 if (id == ISCSI_MAX_TARGET) {
39085 for (id = 0; id < ISCSI_MAX_TARGET; id++) {
39086@@ -2200,7 +2200,7 @@ static __init int iscsi_transport_init(v
39087 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
39088 ISCSI_TRANSPORT_VERSION);
39089
39090- atomic_set(&iscsi_session_nr, 0);
39091+ atomic_set_unchecked(&iscsi_session_nr, 0);
39092
39093 err = class_register(&iscsi_transport_class);
39094 if (err)
39095diff -urNp linux-2.6.39.1/drivers/scsi/scsi_transport_srp.c linux-2.6.39.1/drivers/scsi/scsi_transport_srp.c
39096--- linux-2.6.39.1/drivers/scsi/scsi_transport_srp.c 2011-05-19 00:06:34.000000000 -0400
39097+++ linux-2.6.39.1/drivers/scsi/scsi_transport_srp.c 2011-05-22 19:36:32.000000000 -0400
39098@@ -33,7 +33,7 @@
39099 #include "scsi_transport_srp_internal.h"
39100
39101 struct srp_host_attrs {
39102- atomic_t next_port_id;
39103+ atomic_unchecked_t next_port_id;
39104 };
39105 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
39106
39107@@ -62,7 +62,7 @@ static int srp_host_setup(struct transpo
39108 struct Scsi_Host *shost = dev_to_shost(dev);
39109 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
39110
39111- atomic_set(&srp_host->next_port_id, 0);
39112+ atomic_set_unchecked(&srp_host->next_port_id, 0);
39113 return 0;
39114 }
39115
39116@@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct S
39117 memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
39118 rport->roles = ids->roles;
39119
39120- id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
39121+ id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
39122 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
39123
39124 transport_setup_device(&rport->dev);
39125diff -urNp linux-2.6.39.1/drivers/scsi/sg.c linux-2.6.39.1/drivers/scsi/sg.c
39126--- linux-2.6.39.1/drivers/scsi/sg.c 2011-05-19 00:06:34.000000000 -0400
39127+++ linux-2.6.39.1/drivers/scsi/sg.c 2011-05-22 19:36:32.000000000 -0400
39128@@ -2310,7 +2310,7 @@ struct sg_proc_leaf {
39129 const struct file_operations * fops;
39130 };
39131
39132-static struct sg_proc_leaf sg_proc_leaf_arr[] = {
39133+static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
39134 {"allow_dio", &adio_fops},
39135 {"debug", &debug_fops},
39136 {"def_reserved_size", &dressz_fops},
39137@@ -2325,7 +2325,7 @@ sg_proc_init(void)
39138 {
39139 int k, mask;
39140 int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
39141- struct sg_proc_leaf * leaf;
39142+ const struct sg_proc_leaf * leaf;
39143
39144 sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
39145 if (!sg_proc_sgp)
39146diff -urNp linux-2.6.39.1/drivers/scsi/sym53c8xx_2/sym_glue.c linux-2.6.39.1/drivers/scsi/sym53c8xx_2/sym_glue.c
39147--- linux-2.6.39.1/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-05-19 00:06:34.000000000 -0400
39148+++ linux-2.6.39.1/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-05-22 19:36:32.000000000 -0400
39149@@ -1756,6 +1756,8 @@ static int __devinit sym2_probe(struct p
39150 int do_iounmap = 0;
39151 int do_disable_device = 1;
39152
39153+ pax_track_stack();
39154+
39155 memset(&sym_dev, 0, sizeof(sym_dev));
39156 memset(&nvram, 0, sizeof(nvram));
39157 sym_dev.pdev = pdev;
39158diff -urNp linux-2.6.39.1/drivers/scsi/vmw_pvscsi.c linux-2.6.39.1/drivers/scsi/vmw_pvscsi.c
39159--- linux-2.6.39.1/drivers/scsi/vmw_pvscsi.c 2011-05-19 00:06:34.000000000 -0400
39160+++ linux-2.6.39.1/drivers/scsi/vmw_pvscsi.c 2011-05-22 19:36:32.000000000 -0400
39161@@ -447,6 +447,8 @@ static void pvscsi_setup_all_rings(const
39162 dma_addr_t base;
39163 unsigned i;
39164
39165+ pax_track_stack();
39166+
39167 cmd.ringsStatePPN = adapter->ringStatePA >> PAGE_SHIFT;
39168 cmd.reqRingNumPages = adapter->req_pages;
39169 cmd.cmpRingNumPages = adapter->cmp_pages;
39170diff -urNp linux-2.6.39.1/drivers/sh/clk/cpg.c linux-2.6.39.1/drivers/sh/clk/cpg.c
39171--- linux-2.6.39.1/drivers/sh/clk/cpg.c 2011-06-03 00:04:14.000000000 -0400
39172+++ linux-2.6.39.1/drivers/sh/clk/cpg.c 2011-06-03 00:32:06.000000000 -0400
39173@@ -26,7 +26,7 @@ static void sh_clk_mstp32_disable(struct
39174 clk->enable_reg);
39175 }
39176
39177-static struct clk_ops sh_clk_mstp32_clk_ops = {
39178+static const struct clk_ops sh_clk_mstp32_clk_ops = {
39179 .enable = sh_clk_mstp32_enable,
39180 .disable = sh_clk_mstp32_disable,
39181 .recalc = followparent_recalc,
39182@@ -150,7 +150,7 @@ static void sh_clk_div6_disable(struct c
39183 __raw_writel(value, clk->enable_reg);
39184 }
39185
39186-static struct clk_ops sh_clk_div6_clk_ops = {
39187+static const struct clk_ops sh_clk_div6_clk_ops = {
39188 .recalc = sh_clk_div6_recalc,
39189 .round_rate = sh_clk_div_round_rate,
39190 .set_rate = sh_clk_div6_set_rate,
39191@@ -158,7 +158,7 @@ static struct clk_ops sh_clk_div6_clk_op
39192 .disable = sh_clk_div6_disable,
39193 };
39194
39195-static struct clk_ops sh_clk_div6_reparent_clk_ops = {
39196+static const struct clk_ops sh_clk_div6_reparent_clk_ops = {
39197 .recalc = sh_clk_div6_recalc,
39198 .round_rate = sh_clk_div_round_rate,
39199 .set_rate = sh_clk_div6_set_rate,
39200@@ -282,13 +282,13 @@ static void sh_clk_div4_disable(struct c
39201 __raw_writel(__raw_readl(clk->enable_reg) | (1 << 8), clk->enable_reg);
39202 }
39203
39204-static struct clk_ops sh_clk_div4_clk_ops = {
39205+static const struct clk_ops sh_clk_div4_clk_ops = {
39206 .recalc = sh_clk_div4_recalc,
39207 .set_rate = sh_clk_div4_set_rate,
39208 .round_rate = sh_clk_div_round_rate,
39209 };
39210
39211-static struct clk_ops sh_clk_div4_enable_clk_ops = {
39212+static const struct clk_ops sh_clk_div4_enable_clk_ops = {
39213 .recalc = sh_clk_div4_recalc,
39214 .set_rate = sh_clk_div4_set_rate,
39215 .round_rate = sh_clk_div_round_rate,
39216@@ -296,7 +296,7 @@ static struct clk_ops sh_clk_div4_enable
39217 .disable = sh_clk_div4_disable,
39218 };
39219
39220-static struct clk_ops sh_clk_div4_reparent_clk_ops = {
39221+static const struct clk_ops sh_clk_div4_reparent_clk_ops = {
39222 .recalc = sh_clk_div4_recalc,
39223 .set_rate = sh_clk_div4_set_rate,
39224 .round_rate = sh_clk_div_round_rate,
39225diff -urNp linux-2.6.39.1/drivers/spi/dw_spi.h linux-2.6.39.1/drivers/spi/dw_spi.h
39226--- linux-2.6.39.1/drivers/spi/dw_spi.h 2011-05-19 00:06:34.000000000 -0400
39227+++ linux-2.6.39.1/drivers/spi/dw_spi.h 2011-05-22 19:36:32.000000000 -0400
39228@@ -151,7 +151,7 @@ struct dw_spi {
39229 int dma_chan_done;
39230 struct device *dma_dev;
39231 dma_addr_t dma_addr; /* phy address of the Data register */
39232- struct dw_spi_dma_ops *dma_ops;
39233+ const struct dw_spi_dma_ops *dma_ops;
39234 void *dma_priv; /* platform relate info */
39235 struct pci_dev *dmac;
39236
39237diff -urNp linux-2.6.39.1/drivers/spi/dw_spi_mid.c linux-2.6.39.1/drivers/spi/dw_spi_mid.c
39238--- linux-2.6.39.1/drivers/spi/dw_spi_mid.c 2011-05-19 00:06:34.000000000 -0400
39239+++ linux-2.6.39.1/drivers/spi/dw_spi_mid.c 2011-05-22 19:36:32.000000000 -0400
39240@@ -180,7 +180,7 @@ static int mid_spi_dma_transfer(struct d
39241 return 0;
39242 }
39243
39244-static struct dw_spi_dma_ops mid_dma_ops = {
39245+static const struct dw_spi_dma_ops mid_dma_ops = {
39246 .dma_init = mid_spi_dma_init,
39247 .dma_exit = mid_spi_dma_exit,
39248 .dma_transfer = mid_spi_dma_transfer,
39249diff -urNp linux-2.6.39.1/drivers/spi/spi.c linux-2.6.39.1/drivers/spi/spi.c
39250--- linux-2.6.39.1/drivers/spi/spi.c 2011-05-19 00:06:34.000000000 -0400
39251+++ linux-2.6.39.1/drivers/spi/spi.c 2011-05-22 19:36:32.000000000 -0400
39252@@ -1023,7 +1023,7 @@ int spi_bus_unlock(struct spi_master *ma
39253 EXPORT_SYMBOL_GPL(spi_bus_unlock);
39254
39255 /* portable code must never pass more than 32 bytes */
39256-#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
39257+#define SPI_BUFSIZ max(32U,SMP_CACHE_BYTES)
39258
39259 static u8 *buf;
39260
39261diff -urNp linux-2.6.39.1/drivers/ssb/driver_pcicore.c linux-2.6.39.1/drivers/ssb/driver_pcicore.c
39262--- linux-2.6.39.1/drivers/ssb/driver_pcicore.c 2011-05-19 00:06:34.000000000 -0400
39263+++ linux-2.6.39.1/drivers/ssb/driver_pcicore.c 2011-05-22 19:36:32.000000000 -0400
39264@@ -223,7 +223,7 @@ static int ssb_pcicore_write_config(stru
39265 return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
39266 }
39267
39268-static struct pci_ops ssb_pcicore_pciops = {
39269+static const struct pci_ops ssb_pcicore_pciops = {
39270 .read = ssb_pcicore_read_config,
39271 .write = ssb_pcicore_write_config,
39272 };
39273diff -urNp linux-2.6.39.1/drivers/staging/ath6kl/os/linux/cfg80211.c linux-2.6.39.1/drivers/staging/ath6kl/os/linux/cfg80211.c
39274--- linux-2.6.39.1/drivers/staging/ath6kl/os/linux/cfg80211.c 2011-05-19 00:06:34.000000000 -0400
39275+++ linux-2.6.39.1/drivers/staging/ath6kl/os/linux/cfg80211.c 2011-05-22 19:36:32.000000000 -0400
39276@@ -1391,8 +1391,7 @@ u32 cipher_suites[] = {
39277 WLAN_CIPHER_SUITE_CCMP,
39278 };
39279
39280-static struct
39281-cfg80211_ops ar6k_cfg80211_ops = {
39282+static const struct cfg80211_ops ar6k_cfg80211_ops = {
39283 .change_virtual_intf = ar6k_cfg80211_change_iface,
39284 .add_virtual_intf = ar6k_cfg80211_add_virtual_intf,
39285 .del_virtual_intf = ar6k_cfg80211_del_virtual_intf,
39286diff -urNp linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/dhd_linux.c linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
39287--- linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/dhd_linux.c 2011-05-19 00:06:34.000000000 -0400
39288+++ linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/dhd_linux.c 2011-05-22 19:36:32.000000000 -0400
39289@@ -857,14 +857,14 @@ static void dhd_op_if(dhd_if_t *ifp)
39290 free_netdev(ifp->net);
39291 }
39292 /* Allocate etherdev, including space for private structure */
39293- ifp->net = alloc_etherdev(sizeof(dhd));
39294+ ifp->net = alloc_etherdev(sizeof(*dhd));
39295 if (!ifp->net) {
39296 DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
39297 ret = -ENOMEM;
39298 }
39299 if (ret == 0) {
39300 strcpy(ifp->net->name, ifp->name);
39301- memcpy(netdev_priv(ifp->net), &dhd, sizeof(dhd));
39302+ memcpy(netdev_priv(ifp->net), dhd, sizeof(*dhd));
39303 err = dhd_net_attach(&dhd->pub, ifp->idx);
39304 if (err != 0) {
39305 DHD_ERROR(("%s: dhd_net_attach failed, "
39306@@ -1500,7 +1500,7 @@ static void dhd_ethtool_get_drvinfo(stru
39307 sprintf(info->bus_info, "%s", dev_name(&wl_cfg80211_get_sdio_func()->dev));
39308 }
39309
39310-struct ethtool_ops dhd_ethtool_ops = {
39311+const struct ethtool_ops dhd_ethtool_ops = {
39312 .get_drvinfo = dhd_ethtool_get_drvinfo
39313 };
39314
39315@@ -1923,7 +1923,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
39316 strcpy(nv_path, nvram_path);
39317
39318 /* Allocate etherdev, including space for private structure */
39319- net = alloc_etherdev(sizeof(dhd));
39320+ net = alloc_etherdev(sizeof(*dhd));
39321 if (!net) {
39322 DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
39323 goto fail;
39324@@ -1939,7 +1939,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
39325 /*
39326 * Save the dhd_info into the priv
39327 */
39328- memcpy(netdev_priv(net), &dhd, sizeof(dhd));
39329+ memcpy(netdev_priv(net), dhd, sizeof(*dhd));
39330
39331 /* Set network interface name if it was provided as module parameter */
39332 if (iface_name[0]) {
39333@@ -2056,7 +2056,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
39334 /*
39335 * Save the dhd_info into the priv
39336 */
39337- memcpy(netdev_priv(net), &dhd, sizeof(dhd));
39338+ memcpy(netdev_priv(net), dhd, sizeof(*dhd));
39339
39340 #if defined(CUSTOMER_HW2) && defined(CONFIG_WIFI_CONTROL_FUNC)
39341 g_bus = bus;
39342@@ -2206,7 +2206,7 @@ dhd_iovar(dhd_pub_t *pub, int ifidx, cha
39343 return ret;
39344 }
39345
39346-static struct net_device_ops dhd_ops_pri = {
39347+static const struct net_device_ops dhd_ops_pri = {
39348 .ndo_open = dhd_open,
39349 .ndo_stop = dhd_stop,
39350 .ndo_get_stats = dhd_get_stats,
39351diff -urNp linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c
39352--- linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c 2011-05-19 00:06:34.000000000 -0400
39353+++ linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c 2011-05-22 19:36:32.000000000 -0400
39354@@ -2109,7 +2109,7 @@ wl_cfg80211_flush_pmksa(struct wiphy *wi
39355
39356 }
39357
39358-static struct cfg80211_ops wl_cfg80211_ops = {
39359+static const struct cfg80211_ops wl_cfg80211_ops = {
39360 .change_virtual_intf = wl_cfg80211_change_iface,
39361 .scan = wl_cfg80211_scan,
39362 .set_wiphy_params = wl_cfg80211_set_wiphy_params,
39363diff -urNp linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/wl_iw.c linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/wl_iw.c
39364--- linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/wl_iw.c 2011-05-19 00:06:34.000000000 -0400
39365+++ linux-2.6.39.1/drivers/staging/brcm80211/brcmfmac/wl_iw.c 2011-05-22 19:36:32.000000000 -0400
39366@@ -495,7 +495,7 @@ wl_iw_get_range(struct net_device *dev,
39367 list = (wl_u32_list_t *) channels;
39368
39369 dwrq->length = sizeof(struct iw_range);
39370- memset(range, 0, sizeof(range));
39371+ memset(range, 0, sizeof(*range));
39372
39373 range->min_nwid = range->max_nwid = 0;
39374
39375diff -urNp linux-2.6.39.1/drivers/staging/comedi/comedi_fops.c linux-2.6.39.1/drivers/staging/comedi/comedi_fops.c
39376--- linux-2.6.39.1/drivers/staging/comedi/comedi_fops.c 2011-05-19 00:06:34.000000000 -0400
39377+++ linux-2.6.39.1/drivers/staging/comedi/comedi_fops.c 2011-05-22 19:36:32.000000000 -0400
39378@@ -1445,7 +1445,7 @@ static void comedi_unmap(struct vm_area_
39379 mutex_unlock(&dev->mutex);
39380 }
39381
39382-static struct vm_operations_struct comedi_vm_ops = {
39383+static const struct vm_operations_struct comedi_vm_ops = {
39384 .close = comedi_unmap,
39385 };
39386
39387diff -urNp linux-2.6.39.1/drivers/staging/cx25821/cx25821-alsa.c linux-2.6.39.1/drivers/staging/cx25821/cx25821-alsa.c
39388--- linux-2.6.39.1/drivers/staging/cx25821/cx25821-alsa.c 2011-05-19 00:06:34.000000000 -0400
39389+++ linux-2.6.39.1/drivers/staging/cx25821/cx25821-alsa.c 2011-05-22 19:36:32.000000000 -0400
39390@@ -586,7 +586,7 @@ static struct page *snd_cx25821_page(str
39391 /*
39392 * operators
39393 */
39394-static struct snd_pcm_ops snd_cx25821_pcm_ops = {
39395+static const struct snd_pcm_ops snd_cx25821_pcm_ops = {
39396 .open = snd_cx25821_pcm_open,
39397 .close = snd_cx25821_close,
39398 .ioctl = snd_pcm_lib_ioctl,
39399diff -urNp linux-2.6.39.1/drivers/staging/cx25821/cx25821-i2c.c linux-2.6.39.1/drivers/staging/cx25821/cx25821-i2c.c
39400--- linux-2.6.39.1/drivers/staging/cx25821/cx25821-i2c.c 2011-05-19 00:06:34.000000000 -0400
39401+++ linux-2.6.39.1/drivers/staging/cx25821/cx25821-i2c.c 2011-05-22 19:36:32.000000000 -0400
39402@@ -282,7 +282,7 @@ static u32 cx25821_functionality(struct
39403 I2C_FUNC_SMBUS_READ_WORD_DATA | I2C_FUNC_SMBUS_WRITE_WORD_DATA;
39404 }
39405
39406-static struct i2c_algorithm cx25821_i2c_algo_template = {
39407+static const struct i2c_algorithm cx25821_i2c_algo_template = {
39408 .master_xfer = i2c_xfer,
39409 .functionality = cx25821_functionality,
39410 #ifdef NEED_ALGO_CONTROL
39411diff -urNp linux-2.6.39.1/drivers/staging/et131x/et1310_tx.c linux-2.6.39.1/drivers/staging/et131x/et1310_tx.c
39412--- linux-2.6.39.1/drivers/staging/et131x/et1310_tx.c 2011-05-19 00:06:34.000000000 -0400
39413+++ linux-2.6.39.1/drivers/staging/et131x/et1310_tx.c 2011-05-22 19:36:32.000000000 -0400
39414@@ -635,11 +635,11 @@ inline void et131x_free_send_packet(stru
39415 struct net_device_stats *stats = &etdev->net_stats;
39416
39417 if (tcb->flags & fMP_DEST_BROAD)
39418- atomic_inc(&etdev->Stats.brdcstxmt);
39419+ atomic_inc_unchecked(&etdev->Stats.brdcstxmt);
39420 else if (tcb->flags & fMP_DEST_MULTI)
39421- atomic_inc(&etdev->Stats.multixmt);
39422+ atomic_inc_unchecked(&etdev->Stats.multixmt);
39423 else
39424- atomic_inc(&etdev->Stats.unixmt);
39425+ atomic_inc_unchecked(&etdev->Stats.unixmt);
39426
39427 if (tcb->skb) {
39428 stats->tx_bytes += tcb->skb->len;
39429diff -urNp linux-2.6.39.1/drivers/staging/et131x/et131x_adapter.h linux-2.6.39.1/drivers/staging/et131x/et131x_adapter.h
39430--- linux-2.6.39.1/drivers/staging/et131x/et131x_adapter.h 2011-05-19 00:06:34.000000000 -0400
39431+++ linux-2.6.39.1/drivers/staging/et131x/et131x_adapter.h 2011-05-22 19:36:32.000000000 -0400
39432@@ -110,11 +110,11 @@ typedef struct _ce_stats_t {
39433 * operations
39434 */
39435 u32 unircv; /* # multicast packets received */
39436- atomic_t unixmt; /* # multicast packets for Tx */
39437+ atomic_unchecked_t unixmt; /* # multicast packets for Tx */
39438 u32 multircv; /* # multicast packets received */
39439- atomic_t multixmt; /* # multicast packets for Tx */
39440+ atomic_unchecked_t multixmt; /* # multicast packets for Tx */
39441 u32 brdcstrcv; /* # broadcast packets received */
39442- atomic_t brdcstxmt; /* # broadcast packets for Tx */
39443+ atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
39444 u32 norcvbuf; /* # Rx packets discarded */
39445 u32 noxmtbuf; /* # Tx packets discarded */
39446
39447diff -urNp linux-2.6.39.1/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c linux-2.6.39.1/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
39448--- linux-2.6.39.1/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c 2011-05-19 00:06:34.000000000 -0400
39449+++ linux-2.6.39.1/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c 2011-05-22 19:36:32.000000000 -0400
39450@@ -55,7 +55,7 @@ int numofmsgbuf = 0;
39451 //
39452 // Table of entry-point routines for char device
39453 //
39454-static struct file_operations ft1000fops =
39455+static const struct file_operations ft1000fops =
39456 {
39457 .unlocked_ioctl = ft1000_ioctl,
39458 .poll = ft1000_poll_dev,
39459diff -urNp linux-2.6.39.1/drivers/staging/generic_serial/rio/rio_linux.c linux-2.6.39.1/drivers/staging/generic_serial/rio/rio_linux.c
39460--- linux-2.6.39.1/drivers/staging/generic_serial/rio/rio_linux.c 2011-05-19 00:06:34.000000000 -0400
39461+++ linux-2.6.39.1/drivers/staging/generic_serial/rio/rio_linux.c 2011-05-22 19:36:32.000000000 -0400
39462@@ -221,7 +221,7 @@ module_param(rio_poll, int, 0);
39463 module_param(rio_debug, int, 0644);
39464 module_param(rio_irqmask, long, 0);
39465
39466-static struct real_driver rio_real_driver = {
39467+static const struct real_driver rio_real_driver = {
39468 rio_disable_tx_interrupts,
39469 rio_enable_tx_interrupts,
39470 rio_disable_rx_interrupts,
39471diff -urNp linux-2.6.39.1/drivers/staging/generic_serial/ser_a2232.c linux-2.6.39.1/drivers/staging/generic_serial/ser_a2232.c
39472--- linux-2.6.39.1/drivers/staging/generic_serial/ser_a2232.c 2011-05-19 00:06:34.000000000 -0400
39473+++ linux-2.6.39.1/drivers/staging/generic_serial/ser_a2232.c 2011-05-22 19:36:32.000000000 -0400
39474@@ -144,7 +144,7 @@ static int a2232_open(struct tty_struct
39475 /*---------------------------------------------------------------------------
39476 * Interface from generic_serial.c back here
39477 *--------------------------------------------------------------------------*/
39478-static struct real_driver a2232_real_driver = {
39479+static const struct real_driver a2232_real_driver = {
39480 a2232_disable_tx_interrupts,
39481 a2232_enable_tx_interrupts,
39482 a2232_disable_rx_interrupts,
39483diff -urNp linux-2.6.39.1/drivers/staging/generic_serial/sx.c linux-2.6.39.1/drivers/staging/generic_serial/sx.c
39484--- linux-2.6.39.1/drivers/staging/generic_serial/sx.c 2011-05-19 00:06:34.000000000 -0400
39485+++ linux-2.6.39.1/drivers/staging/generic_serial/sx.c 2011-05-22 19:36:32.000000000 -0400
39486@@ -355,7 +355,7 @@ module_param(sx_irqmask, int, 0);
39487
39488 MODULE_LICENSE("GPL");
39489
39490-static struct real_driver sx_real_driver = {
39491+static const struct real_driver sx_real_driver = {
39492 sx_disable_tx_interrupts,
39493 sx_enable_tx_interrupts,
39494 sx_disable_rx_interrupts,
39495diff -urNp linux-2.6.39.1/drivers/staging/generic_serial/vme_scc.c linux-2.6.39.1/drivers/staging/generic_serial/vme_scc.c
39496--- linux-2.6.39.1/drivers/staging/generic_serial/vme_scc.c 2011-05-19 00:06:34.000000000 -0400
39497+++ linux-2.6.39.1/drivers/staging/generic_serial/vme_scc.c 2011-05-22 19:36:32.000000000 -0400
39498@@ -94,7 +94,7 @@ static struct scc_port scc_ports[2];
39499 * Interface from generic_serial.c back here
39500 *--------------------------------------------------------------------------*/
39501
39502-static struct real_driver scc_real_driver = {
39503+static const struct real_driver scc_real_driver = {
39504 scc_disable_tx_interrupts,
39505 scc_enable_tx_interrupts,
39506 scc_disable_rx_interrupts,
39507diff -urNp linux-2.6.39.1/drivers/staging/gma500/psb_fb.c linux-2.6.39.1/drivers/staging/gma500/psb_fb.c
39508--- linux-2.6.39.1/drivers/staging/gma500/psb_fb.c 2011-05-19 00:06:34.000000000 -0400
39509+++ linux-2.6.39.1/drivers/staging/gma500/psb_fb.c 2011-05-22 19:36:32.000000000 -0400
39510@@ -230,7 +230,7 @@ static void psbfb_vm_close(struct vm_are
39511 DRM_DEBUG("vm_close\n");
39512 }
39513
39514-static struct vm_operations_struct psbfb_vm_ops = {
39515+static const struct vm_operations_struct psbfb_vm_ops = {
39516 .fault = psbfb_vm_fault,
39517 .open = psbfb_vm_open,
39518 .close = psbfb_vm_close
39519diff -urNp linux-2.6.39.1/drivers/staging/go7007/go7007-i2c.c linux-2.6.39.1/drivers/staging/go7007/go7007-i2c.c
39520--- linux-2.6.39.1/drivers/staging/go7007/go7007-i2c.c 2011-05-19 00:06:34.000000000 -0400
39521+++ linux-2.6.39.1/drivers/staging/go7007/go7007-i2c.c 2011-05-22 19:36:32.000000000 -0400
39522@@ -198,7 +198,7 @@ static u32 go7007_functionality(struct i
39523 return I2C_FUNC_SMBUS_BYTE_DATA;
39524 }
39525
39526-static struct i2c_algorithm go7007_algo = {
39527+static const struct i2c_algorithm go7007_algo = {
39528 .smbus_xfer = go7007_smbus_xfer,
39529 .master_xfer = go7007_i2c_master_xfer,
39530 .functionality = go7007_functionality,
39531diff -urNp linux-2.6.39.1/drivers/staging/go7007/go7007-usb.c linux-2.6.39.1/drivers/staging/go7007/go7007-usb.c
39532--- linux-2.6.39.1/drivers/staging/go7007/go7007-usb.c 2011-05-19 00:06:34.000000000 -0400
39533+++ linux-2.6.39.1/drivers/staging/go7007/go7007-usb.c 2011-05-22 19:36:32.000000000 -0400
39534@@ -849,7 +849,7 @@ static int go7007_usb_send_firmware(stru
39535 &transferred, timeout);
39536 }
39537
39538-static struct go7007_hpi_ops go7007_usb_ezusb_hpi_ops = {
39539+static const struct go7007_hpi_ops go7007_usb_ezusb_hpi_ops = {
39540 .interface_reset = go7007_usb_interface_reset,
39541 .write_interrupt = go7007_usb_ezusb_write_interrupt,
39542 .read_interrupt = go7007_usb_read_interrupt,
39543@@ -858,7 +858,7 @@ static struct go7007_hpi_ops go7007_usb_
39544 .send_firmware = go7007_usb_send_firmware,
39545 };
39546
39547-static struct go7007_hpi_ops go7007_usb_onboard_hpi_ops = {
39548+static const struct go7007_hpi_ops go7007_usb_onboard_hpi_ops = {
39549 .interface_reset = go7007_usb_interface_reset,
39550 .write_interrupt = go7007_usb_onboard_write_interrupt,
39551 .read_interrupt = go7007_usb_read_interrupt,
39552@@ -950,7 +950,7 @@ static u32 go7007_usb_functionality(stru
39553 return (I2C_FUNC_SMBUS_EMUL) & ~I2C_FUNC_SMBUS_QUICK;
39554 }
39555
39556-static struct i2c_algorithm go7007_usb_algo = {
39557+static const struct i2c_algorithm go7007_usb_algo = {
39558 .master_xfer = go7007_usb_i2c_master_xfer,
39559 .functionality = go7007_usb_functionality,
39560 };
39561diff -urNp linux-2.6.39.1/drivers/staging/go7007/go7007-v4l2.c linux-2.6.39.1/drivers/staging/go7007/go7007-v4l2.c
39562--- linux-2.6.39.1/drivers/staging/go7007/go7007-v4l2.c 2011-05-19 00:06:34.000000000 -0400
39563+++ linux-2.6.39.1/drivers/staging/go7007/go7007-v4l2.c 2011-05-22 19:36:32.000000000 -0400
39564@@ -1672,7 +1672,7 @@ static int go7007_vm_fault(struct vm_are
39565 return 0;
39566 }
39567
39568-static struct vm_operations_struct go7007_vm_ops = {
39569+static const struct vm_operations_struct go7007_vm_ops = {
39570 .open = go7007_vm_open,
39571 .close = go7007_vm_close,
39572 .fault = go7007_vm_fault,
39573diff -urNp linux-2.6.39.1/drivers/staging/go7007/saa7134-go7007.c linux-2.6.39.1/drivers/staging/go7007/saa7134-go7007.c
39574--- linux-2.6.39.1/drivers/staging/go7007/saa7134-go7007.c 2011-05-19 00:06:34.000000000 -0400
39575+++ linux-2.6.39.1/drivers/staging/go7007/saa7134-go7007.c 2011-05-22 19:36:32.000000000 -0400
39576@@ -421,7 +421,7 @@ static int saa7134_go7007_send_command(s
39577
39578 }
39579
39580-static struct go7007_hpi_ops saa7134_go7007_hpi_ops = {
39581+static const struct go7007_hpi_ops saa7134_go7007_hpi_ops = {
39582 .interface_reset = saa7134_go7007_interface_reset,
39583 .write_interrupt = saa7134_go7007_write_interrupt,
39584 .read_interrupt = saa7134_go7007_read_interrupt,
39585diff -urNp linux-2.6.39.1/drivers/staging/go7007/snd-go7007.c linux-2.6.39.1/drivers/staging/go7007/snd-go7007.c
39586--- linux-2.6.39.1/drivers/staging/go7007/snd-go7007.c 2011-05-19 00:06:34.000000000 -0400
39587+++ linux-2.6.39.1/drivers/staging/go7007/snd-go7007.c 2011-05-22 19:36:32.000000000 -0400
39588@@ -204,7 +204,7 @@ static struct page *go7007_snd_pcm_page(
39589 return vmalloc_to_page(substream->runtime->dma_area + offset);
39590 }
39591
39592-static struct snd_pcm_ops go7007_snd_capture_ops = {
39593+static const struct snd_pcm_ops go7007_snd_capture_ops = {
39594 .open = go7007_snd_capture_open,
39595 .close = go7007_snd_capture_close,
39596 .ioctl = snd_pcm_lib_ioctl,
39597@@ -227,7 +227,7 @@ static int go7007_snd_free(struct snd_de
39598 return 0;
39599 }
39600
39601-static struct snd_device_ops go7007_snd_device_ops = {
39602+static const struct snd_device_ops go7007_snd_device_ops = {
39603 .dev_free = go7007_snd_free,
39604 };
39605
39606diff -urNp linux-2.6.39.1/drivers/staging/hv/channel.c linux-2.6.39.1/drivers/staging/hv/channel.c
39607--- linux-2.6.39.1/drivers/staging/hv/channel.c 2011-05-19 00:06:34.000000000 -0400
39608+++ linux-2.6.39.1/drivers/staging/hv/channel.c 2011-05-22 19:36:32.000000000 -0400
39609@@ -509,8 +509,8 @@ int vmbus_establish_gpadl(struct vmbus_c
39610 unsigned long flags;
39611 int ret = 0;
39612
39613- next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle);
39614- atomic_inc(&vmbus_connection.next_gpadl_handle);
39615+ next_gpadl_handle = atomic_read_unchecked(&vmbus_connection.next_gpadl_handle);
39616+ atomic_inc_unchecked(&vmbus_connection.next_gpadl_handle);
39617
39618 ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
39619 if (ret)
39620diff -urNp linux-2.6.39.1/drivers/staging/hv/hv.c linux-2.6.39.1/drivers/staging/hv/hv.c
39621--- linux-2.6.39.1/drivers/staging/hv/hv.c 2011-05-19 00:06:34.000000000 -0400
39622+++ linux-2.6.39.1/drivers/staging/hv/hv.c 2011-05-22 19:36:32.000000000 -0400
39623@@ -163,7 +163,7 @@ static u64 do_hypercall(u64 control, voi
39624 u64 output_address = (output) ? virt_to_phys(output) : 0;
39625 u32 output_address_hi = output_address >> 32;
39626 u32 output_address_lo = output_address & 0xFFFFFFFF;
39627- volatile void *hypercall_page = hv_context.hypercall_page;
39628+ volatile void *hypercall_page = ktva_ktla(hv_context.hypercall_page);
39629
39630 DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
39631 control, input, output);
39632diff -urNp linux-2.6.39.1/drivers/staging/hv/rndis_filter.c linux-2.6.39.1/drivers/staging/hv/rndis_filter.c
39633--- linux-2.6.39.1/drivers/staging/hv/rndis_filter.c 2011-05-19 00:06:34.000000000 -0400
39634+++ linux-2.6.39.1/drivers/staging/hv/rndis_filter.c 2011-05-22 19:36:32.000000000 -0400
39635@@ -49,7 +49,7 @@ struct rndis_device {
39636
39637 enum rndis_device_state state;
39638 u32 link_stat;
39639- atomic_t new_req_id;
39640+ atomic_unchecked_t new_req_id;
39641
39642 spinlock_t request_lock;
39643 struct list_head req_list;
39644@@ -144,7 +144,7 @@ static struct rndis_request *get_rndis_r
39645 * template
39646 */
39647 set = &rndis_msg->msg.set_req;
39648- set->req_id = atomic_inc_return(&dev->new_req_id);
39649+ set->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
39650
39651 /* Add to the request list */
39652 spin_lock_irqsave(&dev->request_lock, flags);
39653@@ -709,7 +709,7 @@ static void rndis_filter_halt_device(str
39654
39655 /* Setup the rndis set */
39656 halt = &request->request_msg.msg.halt_req;
39657- halt->req_id = atomic_inc_return(&dev->new_req_id);
39658+ halt->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
39659
39660 /* Ignore return since this msg is optional. */
39661 rndis_filter_send_request(dev, request);
39662diff -urNp linux-2.6.39.1/drivers/staging/hv/vmbus_drv.c linux-2.6.39.1/drivers/staging/hv/vmbus_drv.c
39663--- linux-2.6.39.1/drivers/staging/hv/vmbus_drv.c 2011-05-19 00:06:34.000000000 -0400
39664+++ linux-2.6.39.1/drivers/staging/hv/vmbus_drv.c 2011-05-22 19:36:32.000000000 -0400
39665@@ -661,14 +661,14 @@ int vmbus_child_device_register(struct h
39666 {
39667 int ret = 0;
39668
39669- static atomic_t device_num = ATOMIC_INIT(0);
39670+ static atomic_unchecked_t device_num = ATOMIC_INIT(0);
39671
39672 DPRINT_DBG(VMBUS_DRV, "child device (%p) registering",
39673 child_device_obj);
39674
39675 /* Set the device name. Otherwise, device_register() will fail. */
39676 dev_set_name(&child_device_obj->device, "vmbus_0_%d",
39677- atomic_inc_return(&device_num));
39678+ atomic_inc_return_unchecked(&device_num));
39679
39680 /* The new device belongs to this bus */
39681 child_device_obj->device.bus = &vmbus_drv.bus; /* device->dev.bus; */
39682diff -urNp linux-2.6.39.1/drivers/staging/hv/vmbus_private.h linux-2.6.39.1/drivers/staging/hv/vmbus_private.h
39683--- linux-2.6.39.1/drivers/staging/hv/vmbus_private.h 2011-05-19 00:06:34.000000000 -0400
39684+++ linux-2.6.39.1/drivers/staging/hv/vmbus_private.h 2011-05-22 19:36:32.000000000 -0400
39685@@ -58,7 +58,7 @@ enum vmbus_connect_state {
39686 struct vmbus_connection {
39687 enum vmbus_connect_state conn_state;
39688
39689- atomic_t next_gpadl_handle;
39690+ atomic_unchecked_t next_gpadl_handle;
39691
39692 /*
39693 * Represents channel interrupts. Each bit position represents a
39694diff -urNp linux-2.6.39.1/drivers/staging/iio/ring_generic.h linux-2.6.39.1/drivers/staging/iio/ring_generic.h
39695--- linux-2.6.39.1/drivers/staging/iio/ring_generic.h 2011-05-19 00:06:34.000000000 -0400
39696+++ linux-2.6.39.1/drivers/staging/iio/ring_generic.h 2011-05-25 16:55:27.000000000 -0400
39697@@ -134,7 +134,7 @@ struct iio_ring_buffer {
39698 struct iio_handler access_handler;
39699 struct iio_event_interface ev_int;
39700 struct iio_shared_ev_pointer shared_ev_pointer;
39701- struct iio_ring_access_funcs access;
39702+ struct iio_ring_access_funcs access;
39703 int (*preenable)(struct iio_dev *);
39704 int (*postenable)(struct iio_dev *);
39705 int (*predisable)(struct iio_dev *);
39706diff -urNp linux-2.6.39.1/drivers/staging/intel_sst/intelmid_ctrl.c linux-2.6.39.1/drivers/staging/intel_sst/intelmid_ctrl.c
39707--- linux-2.6.39.1/drivers/staging/intel_sst/intelmid_ctrl.c 2011-05-19 00:06:34.000000000 -0400
39708+++ linux-2.6.39.1/drivers/staging/intel_sst/intelmid_ctrl.c 2011-05-22 19:36:32.000000000 -0400
39709@@ -494,7 +494,7 @@ static int snd_intelmad_device_set(struc
39710 struct snd_intelmad *intelmaddata;
39711 struct snd_pmic_ops *scard_ops;
39712 int ret_val = 0, vendor, status;
39713- struct intel_sst_pcm_control *pcm_control;
39714+ const struct intel_sst_pcm_control *pcm_control;
39715
39716 pr_debug("snd_intelmad_device_set called\n");
39717
39718diff -urNp linux-2.6.39.1/drivers/staging/intel_sst/intel_sst_drv_interface.c linux-2.6.39.1/drivers/staging/intel_sst/intel_sst_drv_interface.c
39719--- linux-2.6.39.1/drivers/staging/intel_sst/intel_sst_drv_interface.c 2011-05-19 00:06:34.000000000 -0400
39720+++ linux-2.6.39.1/drivers/staging/intel_sst/intel_sst_drv_interface.c 2011-05-22 19:36:32.000000000 -0400
39721@@ -470,7 +470,7 @@ int sst_device_control(int cmd, void *ar
39722 }
39723
39724
39725-struct intel_sst_pcm_control pcm_ops = {
39726+const struct intel_sst_pcm_control pcm_ops = {
39727 .open = sst_open_pcm_stream,
39728 .device_control = sst_device_control,
39729 .close = sst_close_pcm_stream,
39730diff -urNp linux-2.6.39.1/drivers/staging/line6/capture.c linux-2.6.39.1/drivers/staging/line6/capture.c
39731--- linux-2.6.39.1/drivers/staging/line6/capture.c 2011-05-19 00:06:34.000000000 -0400
39732+++ linux-2.6.39.1/drivers/staging/line6/capture.c 2011-05-22 19:36:32.000000000 -0400
39733@@ -378,7 +378,7 @@ snd_line6_capture_pointer(struct snd_pcm
39734 }
39735
39736 /* capture operators */
39737-struct snd_pcm_ops snd_line6_capture_ops = {
39738+const struct snd_pcm_ops snd_line6_capture_ops = {
39739 .open = snd_line6_capture_open,
39740 .close = snd_line6_capture_close,
39741 .ioctl = snd_pcm_lib_ioctl,
39742diff -urNp linux-2.6.39.1/drivers/staging/line6/capture.h linux-2.6.39.1/drivers/staging/line6/capture.h
39743--- linux-2.6.39.1/drivers/staging/line6/capture.h 2011-05-19 00:06:34.000000000 -0400
39744+++ linux-2.6.39.1/drivers/staging/line6/capture.h 2011-05-22 19:36:32.000000000 -0400
39745@@ -17,7 +17,7 @@
39746 #include "driver.h"
39747 #include "pcm.h"
39748
39749-extern struct snd_pcm_ops snd_line6_capture_ops;
39750+extern const struct snd_pcm_ops snd_line6_capture_ops;
39751
39752 extern void line6_capture_copy(struct snd_line6_pcm *line6pcm, char *fbuf,
39753 int fsize);
39754diff -urNp linux-2.6.39.1/drivers/staging/line6/midi.c linux-2.6.39.1/drivers/staging/line6/midi.c
39755--- linux-2.6.39.1/drivers/staging/line6/midi.c 2011-05-19 00:06:34.000000000 -0400
39756+++ linux-2.6.39.1/drivers/staging/line6/midi.c 2011-05-22 19:36:32.000000000 -0400
39757@@ -239,14 +239,14 @@ static void line6_midi_input_trigger(str
39758 line6->line6midi->substream_receive = 0;
39759 }
39760
39761-static struct snd_rawmidi_ops line6_midi_output_ops = {
39762+static const struct snd_rawmidi_ops line6_midi_output_ops = {
39763 .open = line6_midi_output_open,
39764 .close = line6_midi_output_close,
39765 .trigger = line6_midi_output_trigger,
39766 .drain = line6_midi_output_drain,
39767 };
39768
39769-static struct snd_rawmidi_ops line6_midi_input_ops = {
39770+static const struct snd_rawmidi_ops line6_midi_input_ops = {
39771 .open = line6_midi_input_open,
39772 .close = line6_midi_input_close,
39773 .trigger = line6_midi_input_trigger,
39774@@ -373,7 +373,7 @@ static int snd_line6_midi_free(struct sn
39775 */
39776 int line6_init_midi(struct usb_line6 *line6)
39777 {
39778- static struct snd_device_ops midi_ops = {
39779+ static const struct snd_device_ops midi_ops = {
39780 .dev_free = snd_line6_midi_free,
39781 };
39782
39783diff -urNp linux-2.6.39.1/drivers/staging/line6/pcm.c linux-2.6.39.1/drivers/staging/line6/pcm.c
39784--- linux-2.6.39.1/drivers/staging/line6/pcm.c 2011-05-19 00:06:34.000000000 -0400
39785+++ linux-2.6.39.1/drivers/staging/line6/pcm.c 2011-05-22 19:36:32.000000000 -0400
39786@@ -384,7 +384,7 @@ void line6_pcm_disconnect(struct snd_lin
39787 int line6_init_pcm(struct usb_line6 *line6,
39788 struct line6_pcm_properties *properties)
39789 {
39790- static struct snd_device_ops pcm_ops = {
39791+ static const struct snd_device_ops pcm_ops = {
39792 .dev_free = snd_line6_pcm_free,
39793 };
39794
39795diff -urNp linux-2.6.39.1/drivers/staging/line6/playback.c linux-2.6.39.1/drivers/staging/line6/playback.c
39796--- linux-2.6.39.1/drivers/staging/line6/playback.c 2011-05-19 00:06:34.000000000 -0400
39797+++ linux-2.6.39.1/drivers/staging/line6/playback.c 2011-05-22 19:36:32.000000000 -0400
39798@@ -536,7 +536,7 @@ snd_line6_playback_pointer(struct snd_pc
39799 }
39800
39801 /* playback operators */
39802-struct snd_pcm_ops snd_line6_playback_ops = {
39803+const struct snd_pcm_ops snd_line6_playback_ops = {
39804 .open = snd_line6_playback_open,
39805 .close = snd_line6_playback_close,
39806 .ioctl = snd_pcm_lib_ioctl,
39807diff -urNp linux-2.6.39.1/drivers/staging/line6/playback.h linux-2.6.39.1/drivers/staging/line6/playback.h
39808--- linux-2.6.39.1/drivers/staging/line6/playback.h 2011-05-19 00:06:34.000000000 -0400
39809+++ linux-2.6.39.1/drivers/staging/line6/playback.h 2011-05-22 19:36:32.000000000 -0400
39810@@ -27,7 +27,7 @@
39811 */
39812 #define USE_CLEAR_BUFFER_WORKAROUND 1
39813
39814-extern struct snd_pcm_ops snd_line6_playback_ops;
39815+extern const struct snd_pcm_ops snd_line6_playback_ops;
39816
39817 extern int line6_create_audio_out_urbs(struct snd_line6_pcm *line6pcm);
39818 extern int line6_submit_audio_out_all_urbs(struct snd_line6_pcm *line6pcm);
39819diff -urNp linux-2.6.39.1/drivers/staging/msm/staging-devices.c linux-2.6.39.1/drivers/staging/msm/staging-devices.c
39820--- linux-2.6.39.1/drivers/staging/msm/staging-devices.c 2011-05-19 00:06:34.000000000 -0400
39821+++ linux-2.6.39.1/drivers/staging/msm/staging-devices.c 2011-05-22 19:36:32.000000000 -0400
39822@@ -211,7 +211,7 @@ static int msm_fb_lcdc_gpio_config(int o
39823 }
39824
39825
39826-static struct lcdc_platform_data lcdc_pdata = {
39827+static const struct lcdc_platform_data lcdc_pdata = {
39828 .lcdc_gpio_config = msm_fb_lcdc_gpio_config,
39829 };
39830
39831diff -urNp linux-2.6.39.1/drivers/staging/octeon/ethernet.c linux-2.6.39.1/drivers/staging/octeon/ethernet.c
39832--- linux-2.6.39.1/drivers/staging/octeon/ethernet.c 2011-05-19 00:06:34.000000000 -0400
39833+++ linux-2.6.39.1/drivers/staging/octeon/ethernet.c 2011-05-22 19:36:32.000000000 -0400
39834@@ -258,11 +258,11 @@ static struct net_device_stats *cvm_oct_
39835 * since the RX tasklet also increments it.
39836 */
39837 #ifdef CONFIG_64BIT
39838- atomic64_add(rx_status.dropped_packets,
39839- (atomic64_t *)&priv->stats.rx_dropped);
39840+ atomic64_add_unchecked(rx_status.dropped_packets,
39841+ (atomic64_unchecked_t *)&priv->stats.rx_dropped);
39842 #else
39843- atomic_add(rx_status.dropped_packets,
39844- (atomic_t *)&priv->stats.rx_dropped);
39845+ atomic_add_unchecked(rx_status.dropped_packets,
39846+ (atomic_unchecked_t *)&priv->stats.rx_dropped);
39847 #endif
39848 }
39849
39850diff -urNp linux-2.6.39.1/drivers/staging/octeon/ethernet-rx.c linux-2.6.39.1/drivers/staging/octeon/ethernet-rx.c
39851--- linux-2.6.39.1/drivers/staging/octeon/ethernet-rx.c 2011-05-19 00:06:34.000000000 -0400
39852+++ linux-2.6.39.1/drivers/staging/octeon/ethernet-rx.c 2011-05-22 19:36:32.000000000 -0400
39853@@ -417,11 +417,11 @@ static int cvm_oct_napi_poll(struct napi
39854 /* Increment RX stats for virtual ports */
39855 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
39856 #ifdef CONFIG_64BIT
39857- atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
39858- atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
39859+ atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
39860+ atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
39861 #else
39862- atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
39863- atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
39864+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
39865+ atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
39866 #endif
39867 }
39868 netif_receive_skb(skb);
39869@@ -433,9 +433,9 @@ static int cvm_oct_napi_poll(struct napi
39870 dev->name);
39871 */
39872 #ifdef CONFIG_64BIT
39873- atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
39874+ atomic64_unchecked_add(1, (atomic64_unchecked_t *)&priv->stats.rx_dropped);
39875 #else
39876- atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
39877+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_dropped);
39878 #endif
39879 dev_kfree_skb_irq(skb);
39880 }
39881diff -urNp linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon.c linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon.c
39882--- linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon.c 2011-05-19 00:06:34.000000000 -0400
39883+++ linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon.c 2011-05-22 19:36:32.000000000 -0400
39884@@ -43,7 +43,7 @@ module_param(noinit, int, 0444);
39885 static int useaa = 1;
39886 module_param(useaa, int, 0444);
39887
39888-static struct dcon_platform_data *pdata;
39889+static const struct dcon_platform_data *pdata;
39890
39891 /* I2C structures */
39892
39893diff -urNp linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon.h linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon.h
39894--- linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon.h 2011-05-19 00:06:34.000000000 -0400
39895+++ linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon.h 2011-05-22 19:36:32.000000000 -0400
39896@@ -92,11 +92,11 @@ struct dcon_platform_data {
39897 extern irqreturn_t dcon_interrupt(int irq, void *id);
39898
39899 #ifdef CONFIG_FB_OLPC_DCON_1
39900-extern struct dcon_platform_data dcon_pdata_xo_1;
39901+extern const struct dcon_platform_data dcon_pdata_xo_1;
39902 #endif
39903
39904 #ifdef CONFIG_FB_OLPC_DCON_1_5
39905-extern struct dcon_platform_data dcon_pdata_xo_1_5;
39906+extern const struct dcon_platform_data dcon_pdata_xo_1_5;
39907 #endif
39908
39909 #endif
39910diff -urNp linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c
39911--- linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c 2011-05-19 00:06:34.000000000 -0400
39912+++ linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c 2011-05-22 19:36:32.000000000 -0400
39913@@ -185,7 +185,7 @@ static u8 dcon_read_status_xo_1_5(void)
39914 return status;
39915 }
39916
39917-struct dcon_platform_data dcon_pdata_xo_1_5 = {
39918+const struct dcon_platform_data dcon_pdata_xo_1_5 = {
39919 .init = dcon_init_xo_1_5,
39920 .bus_stabilize_wiggle = dcon_wiggle_xo_1_5,
39921 .set_dconload = dcon_set_dconload_xo_1_5,
39922diff -urNp linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c
39923--- linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c 2011-05-19 00:06:34.000000000 -0400
39924+++ linux-2.6.39.1/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c 2011-05-22 19:36:32.000000000 -0400
39925@@ -196,7 +196,7 @@ static u8 dcon_read_status_xo_1(void)
39926 return status;
39927 }
39928
39929-struct dcon_platform_data dcon_pdata_xo_1 = {
39930+const struct dcon_platform_data dcon_pdata_xo_1 = {
39931 .init = dcon_init_xo_1,
39932 .bus_stabilize_wiggle = dcon_wiggle_xo_1,
39933 .set_dconload = dcon_set_dconload_1,
39934diff -urNp linux-2.6.39.1/drivers/staging/phison/phison.c linux-2.6.39.1/drivers/staging/phison/phison.c
39935--- linux-2.6.39.1/drivers/staging/phison/phison.c 2011-05-19 00:06:34.000000000 -0400
39936+++ linux-2.6.39.1/drivers/staging/phison/phison.c 2011-05-22 19:36:32.000000000 -0400
39937@@ -43,7 +43,7 @@ static struct scsi_host_template phison_
39938 ATA_BMDMA_SHT(DRV_NAME),
39939 };
39940
39941-static struct ata_port_operations phison_ops = {
39942+static const struct ata_port_operations phison_ops = {
39943 .inherits = &ata_bmdma_port_ops,
39944 .prereset = phison_pre_reset,
39945 };
39946diff -urNp linux-2.6.39.1/drivers/staging/pohmelfs/inode.c linux-2.6.39.1/drivers/staging/pohmelfs/inode.c
39947--- linux-2.6.39.1/drivers/staging/pohmelfs/inode.c 2011-05-19 00:06:34.000000000 -0400
39948+++ linux-2.6.39.1/drivers/staging/pohmelfs/inode.c 2011-05-22 19:36:32.000000000 -0400
39949@@ -1855,7 +1855,7 @@ static int pohmelfs_fill_super(struct su
39950 mutex_init(&psb->mcache_lock);
39951 psb->mcache_root = RB_ROOT;
39952 psb->mcache_timeout = msecs_to_jiffies(5000);
39953- atomic_long_set(&psb->mcache_gen, 0);
39954+ atomic_long_set_unchecked(&psb->mcache_gen, 0);
39955
39956 psb->trans_max_pages = 100;
39957
39958@@ -1870,7 +1870,7 @@ static int pohmelfs_fill_super(struct su
39959 INIT_LIST_HEAD(&psb->crypto_ready_list);
39960 INIT_LIST_HEAD(&psb->crypto_active_list);
39961
39962- atomic_set(&psb->trans_gen, 1);
39963+ atomic_set_unchecked(&psb->trans_gen, 1);
39964 atomic_long_set(&psb->total_inodes, 0);
39965
39966 mutex_init(&psb->state_lock);
39967diff -urNp linux-2.6.39.1/drivers/staging/pohmelfs/mcache.c linux-2.6.39.1/drivers/staging/pohmelfs/mcache.c
39968--- linux-2.6.39.1/drivers/staging/pohmelfs/mcache.c 2011-05-19 00:06:34.000000000 -0400
39969+++ linux-2.6.39.1/drivers/staging/pohmelfs/mcache.c 2011-05-22 19:36:32.000000000 -0400
39970@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
39971 m->data = data;
39972 m->start = start;
39973 m->size = size;
39974- m->gen = atomic_long_inc_return(&psb->mcache_gen);
39975+ m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
39976
39977 mutex_lock(&psb->mcache_lock);
39978 err = pohmelfs_mcache_insert(psb, m);
39979diff -urNp linux-2.6.39.1/drivers/staging/pohmelfs/netfs.h linux-2.6.39.1/drivers/staging/pohmelfs/netfs.h
39980--- linux-2.6.39.1/drivers/staging/pohmelfs/netfs.h 2011-05-19 00:06:34.000000000 -0400
39981+++ linux-2.6.39.1/drivers/staging/pohmelfs/netfs.h 2011-05-22 19:36:32.000000000 -0400
39982@@ -571,14 +571,14 @@ struct pohmelfs_config;
39983 struct pohmelfs_sb {
39984 struct rb_root mcache_root;
39985 struct mutex mcache_lock;
39986- atomic_long_t mcache_gen;
39987+ atomic_long_unchecked_t mcache_gen;
39988 unsigned long mcache_timeout;
39989
39990 unsigned int idx;
39991
39992 unsigned int trans_retries;
39993
39994- atomic_t trans_gen;
39995+ atomic_unchecked_t trans_gen;
39996
39997 unsigned int crypto_attached_size;
39998 unsigned int crypto_align_size;
39999diff -urNp linux-2.6.39.1/drivers/staging/pohmelfs/trans.c linux-2.6.39.1/drivers/staging/pohmelfs/trans.c
40000--- linux-2.6.39.1/drivers/staging/pohmelfs/trans.c 2011-05-19 00:06:34.000000000 -0400
40001+++ linux-2.6.39.1/drivers/staging/pohmelfs/trans.c 2011-05-22 19:36:32.000000000 -0400
40002@@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_tran
40003 int err;
40004 struct netfs_cmd *cmd = t->iovec.iov_base;
40005
40006- t->gen = atomic_inc_return(&psb->trans_gen);
40007+ t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
40008
40009 cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
40010 t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
40011diff -urNp linux-2.6.39.1/drivers/staging/rtl8192u/ieee80211/proc.c linux-2.6.39.1/drivers/staging/rtl8192u/ieee80211/proc.c
40012--- linux-2.6.39.1/drivers/staging/rtl8192u/ieee80211/proc.c 2011-05-19 00:06:34.000000000 -0400
40013+++ linux-2.6.39.1/drivers/staging/rtl8192u/ieee80211/proc.c 2011-05-22 19:36:32.000000000 -0400
40014@@ -87,7 +87,7 @@ static int c_show(struct seq_file *m, vo
40015 return 0;
40016 }
40017
40018-static struct seq_operations crypto_seq_ops = {
40019+static const struct seq_operations crypto_seq_ops = {
40020 .start = c_start,
40021 .next = c_next,
40022 .stop = c_stop,
40023@@ -99,7 +99,7 @@ static int crypto_info_open(struct inode
40024 return seq_open(file, &crypto_seq_ops);
40025 }
40026
40027-static struct file_operations proc_crypto_ops = {
40028+static const struct file_operations proc_crypto_ops = {
40029 .open = crypto_info_open,
40030 .read = seq_read,
40031 .llseek = seq_lseek,
40032diff -urNp linux-2.6.39.1/drivers/staging/rtl8712/rtl871x_io.h linux-2.6.39.1/drivers/staging/rtl8712/rtl871x_io.h
40033--- linux-2.6.39.1/drivers/staging/rtl8712/rtl871x_io.h 2011-05-19 00:06:34.000000000 -0400
40034+++ linux-2.6.39.1/drivers/staging/rtl8712/rtl871x_io.h 2011-05-22 19:36:32.000000000 -0400
40035@@ -107,7 +107,7 @@ struct intf_hdl {
40036 void (*intf_hdl_unload)(u8 *priv);
40037 void (*intf_hdl_open)(u8 *priv);
40038 void (*intf_hdl_close)(u8 *priv);
40039- struct _io_ops io_ops;
40040+ const struct _io_ops io_ops;
40041 };
40042
40043 struct reg_protocol_rd {
40044diff -urNp linux-2.6.39.1/drivers/staging/solo6x10/g723.c linux-2.6.39.1/drivers/staging/solo6x10/g723.c
40045--- linux-2.6.39.1/drivers/staging/solo6x10/g723.c 2011-05-19 00:06:34.000000000 -0400
40046+++ linux-2.6.39.1/drivers/staging/solo6x10/g723.c 2011-05-22 19:36:32.000000000 -0400
40047@@ -237,7 +237,7 @@ static int snd_solo_pcm_copy(struct snd_
40048 return 0;
40049 }
40050
40051-static struct snd_pcm_ops snd_solo_pcm_ops = {
40052+static const struct snd_pcm_ops snd_solo_pcm_ops = {
40053 .open = snd_solo_pcm_open,
40054 .close = snd_solo_pcm_close,
40055 .ioctl = snd_pcm_lib_ioctl,
40056@@ -334,7 +334,7 @@ static int solo_snd_pcm_init(struct solo
40057
40058 int solo_g723_init(struct solo_dev *solo_dev)
40059 {
40060- static struct snd_device_ops ops = { NULL };
40061+ static const struct snd_device_ops ops = { NULL };
40062 struct snd_card *card;
40063 struct snd_kcontrol_new kctl;
40064 char name[32];
40065diff -urNp linux-2.6.39.1/drivers/staging/spectra/ffsport.c linux-2.6.39.1/drivers/staging/spectra/ffsport.c
40066--- linux-2.6.39.1/drivers/staging/spectra/ffsport.c 2011-05-19 00:06:34.000000000 -0400
40067+++ linux-2.6.39.1/drivers/staging/spectra/ffsport.c 2011-05-22 19:36:32.000000000 -0400
40068@@ -604,7 +604,7 @@ int GLOB_SBD_unlocked_ioctl(struct block
40069 return ret;
40070 }
40071
40072-static struct block_device_operations GLOB_SBD_ops = {
40073+static const struct block_device_operations GLOB_SBD_ops = {
40074 .owner = THIS_MODULE,
40075 .open = GLOB_SBD_open,
40076 .release = GLOB_SBD_release,
40077diff -urNp linux-2.6.39.1/drivers/staging/tm6000/tm6000-alsa.c linux-2.6.39.1/drivers/staging/tm6000/tm6000-alsa.c
40078--- linux-2.6.39.1/drivers/staging/tm6000/tm6000-alsa.c 2011-05-19 00:06:34.000000000 -0400
40079+++ linux-2.6.39.1/drivers/staging/tm6000/tm6000-alsa.c 2011-05-22 19:36:32.000000000 -0400
40080@@ -380,7 +380,7 @@ static snd_pcm_uframes_t snd_tm6000_poin
40081 /*
40082 * operators
40083 */
40084-static struct snd_pcm_ops snd_tm6000_pcm_ops = {
40085+static const struct snd_pcm_ops snd_tm6000_pcm_ops = {
40086 .open = snd_tm6000_pcm_open,
40087 .close = snd_tm6000_close,
40088 .ioctl = snd_pcm_lib_ioctl,
40089diff -urNp linux-2.6.39.1/drivers/staging/tty/istallion.c linux-2.6.39.1/drivers/staging/tty/istallion.c
40090--- linux-2.6.39.1/drivers/staging/tty/istallion.c 2011-05-19 00:06:34.000000000 -0400
40091+++ linux-2.6.39.1/drivers/staging/tty/istallion.c 2011-05-22 20:49:07.000000000 -0400
40092@@ -186,7 +186,6 @@ static struct ktermios stli_deftermios
40093 * re-used for each stats call.
40094 */
40095 static comstats_t stli_comstats;
40096-static combrd_t stli_brdstats;
40097 static struct asystats stli_cdkstats;
40098
40099 /*****************************************************************************/
40100@@ -4003,6 +4002,7 @@ out:
40101
40102 static int stli_getbrdstats(combrd_t __user *bp)
40103 {
40104+ combrd_t stli_brdstats;
40105 struct stlibrd *brdp;
40106 unsigned int i;
40107
40108@@ -4226,6 +4226,8 @@ static int stli_getportstruct(struct stl
40109 struct stliport stli_dummyport;
40110 struct stliport *portp;
40111
40112+ pax_track_stack();
40113+
40114 if (copy_from_user(&stli_dummyport, arg, sizeof(struct stliport)))
40115 return -EFAULT;
40116 portp = stli_getport(stli_dummyport.brdnr, stli_dummyport.panelnr,
40117@@ -4248,6 +4250,8 @@ static int stli_getbrdstruct(struct stli
40118 struct stlibrd stli_dummybrd;
40119 struct stlibrd *brdp;
40120
40121+ pax_track_stack();
40122+
40123 if (copy_from_user(&stli_dummybrd, arg, sizeof(struct stlibrd)))
40124 return -EFAULT;
40125 if (stli_dummybrd.brdnr >= STL_MAXBRDS)
40126diff -urNp linux-2.6.39.1/drivers/staging/tty/stallion.c linux-2.6.39.1/drivers/staging/tty/stallion.c
40127--- linux-2.6.39.1/drivers/staging/tty/stallion.c 2011-05-19 00:06:34.000000000 -0400
40128+++ linux-2.6.39.1/drivers/staging/tty/stallion.c 2011-05-22 19:36:32.000000000 -0400
40129@@ -2406,6 +2406,8 @@ static int stl_getportstruct(struct stlp
40130 struct stlport stl_dummyport;
40131 struct stlport *portp;
40132
40133+ pax_track_stack();
40134+
40135 if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
40136 return -EFAULT;
40137 portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
40138diff -urNp linux-2.6.39.1/drivers/staging/usbip/vhci.h linux-2.6.39.1/drivers/staging/usbip/vhci.h
40139--- linux-2.6.39.1/drivers/staging/usbip/vhci.h 2011-05-19 00:06:34.000000000 -0400
40140+++ linux-2.6.39.1/drivers/staging/usbip/vhci.h 2011-05-22 19:36:32.000000000 -0400
40141@@ -92,7 +92,7 @@ struct vhci_hcd {
40142 unsigned resuming:1;
40143 unsigned long re_timeout;
40144
40145- atomic_t seqnum;
40146+ atomic_unchecked_t seqnum;
40147
40148 /*
40149 * NOTE:
40150diff -urNp linux-2.6.39.1/drivers/staging/usbip/vhci_hcd.c linux-2.6.39.1/drivers/staging/usbip/vhci_hcd.c
40151--- linux-2.6.39.1/drivers/staging/usbip/vhci_hcd.c 2011-05-19 00:06:34.000000000 -0400
40152+++ linux-2.6.39.1/drivers/staging/usbip/vhci_hcd.c 2011-05-22 19:36:32.000000000 -0400
40153@@ -536,7 +536,7 @@ static void vhci_tx_urb(struct urb *urb)
40154 return;
40155 }
40156
40157- priv->seqnum = atomic_inc_return(&the_controller->seqnum);
40158+ priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
40159 if (priv->seqnum == 0xffff)
40160 usbip_uinfo("seqnum max\n");
40161
40162@@ -795,7 +795,7 @@ static int vhci_urb_dequeue(struct usb_h
40163 return -ENOMEM;
40164 }
40165
40166- unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
40167+ unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
40168 if (unlink->seqnum == 0xffff)
40169 usbip_uinfo("seqnum max\n");
40170
40171@@ -992,7 +992,7 @@ static int vhci_start(struct usb_hcd *hc
40172 vdev->rhport = rhport;
40173 }
40174
40175- atomic_set(&vhci->seqnum, 0);
40176+ atomic_set_unchecked(&vhci->seqnum, 0);
40177 spin_lock_init(&vhci->lock);
40178
40179
40180diff -urNp linux-2.6.39.1/drivers/staging/usbip/vhci_rx.c linux-2.6.39.1/drivers/staging/usbip/vhci_rx.c
40181--- linux-2.6.39.1/drivers/staging/usbip/vhci_rx.c 2011-05-19 00:06:34.000000000 -0400
40182+++ linux-2.6.39.1/drivers/staging/usbip/vhci_rx.c 2011-05-22 19:36:32.000000000 -0400
40183@@ -81,7 +81,7 @@ static void vhci_recv_ret_submit(struct
40184 usbip_uerr("cannot find a urb of seqnum %u\n",
40185 pdu->base.seqnum);
40186 usbip_uinfo("max seqnum %d\n",
40187- atomic_read(&the_controller->seqnum));
40188+ atomic_read_unchecked(&the_controller->seqnum));
40189 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
40190 return;
40191 }
40192diff -urNp linux-2.6.39.1/drivers/staging/vme/devices/vme_user.c linux-2.6.39.1/drivers/staging/vme/devices/vme_user.c
40193--- linux-2.6.39.1/drivers/staging/vme/devices/vme_user.c 2011-05-19 00:06:34.000000000 -0400
40194+++ linux-2.6.39.1/drivers/staging/vme/devices/vme_user.c 2011-05-22 19:36:32.000000000 -0400
40195@@ -138,7 +138,7 @@ static long vme_user_unlocked_ioctl(stru
40196 static int __devinit vme_user_probe(struct device *, int, int);
40197 static int __devexit vme_user_remove(struct device *, int, int);
40198
40199-static struct file_operations vme_user_fops = {
40200+static const struct file_operations vme_user_fops = {
40201 .open = vme_user_open,
40202 .release = vme_user_release,
40203 .read = vme_user_read,
40204diff -urNp linux-2.6.39.1/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c linux-2.6.39.1/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c
40205--- linux-2.6.39.1/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c 2011-05-19 00:06:34.000000000 -0400
40206+++ linux-2.6.39.1/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c 2011-05-22 19:36:32.000000000 -0400
40207@@ -426,7 +426,7 @@ int cyasblkdev_revalidate_disk(struct ge
40208
40209
40210 /*standard block device driver interface */
40211-static struct block_device_operations cyasblkdev_bdops = {
40212+static const struct block_device_operations cyasblkdev_bdops = {
40213 .open = cyasblkdev_blk_open,
40214 .release = cyasblkdev_blk_release,
40215 .ioctl = cyasblkdev_blk_ioctl,
40216diff -urNp linux-2.6.39.1/drivers/staging/wlags49_h2/wl_netdev.c linux-2.6.39.1/drivers/staging/wlags49_h2/wl_netdev.c
40217--- linux-2.6.39.1/drivers/staging/wlags49_h2/wl_netdev.c 2011-05-19 00:06:34.000000000 -0400
40218+++ linux-2.6.39.1/drivers/staging/wlags49_h2/wl_netdev.c 2011-05-22 19:36:32.000000000 -0400
40219@@ -474,7 +474,7 @@ static void wl_get_drvinfo(struct net_de
40220 }
40221 } // wl_get_drvinfo
40222
40223-static struct ethtool_ops wl_ethtool_ops = {
40224+static const struct ethtool_ops wl_ethtool_ops = {
40225 .get_drvinfo = wl_get_drvinfo,
40226 .get_link = ethtool_op_get_link,
40227 };
40228diff -urNp linux-2.6.39.1/drivers/staging/wlan-ng/hfa384x_usb.c linux-2.6.39.1/drivers/staging/wlan-ng/hfa384x_usb.c
40229--- linux-2.6.39.1/drivers/staging/wlan-ng/hfa384x_usb.c 2011-05-19 00:06:34.000000000 -0400
40230+++ linux-2.6.39.1/drivers/staging/wlan-ng/hfa384x_usb.c 2011-05-22 19:36:32.000000000 -0400
40231@@ -671,7 +671,7 @@ struct usbctlx_cmd_completor {
40232 hfa384x_cmdresult_t *result;
40233 };
40234
40235-static inline int usbctlx_cmd_completor_fn(struct usbctlx_completor *head)
40236+static inline int usbctlx_cmd_completor_fn(const struct usbctlx_completor *head)
40237 {
40238 struct usbctlx_cmd_completor *complete;
40239
40240@@ -705,7 +705,7 @@ struct usbctlx_rrid_completor {
40241 unsigned int riddatalen;
40242 };
40243
40244-static int usbctlx_rrid_completor_fn(struct usbctlx_completor *head)
40245+static int usbctlx_rrid_completor_fn(const struct usbctlx_completor *head)
40246 {
40247 struct usbctlx_rrid_completor *complete;
40248 hfa384x_rridresult_t rridresult;
40249@@ -768,7 +768,7 @@ struct usbctlx_rmem_completor {
40250 };
40251 typedef struct usbctlx_rmem_completor usbctlx_rmem_completor_t;
40252
40253-static int usbctlx_rmem_completor_fn(struct usbctlx_completor *head)
40254+static int usbctlx_rmem_completor_fn(const struct usbctlx_completor *head)
40255 {
40256 usbctlx_rmem_completor_t *complete = (usbctlx_rmem_completor_t *) head;
40257
40258diff -urNp linux-2.6.39.1/drivers/staging/zcache/tmem.c linux-2.6.39.1/drivers/staging/zcache/tmem.c
40259--- linux-2.6.39.1/drivers/staging/zcache/tmem.c 2011-05-19 00:06:34.000000000 -0400
40260+++ linux-2.6.39.1/drivers/staging/zcache/tmem.c 2011-05-22 19:36:32.000000000 -0400
40261@@ -39,7 +39,7 @@
40262 * A tmem host implementation must use this function to register callbacks
40263 * for memory allocation.
40264 */
40265-static struct tmem_hostops tmem_hostops;
40266+static const struct tmem_hostops tmem_hostops;
40267
40268 static void tmem_objnode_tree_init(void);
40269
40270@@ -53,7 +53,7 @@ void tmem_register_hostops(struct tmem_h
40271 * A tmem host implementation must use this function to register
40272 * callbacks for a page-accessible memory (PAM) implementation
40273 */
40274-static struct tmem_pamops tmem_pamops;
40275+static const struct tmem_pamops tmem_pamops;
40276
40277 void tmem_register_pamops(struct tmem_pamops *m)
40278 {
40279diff -urNp linux-2.6.39.1/drivers/staging/zcache/zcache.c linux-2.6.39.1/drivers/staging/zcache/zcache.c
40280--- linux-2.6.39.1/drivers/staging/zcache/zcache.c 2011-05-19 00:06:34.000000000 -0400
40281+++ linux-2.6.39.1/drivers/staging/zcache/zcache.c 2011-05-22 19:36:32.000000000 -0400
40282@@ -882,7 +882,7 @@ static void zcache_obj_free(struct tmem_
40283 kmem_cache_free(zcache_obj_cache, obj);
40284 }
40285
40286-static struct tmem_hostops zcache_hostops = {
40287+static const struct tmem_hostops zcache_hostops = {
40288 .obj_alloc = zcache_obj_alloc,
40289 .obj_free = zcache_obj_free,
40290 .objnode_alloc = zcache_objnode_alloc,
40291@@ -987,7 +987,7 @@ static void zcache_pampd_free(void *pamp
40292 }
40293 }
40294
40295-static struct tmem_pamops zcache_pamops = {
40296+static const struct tmem_pamops zcache_pamops = {
40297 .create = zcache_pampd_create,
40298 .get_data = zcache_pampd_get_data,
40299 .free = zcache_pampd_free,
40300diff -urNp linux-2.6.39.1/drivers/target/target_core_alua.c linux-2.6.39.1/drivers/target/target_core_alua.c
40301--- linux-2.6.39.1/drivers/target/target_core_alua.c 2011-05-19 00:06:34.000000000 -0400
40302+++ linux-2.6.39.1/drivers/target/target_core_alua.c 2011-05-22 19:36:32.000000000 -0400
40303@@ -675,6 +675,8 @@ static int core_alua_update_tpg_primary_
40304 char path[ALUA_METADATA_PATH_LEN];
40305 int len;
40306
40307+ pax_track_stack();
40308+
40309 memset(path, 0, ALUA_METADATA_PATH_LEN);
40310
40311 len = snprintf(md_buf, tg_pt_gp->tg_pt_gp_md_buf_len,
40312@@ -938,6 +940,8 @@ static int core_alua_update_tpg_secondar
40313 char path[ALUA_METADATA_PATH_LEN], wwn[ALUA_SECONDARY_METADATA_WWN_LEN];
40314 int len;
40315
40316+ pax_track_stack();
40317+
40318 memset(path, 0, ALUA_METADATA_PATH_LEN);
40319 memset(wwn, 0, ALUA_SECONDARY_METADATA_WWN_LEN);
40320
40321diff -urNp linux-2.6.39.1/drivers/target/target_core_cdb.c linux-2.6.39.1/drivers/target/target_core_cdb.c
40322--- linux-2.6.39.1/drivers/target/target_core_cdb.c 2011-05-19 00:06:34.000000000 -0400
40323+++ linux-2.6.39.1/drivers/target/target_core_cdb.c 2011-05-22 19:36:32.000000000 -0400
40324@@ -838,6 +838,8 @@ target_emulate_modesense(struct se_cmd *
40325 int length = 0;
40326 unsigned char buf[SE_MODE_PAGE_BUF];
40327
40328+ pax_track_stack();
40329+
40330 memset(buf, 0, SE_MODE_PAGE_BUF);
40331
40332 switch (cdb[2] & 0x3f) {
40333diff -urNp linux-2.6.39.1/drivers/target/target_core_configfs.c linux-2.6.39.1/drivers/target/target_core_configfs.c
40334--- linux-2.6.39.1/drivers/target/target_core_configfs.c 2011-05-19 00:06:34.000000000 -0400
40335+++ linux-2.6.39.1/drivers/target/target_core_configfs.c 2011-05-22 19:36:32.000000000 -0400
40336@@ -1280,6 +1280,8 @@ static ssize_t target_core_dev_pr_show_a
40337 ssize_t len = 0;
40338 int reg_count = 0, prf_isid;
40339
40340+ pax_track_stack();
40341+
40342 if (!(su_dev->se_dev_ptr))
40343 return -ENODEV;
40344
40345@@ -2682,7 +2684,7 @@ static void target_core_alua_drop_tg_pt_
40346 config_item_put(item);
40347 }
40348
40349-static struct configfs_group_operations target_core_alua_tg_pt_gps_group_ops = {
40350+static const struct configfs_group_operations target_core_alua_tg_pt_gps_group_ops = {
40351 .make_group = &target_core_alua_create_tg_pt_gp,
40352 .drop_item = &target_core_alua_drop_tg_pt_gp,
40353 };
40354@@ -2726,7 +2728,7 @@ static void target_core_stat_rmdir(
40355 return;
40356 }
40357
40358-static struct configfs_group_operations target_core_stat_group_ops = {
40359+static const struct configfs_group_operations target_core_stat_group_ops = {
40360 .make_group = &target_core_stat_mkdir,
40361 .drop_item = &target_core_stat_rmdir,
40362 };
40363@@ -2939,7 +2941,7 @@ static void target_core_drop_subdev(
40364 mutex_unlock(&hba->hba_access_mutex);
40365 }
40366
40367-static struct configfs_group_operations target_core_hba_group_ops = {
40368+static const struct configfs_group_operations target_core_hba_group_ops = {
40369 .make_group = target_core_make_subdev,
40370 .drop_item = target_core_drop_subdev,
40371 };
40372@@ -3117,7 +3119,7 @@ static void target_core_call_delhbafromt
40373 config_item_put(item);
40374 }
40375
40376-static struct configfs_group_operations target_core_group_ops = {
40377+static const struct configfs_group_operations target_core_group_ops = {
40378 .make_group = target_core_call_addhbatotarget,
40379 .drop_item = target_core_call_delhbafromtarget,
40380 };
40381diff -urNp linux-2.6.39.1/drivers/target/target_core_fabric_configfs.c linux-2.6.39.1/drivers/target/target_core_fabric_configfs.c
40382--- linux-2.6.39.1/drivers/target/target_core_fabric_configfs.c 2011-05-19 00:06:34.000000000 -0400
40383+++ linux-2.6.39.1/drivers/target/target_core_fabric_configfs.c 2011-05-22 19:36:32.000000000 -0400
40384@@ -1174,7 +1174,7 @@ static void target_fabric_drop_wwn(
40385 config_item_put(item);
40386 }
40387
40388-static struct configfs_group_operations target_fabric_wwn_group_ops = {
40389+static const struct configfs_group_operations target_fabric_wwn_group_ops = {
40390 .make_group = target_fabric_make_wwn,
40391 .drop_item = target_fabric_drop_wwn,
40392 };
40393diff -urNp linux-2.6.39.1/drivers/target/target_core_pr.c linux-2.6.39.1/drivers/target/target_core_pr.c
40394--- linux-2.6.39.1/drivers/target/target_core_pr.c 2011-05-19 00:06:34.000000000 -0400
40395+++ linux-2.6.39.1/drivers/target/target_core_pr.c 2011-05-22 19:36:32.000000000 -0400
40396@@ -918,6 +918,8 @@ static int __core_scsi3_check_aptpl_regi
40397 unsigned char t_port[PR_APTPL_MAX_TPORT_LEN];
40398 u16 tpgt;
40399
40400+ pax_track_stack();
40401+
40402 memset(i_port, 0, PR_APTPL_MAX_IPORT_LEN);
40403 memset(t_port, 0, PR_APTPL_MAX_TPORT_LEN);
40404 /*
40405@@ -1861,6 +1863,8 @@ static int __core_scsi3_update_aptpl_buf
40406 ssize_t len = 0;
40407 int reg_count = 0;
40408
40409+ pax_track_stack();
40410+
40411 memset(buf, 0, pr_aptpl_buf_len);
40412 /*
40413 * Called to clear metadata once APTPL has been deactivated.
40414@@ -1983,6 +1987,8 @@ static int __core_scsi3_write_aptpl_to_f
40415 char path[512];
40416 int ret;
40417
40418+ pax_track_stack();
40419+
40420 memset(iov, 0, sizeof(struct iovec));
40421 memset(path, 0, 512);
40422
40423diff -urNp linux-2.6.39.1/drivers/target/target_core_tmr.c linux-2.6.39.1/drivers/target/target_core_tmr.c
40424--- linux-2.6.39.1/drivers/target/target_core_tmr.c 2011-06-03 00:04:14.000000000 -0400
40425+++ linux-2.6.39.1/drivers/target/target_core_tmr.c 2011-06-03 00:32:07.000000000 -0400
40426@@ -263,7 +263,7 @@ int core_tmr_lun_reset(
40427 CMD_TFO(cmd)->get_task_tag(cmd), cmd->pr_res_key,
40428 T_TASK(cmd)->t_task_cdbs,
40429 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
40430- atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
40431+ atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
40432 atomic_read(&T_TASK(cmd)->t_transport_active),
40433 atomic_read(&T_TASK(cmd)->t_transport_stop),
40434 atomic_read(&T_TASK(cmd)->t_transport_sent));
40435@@ -305,7 +305,7 @@ int core_tmr_lun_reset(
40436 DEBUG_LR("LUN_RESET: got t_transport_active = 1 for"
40437 " task: %p, t_fe_count: %d dev: %p\n", task,
40438 fe_count, dev);
40439- atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
40440+ atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1);
40441 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
40442 flags);
40443 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
40444@@ -315,7 +315,7 @@ int core_tmr_lun_reset(
40445 }
40446 DEBUG_LR("LUN_RESET: Got t_transport_active = 0 for task: %p,"
40447 " t_fe_count: %d dev: %p\n", task, fe_count, dev);
40448- atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
40449+ atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1);
40450 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
40451 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
40452
40453diff -urNp linux-2.6.39.1/drivers/target/target_core_transport.c linux-2.6.39.1/drivers/target/target_core_transport.c
40454--- linux-2.6.39.1/drivers/target/target_core_transport.c 2011-06-03 00:04:14.000000000 -0400
40455+++ linux-2.6.39.1/drivers/target/target_core_transport.c 2011-06-03 00:32:07.000000000 -0400
40456@@ -1681,7 +1681,7 @@ struct se_device *transport_add_device_t
40457
40458 dev->queue_depth = dev_limits->queue_depth;
40459 atomic_set(&dev->depth_left, dev->queue_depth);
40460- atomic_set(&dev->dev_ordered_id, 0);
40461+ atomic_set_unchecked(&dev->dev_ordered_id, 0);
40462
40463 se_dev_set_default_attribs(dev, dev_limits);
40464
40465@@ -1882,7 +1882,7 @@ static int transport_check_alloc_task_at
40466 * Used to determine when ORDERED commands should go from
40467 * Dormant to Active status.
40468 */
40469- cmd->se_ordered_id = atomic_inc_return(&SE_DEV(cmd)->dev_ordered_id);
40470+ cmd->se_ordered_id = atomic_inc_return_unchecked(&SE_DEV(cmd)->dev_ordered_id);
40471 smp_mb__after_atomic_inc();
40472 DEBUG_STA("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
40473 cmd->se_ordered_id, cmd->sam_task_attr,
40474@@ -2169,7 +2169,7 @@ static void transport_generic_request_fa
40475 " t_transport_active: %d t_transport_stop: %d"
40476 " t_transport_sent: %d\n", T_TASK(cmd)->t_task_cdbs,
40477 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
40478- atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
40479+ atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
40480 atomic_read(&T_TASK(cmd)->t_task_cdbs_ex_left),
40481 atomic_read(&T_TASK(cmd)->t_transport_active),
40482 atomic_read(&T_TASK(cmd)->t_transport_stop),
40483@@ -2673,9 +2673,9 @@ check_depth:
40484 spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
40485 atomic_set(&task->task_active, 1);
40486 atomic_set(&task->task_sent, 1);
40487- atomic_inc(&T_TASK(cmd)->t_task_cdbs_sent);
40488+ atomic_inc_unchecked(&T_TASK(cmd)->t_task_cdbs_sent);
40489
40490- if (atomic_read(&T_TASK(cmd)->t_task_cdbs_sent) ==
40491+ if (atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent) ==
40492 T_TASK(cmd)->t_task_cdbs)
40493 atomic_set(&cmd->transport_sent, 1);
40494
40495@@ -5568,7 +5568,7 @@ static void transport_generic_wait_for_t
40496 atomic_set(&T_TASK(cmd)->transport_lun_stop, 0);
40497 }
40498 if (!atomic_read(&T_TASK(cmd)->t_transport_active) ||
40499- atomic_read(&T_TASK(cmd)->t_transport_aborted))
40500+ atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted))
40501 goto remove;
40502
40503 atomic_set(&T_TASK(cmd)->t_transport_stop, 1);
40504@@ -5797,7 +5797,7 @@ int transport_check_aborted_status(struc
40505 {
40506 int ret = 0;
40507
40508- if (atomic_read(&T_TASK(cmd)->t_transport_aborted) != 0) {
40509+ if (atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted) != 0) {
40510 if (!(send_status) ||
40511 (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS))
40512 return 1;
40513@@ -5825,7 +5825,7 @@ void transport_send_task_abort(struct se
40514 */
40515 if (cmd->data_direction == DMA_TO_DEVICE) {
40516 if (CMD_TFO(cmd)->write_pending_status(cmd) != 0) {
40517- atomic_inc(&T_TASK(cmd)->t_transport_aborted);
40518+ atomic_inc_unchecked(&T_TASK(cmd)->t_transport_aborted);
40519 smp_mb__after_atomic_inc();
40520 cmd->scsi_status = SAM_STAT_TASK_ABORTED;
40521 transport_new_cmd_failure(cmd);
40522@@ -5949,7 +5949,7 @@ static void transport_processing_shutdow
40523 CMD_TFO(cmd)->get_task_tag(cmd),
40524 T_TASK(cmd)->t_task_cdbs,
40525 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
40526- atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
40527+ atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
40528 atomic_read(&T_TASK(cmd)->t_transport_active),
40529 atomic_read(&T_TASK(cmd)->t_transport_stop),
40530 atomic_read(&T_TASK(cmd)->t_transport_sent));
40531diff -urNp linux-2.6.39.1/drivers/telephony/ixj.c linux-2.6.39.1/drivers/telephony/ixj.c
40532--- linux-2.6.39.1/drivers/telephony/ixj.c 2011-05-19 00:06:34.000000000 -0400
40533+++ linux-2.6.39.1/drivers/telephony/ixj.c 2011-05-22 19:36:32.000000000 -0400
40534@@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
40535 bool mContinue;
40536 char *pIn, *pOut;
40537
40538+ pax_track_stack();
40539+
40540 if (!SCI_Prepare(j))
40541 return 0;
40542
40543diff -urNp linux-2.6.39.1/drivers/tty/hvc/hvc_console.h linux-2.6.39.1/drivers/tty/hvc/hvc_console.h
40544--- linux-2.6.39.1/drivers/tty/hvc/hvc_console.h 2011-05-19 00:06:34.000000000 -0400
40545+++ linux-2.6.39.1/drivers/tty/hvc/hvc_console.h 2011-05-22 19:36:32.000000000 -0400
40546@@ -82,6 +82,7 @@ extern int hvc_instantiate(uint32_t vter
40547 /* register a vterm for hvc tty operation (module_init or hotplug add) */
40548 extern struct hvc_struct * hvc_alloc(uint32_t vtermno, int data,
40549 const struct hv_ops *ops, int outbuf_size);
40550+
40551 /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
40552 extern int hvc_remove(struct hvc_struct *hp);
40553
40554diff -urNp linux-2.6.39.1/drivers/tty/hvc/hvc_iucv.c linux-2.6.39.1/drivers/tty/hvc/hvc_iucv.c
40555--- linux-2.6.39.1/drivers/tty/hvc/hvc_iucv.c 2011-05-19 00:06:34.000000000 -0400
40556+++ linux-2.6.39.1/drivers/tty/hvc/hvc_iucv.c 2011-05-22 19:36:32.000000000 -0400
40557@@ -1203,7 +1203,7 @@ static int param_get_vmidfilter(char *bu
40558
40559 #define param_check_vmidfilter(name, p) __param_check(name, p, void)
40560
40561-static struct kernel_param_ops param_ops_vmidfilter = {
40562+static const struct kernel_param_ops param_ops_vmidfilter = {
40563 .set = param_set_vmidfilter,
40564 .get = param_get_vmidfilter,
40565 };
40566diff -urNp linux-2.6.39.1/drivers/tty/hvc/hvcs.c linux-2.6.39.1/drivers/tty/hvc/hvcs.c
40567--- linux-2.6.39.1/drivers/tty/hvc/hvcs.c 2011-05-19 00:06:34.000000000 -0400
40568+++ linux-2.6.39.1/drivers/tty/hvc/hvcs.c 2011-05-22 19:36:32.000000000 -0400
40569@@ -83,6 +83,7 @@
40570 #include <asm/hvcserver.h>
40571 #include <asm/uaccess.h>
40572 #include <asm/vio.h>
40573+#include <asm/local.h>
40574
40575 /*
40576 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
40577@@ -270,7 +271,7 @@ struct hvcs_struct {
40578 unsigned int index;
40579
40580 struct tty_struct *tty;
40581- int open_count;
40582+ local_t open_count;
40583
40584 /*
40585 * Used to tell the driver kernel_thread what operations need to take
40586@@ -422,7 +423,7 @@ static ssize_t hvcs_vterm_state_store(st
40587
40588 spin_lock_irqsave(&hvcsd->lock, flags);
40589
40590- if (hvcsd->open_count > 0) {
40591+ if (local_read(&hvcsd->open_count) > 0) {
40592 spin_unlock_irqrestore(&hvcsd->lock, flags);
40593 printk(KERN_INFO "HVCS: vterm state unchanged. "
40594 "The hvcs device node is still in use.\n");
40595@@ -1145,7 +1146,7 @@ static int hvcs_open(struct tty_struct *
40596 if ((retval = hvcs_partner_connect(hvcsd)))
40597 goto error_release;
40598
40599- hvcsd->open_count = 1;
40600+ local_set(&hvcsd->open_count, 1);
40601 hvcsd->tty = tty;
40602 tty->driver_data = hvcsd;
40603
40604@@ -1179,7 +1180,7 @@ fast_open:
40605
40606 spin_lock_irqsave(&hvcsd->lock, flags);
40607 kref_get(&hvcsd->kref);
40608- hvcsd->open_count++;
40609+ local_inc(&hvcsd->open_count);
40610 hvcsd->todo_mask |= HVCS_SCHED_READ;
40611 spin_unlock_irqrestore(&hvcsd->lock, flags);
40612
40613@@ -1223,7 +1224,7 @@ static void hvcs_close(struct tty_struct
40614 hvcsd = tty->driver_data;
40615
40616 spin_lock_irqsave(&hvcsd->lock, flags);
40617- if (--hvcsd->open_count == 0) {
40618+ if (local_dec_and_test(&hvcsd->open_count)) {
40619
40620 vio_disable_interrupts(hvcsd->vdev);
40621
40622@@ -1249,10 +1250,10 @@ static void hvcs_close(struct tty_struct
40623 free_irq(irq, hvcsd);
40624 kref_put(&hvcsd->kref, destroy_hvcs_struct);
40625 return;
40626- } else if (hvcsd->open_count < 0) {
40627+ } else if (local_read(&hvcsd->open_count) < 0) {
40628 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
40629 " is missmanaged.\n",
40630- hvcsd->vdev->unit_address, hvcsd->open_count);
40631+ hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
40632 }
40633
40634 spin_unlock_irqrestore(&hvcsd->lock, flags);
40635@@ -1268,7 +1269,7 @@ static void hvcs_hangup(struct tty_struc
40636
40637 spin_lock_irqsave(&hvcsd->lock, flags);
40638 /* Preserve this so that we know how many kref refs to put */
40639- temp_open_count = hvcsd->open_count;
40640+ temp_open_count = local_read(&hvcsd->open_count);
40641
40642 /*
40643 * Don't kref put inside the spinlock because the destruction
40644@@ -1283,7 +1284,7 @@ static void hvcs_hangup(struct tty_struc
40645 hvcsd->tty->driver_data = NULL;
40646 hvcsd->tty = NULL;
40647
40648- hvcsd->open_count = 0;
40649+ local_set(&hvcsd->open_count, 0);
40650
40651 /* This will drop any buffered data on the floor which is OK in a hangup
40652 * scenario. */
40653@@ -1354,7 +1355,7 @@ static int hvcs_write(struct tty_struct
40654 * the middle of a write operation? This is a crummy place to do this
40655 * but we want to keep it all in the spinlock.
40656 */
40657- if (hvcsd->open_count <= 0) {
40658+ if (local_read(&hvcsd->open_count) <= 0) {
40659 spin_unlock_irqrestore(&hvcsd->lock, flags);
40660 return -ENODEV;
40661 }
40662@@ -1428,7 +1429,7 @@ static int hvcs_write_room(struct tty_st
40663 {
40664 struct hvcs_struct *hvcsd = tty->driver_data;
40665
40666- if (!hvcsd || hvcsd->open_count <= 0)
40667+ if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
40668 return 0;
40669
40670 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
40671diff -urNp linux-2.6.39.1/drivers/tty/hvc/hvc_xen.c linux-2.6.39.1/drivers/tty/hvc/hvc_xen.c
40672--- linux-2.6.39.1/drivers/tty/hvc/hvc_xen.c 2011-05-19 00:06:34.000000000 -0400
40673+++ linux-2.6.39.1/drivers/tty/hvc/hvc_xen.c 2011-05-22 19:36:32.000000000 -0400
40674@@ -123,7 +123,7 @@ static int domU_read_console(uint32_t vt
40675 return recv;
40676 }
40677
40678-static struct hv_ops domU_hvc_ops = {
40679+static const struct hv_ops domU_hvc_ops = {
40680 .get_chars = domU_read_console,
40681 .put_chars = domU_write_console,
40682 .notifier_add = notifier_add_irq,
40683@@ -149,7 +149,7 @@ static int dom0_write_console(uint32_t v
40684 return len;
40685 }
40686
40687-static struct hv_ops dom0_hvc_ops = {
40688+static const struct hv_ops dom0_hvc_ops = {
40689 .get_chars = dom0_read_console,
40690 .put_chars = dom0_write_console,
40691 .notifier_add = notifier_add_irq,
40692@@ -160,7 +160,7 @@ static struct hv_ops dom0_hvc_ops = {
40693 static int __init xen_hvc_init(void)
40694 {
40695 struct hvc_struct *hp;
40696- struct hv_ops *ops;
40697+ const struct hv_ops *ops;
40698
40699 if (!xen_pv_domain())
40700 return -ENODEV;
40701@@ -205,7 +205,7 @@ static void __exit xen_hvc_fini(void)
40702
40703 static int xen_cons_init(void)
40704 {
40705- struct hv_ops *ops;
40706+ const struct hv_ops *ops;
40707
40708 if (!xen_pv_domain())
40709 return 0;
40710diff -urNp linux-2.6.39.1/drivers/tty/ipwireless/tty.c linux-2.6.39.1/drivers/tty/ipwireless/tty.c
40711--- linux-2.6.39.1/drivers/tty/ipwireless/tty.c 2011-05-19 00:06:34.000000000 -0400
40712+++ linux-2.6.39.1/drivers/tty/ipwireless/tty.c 2011-05-22 19:36:32.000000000 -0400
40713@@ -29,6 +29,7 @@
40714 #include <linux/tty_driver.h>
40715 #include <linux/tty_flip.h>
40716 #include <linux/uaccess.h>
40717+#include <asm/local.h>
40718
40719 #include "tty.h"
40720 #include "network.h"
40721@@ -51,7 +52,7 @@ struct ipw_tty {
40722 int tty_type;
40723 struct ipw_network *network;
40724 struct tty_struct *linux_tty;
40725- int open_count;
40726+ local_t open_count;
40727 unsigned int control_lines;
40728 struct mutex ipw_tty_mutex;
40729 int tx_bytes_queued;
40730@@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *l
40731 mutex_unlock(&tty->ipw_tty_mutex);
40732 return -ENODEV;
40733 }
40734- if (tty->open_count == 0)
40735+ if (local_read(&tty->open_count) == 0)
40736 tty->tx_bytes_queued = 0;
40737
40738- tty->open_count++;
40739+ local_inc(&tty->open_count);
40740
40741 tty->linux_tty = linux_tty;
40742 linux_tty->driver_data = tty;
40743@@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *l
40744
40745 static void do_ipw_close(struct ipw_tty *tty)
40746 {
40747- tty->open_count--;
40748-
40749- if (tty->open_count == 0) {
40750+ if (local_dec_return(&tty->open_count) == 0) {
40751 struct tty_struct *linux_tty = tty->linux_tty;
40752
40753 if (linux_tty != NULL) {
40754@@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct
40755 return;
40756
40757 mutex_lock(&tty->ipw_tty_mutex);
40758- if (tty->open_count == 0) {
40759+ if (local_read(&tty->open_count) == 0) {
40760 mutex_unlock(&tty->ipw_tty_mutex);
40761 return;
40762 }
40763@@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_
40764 return;
40765 }
40766
40767- if (!tty->open_count) {
40768+ if (!local_read(&tty->open_count)) {
40769 mutex_unlock(&tty->ipw_tty_mutex);
40770 return;
40771 }
40772@@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *
40773 return -ENODEV;
40774
40775 mutex_lock(&tty->ipw_tty_mutex);
40776- if (!tty->open_count) {
40777+ if (!local_read(&tty->open_count)) {
40778 mutex_unlock(&tty->ipw_tty_mutex);
40779 return -EINVAL;
40780 }
40781@@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_str
40782 if (!tty)
40783 return -ENODEV;
40784
40785- if (!tty->open_count)
40786+ if (!local_read(&tty->open_count))
40787 return -EINVAL;
40788
40789 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
40790@@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tt
40791 if (!tty)
40792 return 0;
40793
40794- if (!tty->open_count)
40795+ if (!local_read(&tty->open_count))
40796 return 0;
40797
40798 return tty->tx_bytes_queued;
40799@@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struc
40800 if (!tty)
40801 return -ENODEV;
40802
40803- if (!tty->open_count)
40804+ if (!local_read(&tty->open_count))
40805 return -EINVAL;
40806
40807 return get_control_lines(tty);
40808@@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
40809 if (!tty)
40810 return -ENODEV;
40811
40812- if (!tty->open_count)
40813+ if (!local_read(&tty->open_count))
40814 return -EINVAL;
40815
40816 return set_control_lines(tty, set, clear);
40817@@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *
40818 if (!tty)
40819 return -ENODEV;
40820
40821- if (!tty->open_count)
40822+ if (!local_read(&tty->open_count))
40823 return -EINVAL;
40824
40825 /* FIXME: Exactly how is the tty object locked here .. */
40826@@ -582,7 +581,7 @@ void ipwireless_tty_free(struct ipw_tty
40827 against a parallel ioctl etc */
40828 mutex_lock(&ttyj->ipw_tty_mutex);
40829 }
40830- while (ttyj->open_count)
40831+ while (local_read(&ttyj->open_count))
40832 do_ipw_close(ttyj);
40833 ipwireless_disassociate_network_ttys(network,
40834 ttyj->channel_idx);
40835diff -urNp linux-2.6.39.1/drivers/tty/mxser.c linux-2.6.39.1/drivers/tty/mxser.c
40836--- linux-2.6.39.1/drivers/tty/mxser.c 2011-05-19 00:06:34.000000000 -0400
40837+++ linux-2.6.39.1/drivers/tty/mxser.c 2011-05-22 19:36:32.000000000 -0400
40838@@ -2340,7 +2340,7 @@ static const struct tty_operations mxser
40839 .get_icount = mxser_get_icount,
40840 };
40841
40842-struct tty_port_operations mxser_port_ops = {
40843+const struct tty_port_operations mxser_port_ops = {
40844 .carrier_raised = mxser_carrier_raised,
40845 .dtr_rts = mxser_dtr_rts,
40846 .activate = mxser_activate,
40847diff -urNp linux-2.6.39.1/drivers/tty/n_gsm.c linux-2.6.39.1/drivers/tty/n_gsm.c
40848--- linux-2.6.39.1/drivers/tty/n_gsm.c 2011-05-19 00:06:34.000000000 -0400
40849+++ linux-2.6.39.1/drivers/tty/n_gsm.c 2011-05-22 19:36:32.000000000 -0400
40850@@ -1588,7 +1588,7 @@ static struct gsm_dlci *gsm_dlci_alloc(s
40851 return NULL;
40852 spin_lock_init(&dlci->lock);
40853 dlci->fifo = &dlci->_fifo;
40854- if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL) < 0) {
40855+ if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL)) {
40856 kfree(dlci);
40857 return NULL;
40858 }
40859diff -urNp linux-2.6.39.1/drivers/tty/n_tty.c linux-2.6.39.1/drivers/tty/n_tty.c
40860--- linux-2.6.39.1/drivers/tty/n_tty.c 2011-05-19 00:06:34.000000000 -0400
40861+++ linux-2.6.39.1/drivers/tty/n_tty.c 2011-05-22 19:36:32.000000000 -0400
40862@@ -2122,6 +2122,7 @@ void n_tty_inherit_ops(struct tty_ldisc_
40863 {
40864 *ops = tty_ldisc_N_TTY;
40865 ops->owner = NULL;
40866- ops->refcount = ops->flags = 0;
40867+ atomic_set(&ops->refcount, 0);
40868+ ops->flags = 0;
40869 }
40870 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
40871diff -urNp linux-2.6.39.1/drivers/tty/pty.c linux-2.6.39.1/drivers/tty/pty.c
40872--- linux-2.6.39.1/drivers/tty/pty.c 2011-05-19 00:06:34.000000000 -0400
40873+++ linux-2.6.39.1/drivers/tty/pty.c 2011-05-22 19:36:32.000000000 -0400
40874@@ -699,7 +699,18 @@ out:
40875 return retval;
40876 }
40877
40878-static struct file_operations ptmx_fops;
40879+static const struct file_operations ptmx_fops = {
40880+ .llseek = no_llseek,
40881+ .read = tty_read,
40882+ .write = tty_write,
40883+ .poll = tty_poll,
40884+ .unlocked_ioctl = tty_ioctl,
40885+ .compat_ioctl = tty_compat_ioctl,
40886+ .open = ptmx_open,
40887+ .release = tty_release,
40888+ .fasync = tty_fasync,
40889+};
40890+
40891
40892 static void __init unix98_pty_init(void)
40893 {
40894@@ -752,10 +763,6 @@ static void __init unix98_pty_init(void)
40895
40896 register_sysctl_table(pty_root_table);
40897
40898- /* Now create the /dev/ptmx special device */
40899- tty_default_fops(&ptmx_fops);
40900- ptmx_fops.open = ptmx_open;
40901-
40902 cdev_init(&ptmx_cdev, &ptmx_fops);
40903 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
40904 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
40905diff -urNp linux-2.6.39.1/drivers/tty/rocket.c linux-2.6.39.1/drivers/tty/rocket.c
40906--- linux-2.6.39.1/drivers/tty/rocket.c 2011-05-19 00:06:34.000000000 -0400
40907+++ linux-2.6.39.1/drivers/tty/rocket.c 2011-05-22 19:36:32.000000000 -0400
40908@@ -1277,6 +1277,8 @@ static int get_ports(struct r_port *info
40909 struct rocket_ports tmp;
40910 int board;
40911
40912+ pax_track_stack();
40913+
40914 if (!retports)
40915 return -EFAULT;
40916 memset(&tmp, 0, sizeof (tmp));
40917diff -urNp linux-2.6.39.1/drivers/tty/serial/21285.c linux-2.6.39.1/drivers/tty/serial/21285.c
40918--- linux-2.6.39.1/drivers/tty/serial/21285.c 2011-05-19 00:06:34.000000000 -0400
40919+++ linux-2.6.39.1/drivers/tty/serial/21285.c 2011-05-22 19:36:32.000000000 -0400
40920@@ -340,7 +340,7 @@ static int serial21285_verify_port(struc
40921 return ret;
40922 }
40923
40924-static struct uart_ops serial21285_ops = {
40925+static const struct uart_ops serial21285_ops = {
40926 .tx_empty = serial21285_tx_empty,
40927 .get_mctrl = serial21285_get_mctrl,
40928 .set_mctrl = serial21285_set_mctrl,
40929diff -urNp linux-2.6.39.1/drivers/tty/serial/8250.c linux-2.6.39.1/drivers/tty/serial/8250.c
40930--- linux-2.6.39.1/drivers/tty/serial/8250.c 2011-05-19 00:06:34.000000000 -0400
40931+++ linux-2.6.39.1/drivers/tty/serial/8250.c 2011-05-22 19:36:32.000000000 -0400
40932@@ -2708,7 +2708,7 @@ serial8250_type(struct uart_port *port)
40933 return uart_config[type].name;
40934 }
40935
40936-static struct uart_ops serial8250_pops = {
40937+static const struct uart_ops serial8250_pops = {
40938 .tx_empty = serial8250_tx_empty,
40939 .set_mctrl = serial8250_set_mctrl,
40940 .get_mctrl = serial8250_get_mctrl,
40941diff -urNp linux-2.6.39.1/drivers/tty/serial/altera_jtaguart.c linux-2.6.39.1/drivers/tty/serial/altera_jtaguart.c
40942--- linux-2.6.39.1/drivers/tty/serial/altera_jtaguart.c 2011-05-19 00:06:34.000000000 -0400
40943+++ linux-2.6.39.1/drivers/tty/serial/altera_jtaguart.c 2011-05-22 19:36:32.000000000 -0400
40944@@ -281,7 +281,7 @@ static int altera_jtaguart_verify_port(s
40945 /*
40946 * Define the basic serial functions we support.
40947 */
40948-static struct uart_ops altera_jtaguart_ops = {
40949+static const struct uart_ops altera_jtaguart_ops = {
40950 .tx_empty = altera_jtaguart_tx_empty,
40951 .get_mctrl = altera_jtaguart_get_mctrl,
40952 .set_mctrl = altera_jtaguart_set_mctrl,
40953diff -urNp linux-2.6.39.1/drivers/tty/serial/altera_uart.c linux-2.6.39.1/drivers/tty/serial/altera_uart.c
40954--- linux-2.6.39.1/drivers/tty/serial/altera_uart.c 2011-05-19 00:06:34.000000000 -0400
40955+++ linux-2.6.39.1/drivers/tty/serial/altera_uart.c 2011-05-22 19:36:32.000000000 -0400
40956@@ -380,7 +380,7 @@ static int altera_uart_verify_port(struc
40957 /*
40958 * Define the basic serial functions we support.
40959 */
40960-static struct uart_ops altera_uart_ops = {
40961+static const struct uart_ops altera_uart_ops = {
40962 .tx_empty = altera_uart_tx_empty,
40963 .get_mctrl = altera_uart_get_mctrl,
40964 .set_mctrl = altera_uart_set_mctrl,
40965diff -urNp linux-2.6.39.1/drivers/tty/serial/amba-pl010.c linux-2.6.39.1/drivers/tty/serial/amba-pl010.c
40966--- linux-2.6.39.1/drivers/tty/serial/amba-pl010.c 2011-05-19 00:06:34.000000000 -0400
40967+++ linux-2.6.39.1/drivers/tty/serial/amba-pl010.c 2011-05-22 19:36:32.000000000 -0400
40968@@ -529,7 +529,7 @@ static int pl010_verify_port(struct uart
40969 return ret;
40970 }
40971
40972-static struct uart_ops amba_pl010_pops = {
40973+static const struct uart_ops amba_pl010_pops = {
40974 .tx_empty = pl010_tx_empty,
40975 .set_mctrl = pl010_set_mctrl,
40976 .get_mctrl = pl010_get_mctrl,
40977diff -urNp linux-2.6.39.1/drivers/tty/serial/amba-pl011.c linux-2.6.39.1/drivers/tty/serial/amba-pl011.c
40978--- linux-2.6.39.1/drivers/tty/serial/amba-pl011.c 2011-05-19 00:06:34.000000000 -0400
40979+++ linux-2.6.39.1/drivers/tty/serial/amba-pl011.c 2011-05-22 19:36:32.000000000 -0400
40980@@ -1581,7 +1581,7 @@ static int pl010_verify_port(struct uart
40981 return ret;
40982 }
40983
40984-static struct uart_ops amba_pl011_pops = {
40985+static const struct uart_ops amba_pl011_pops = {
40986 .tx_empty = pl01x_tx_empty,
40987 .set_mctrl = pl011_set_mctrl,
40988 .get_mctrl = pl01x_get_mctrl,
40989diff -urNp linux-2.6.39.1/drivers/tty/serial/apbuart.c linux-2.6.39.1/drivers/tty/serial/apbuart.c
40990--- linux-2.6.39.1/drivers/tty/serial/apbuart.c 2011-05-19 00:06:34.000000000 -0400
40991+++ linux-2.6.39.1/drivers/tty/serial/apbuart.c 2011-05-22 19:36:32.000000000 -0400
40992@@ -328,7 +328,7 @@ static int apbuart_verify_port(struct ua
40993 return ret;
40994 }
40995
40996-static struct uart_ops grlib_apbuart_ops = {
40997+static const struct uart_ops grlib_apbuart_ops = {
40998 .tx_empty = apbuart_tx_empty,
40999 .set_mctrl = apbuart_set_mctrl,
41000 .get_mctrl = apbuart_get_mctrl,
41001diff -urNp linux-2.6.39.1/drivers/tty/serial/atmel_serial.c linux-2.6.39.1/drivers/tty/serial/atmel_serial.c
41002--- linux-2.6.39.1/drivers/tty/serial/atmel_serial.c 2011-05-19 00:06:34.000000000 -0400
41003+++ linux-2.6.39.1/drivers/tty/serial/atmel_serial.c 2011-05-22 19:36:32.000000000 -0400
41004@@ -1382,7 +1382,7 @@ atmel_ioctl(struct uart_port *port, unsi
41005
41006
41007
41008-static struct uart_ops atmel_pops = {
41009+static const struct uart_ops atmel_pops = {
41010 .tx_empty = atmel_tx_empty,
41011 .set_mctrl = atmel_set_mctrl,
41012 .get_mctrl = atmel_get_mctrl,
41013diff -urNp linux-2.6.39.1/drivers/tty/serial/bcm63xx_uart.c linux-2.6.39.1/drivers/tty/serial/bcm63xx_uart.c
41014--- linux-2.6.39.1/drivers/tty/serial/bcm63xx_uart.c 2011-05-19 00:06:34.000000000 -0400
41015+++ linux-2.6.39.1/drivers/tty/serial/bcm63xx_uart.c 2011-05-22 19:36:32.000000000 -0400
41016@@ -636,7 +636,7 @@ static int bcm_uart_verify_port(struct u
41017 }
41018
41019 /* serial core callbacks */
41020-static struct uart_ops bcm_uart_ops = {
41021+static const struct uart_ops bcm_uart_ops = {
41022 .tx_empty = bcm_uart_tx_empty,
41023 .get_mctrl = bcm_uart_get_mctrl,
41024 .set_mctrl = bcm_uart_set_mctrl,
41025diff -urNp linux-2.6.39.1/drivers/tty/serial/bfin_5xx.c linux-2.6.39.1/drivers/tty/serial/bfin_5xx.c
41026--- linux-2.6.39.1/drivers/tty/serial/bfin_5xx.c 2011-05-19 00:06:34.000000000 -0400
41027+++ linux-2.6.39.1/drivers/tty/serial/bfin_5xx.c 2011-05-22 19:36:32.000000000 -0400
41028@@ -1036,7 +1036,7 @@ static int bfin_kgdboc_port_startup(stru
41029 }
41030 #endif
41031
41032-static struct uart_ops bfin_serial_pops = {
41033+static const struct uart_ops bfin_serial_pops = {
41034 .tx_empty = bfin_serial_tx_empty,
41035 .set_mctrl = bfin_serial_set_mctrl,
41036 .get_mctrl = bfin_serial_get_mctrl,
41037diff -urNp linux-2.6.39.1/drivers/tty/serial/bfin_sport_uart.c linux-2.6.39.1/drivers/tty/serial/bfin_sport_uart.c
41038--- linux-2.6.39.1/drivers/tty/serial/bfin_sport_uart.c 2011-05-19 00:06:34.000000000 -0400
41039+++ linux-2.6.39.1/drivers/tty/serial/bfin_sport_uart.c 2011-05-22 19:36:32.000000000 -0400
41040@@ -571,7 +571,7 @@ static void sport_set_termios(struct uar
41041 spin_unlock_irqrestore(&up->port.lock, flags);
41042 }
41043
41044-struct uart_ops sport_uart_ops = {
41045+const struct uart_ops sport_uart_ops = {
41046 .tx_empty = sport_tx_empty,
41047 .set_mctrl = sport_set_mctrl,
41048 .get_mctrl = sport_get_mctrl,
41049diff -urNp linux-2.6.39.1/drivers/tty/serial/clps711x.c linux-2.6.39.1/drivers/tty/serial/clps711x.c
41050--- linux-2.6.39.1/drivers/tty/serial/clps711x.c 2011-05-19 00:06:34.000000000 -0400
41051+++ linux-2.6.39.1/drivers/tty/serial/clps711x.c 2011-05-22 19:36:32.000000000 -0400
41052@@ -380,7 +380,7 @@ static int clps711xuart_request_port(str
41053 return 0;
41054 }
41055
41056-static struct uart_ops clps711x_pops = {
41057+static const struct uart_ops clps711x_pops = {
41058 .tx_empty = clps711xuart_tx_empty,
41059 .set_mctrl = clps711xuart_set_mctrl_null,
41060 .get_mctrl = clps711xuart_get_mctrl,
41061diff -urNp linux-2.6.39.1/drivers/tty/serial/cpm_uart/cpm_uart_core.c linux-2.6.39.1/drivers/tty/serial/cpm_uart/cpm_uart_core.c
41062--- linux-2.6.39.1/drivers/tty/serial/cpm_uart/cpm_uart_core.c 2011-05-19 00:06:34.000000000 -0400
41063+++ linux-2.6.39.1/drivers/tty/serial/cpm_uart/cpm_uart_core.c 2011-05-22 19:36:32.000000000 -0400
41064@@ -1099,7 +1099,7 @@ static void cpm_put_poll_char(struct uar
41065 }
41066 #endif /* CONFIG_CONSOLE_POLL */
41067
41068-static struct uart_ops cpm_uart_pops = {
41069+static const struct uart_ops cpm_uart_pops = {
41070 .tx_empty = cpm_uart_tx_empty,
41071 .set_mctrl = cpm_uart_set_mctrl,
41072 .get_mctrl = cpm_uart_get_mctrl,
41073diff -urNp linux-2.6.39.1/drivers/tty/serial/dz.c linux-2.6.39.1/drivers/tty/serial/dz.c
41074--- linux-2.6.39.1/drivers/tty/serial/dz.c 2011-05-19 00:06:34.000000000 -0400
41075+++ linux-2.6.39.1/drivers/tty/serial/dz.c 2011-05-22 19:36:32.000000000 -0400
41076@@ -746,7 +746,7 @@ static int dz_verify_port(struct uart_po
41077 return ret;
41078 }
41079
41080-static struct uart_ops dz_ops = {
41081+static const struct uart_ops dz_ops = {
41082 .tx_empty = dz_tx_empty,
41083 .get_mctrl = dz_get_mctrl,
41084 .set_mctrl = dz_set_mctrl,
41085diff -urNp linux-2.6.39.1/drivers/tty/serial/imx.c linux-2.6.39.1/drivers/tty/serial/imx.c
41086--- linux-2.6.39.1/drivers/tty/serial/imx.c 2011-05-19 00:06:34.000000000 -0400
41087+++ linux-2.6.39.1/drivers/tty/serial/imx.c 2011-05-22 19:36:32.000000000 -0400
41088@@ -1018,7 +1018,7 @@ imx_verify_port(struct uart_port *port,
41089 return ret;
41090 }
41091
41092-static struct uart_ops imx_pops = {
41093+static const struct uart_ops imx_pops = {
41094 .tx_empty = imx_tx_empty,
41095 .set_mctrl = imx_set_mctrl,
41096 .get_mctrl = imx_get_mctrl,
41097diff -urNp linux-2.6.39.1/drivers/tty/serial/ioc3_serial.c linux-2.6.39.1/drivers/tty/serial/ioc3_serial.c
41098--- linux-2.6.39.1/drivers/tty/serial/ioc3_serial.c 2011-05-19 00:06:34.000000000 -0400
41099+++ linux-2.6.39.1/drivers/tty/serial/ioc3_serial.c 2011-05-22 19:36:32.000000000 -0400
41100@@ -1874,7 +1874,7 @@ static int ic3_request_port(struct uart_
41101 }
41102
41103 /* Associate the uart functions above - given to serial core */
41104-static struct uart_ops ioc3_ops = {
41105+static const struct uart_ops ioc3_ops = {
41106 .tx_empty = ic3_tx_empty,
41107 .set_mctrl = ic3_set_mctrl,
41108 .get_mctrl = ic3_get_mctrl,
41109diff -urNp linux-2.6.39.1/drivers/tty/serial/ioc4_serial.c linux-2.6.39.1/drivers/tty/serial/ioc4_serial.c
41110--- linux-2.6.39.1/drivers/tty/serial/ioc4_serial.c 2011-05-19 00:06:34.000000000 -0400
41111+++ linux-2.6.39.1/drivers/tty/serial/ioc4_serial.c 2011-05-22 19:36:32.000000000 -0400
41112@@ -2593,7 +2593,7 @@ static int ic4_request_port(struct uart_
41113
41114 /* Associate the uart functions above - given to serial core */
41115
41116-static struct uart_ops ioc4_ops = {
41117+static const struct uart_ops ioc4_ops = {
41118 .tx_empty = ic4_tx_empty,
41119 .set_mctrl = ic4_set_mctrl,
41120 .get_mctrl = ic4_get_mctrl,
41121diff -urNp linux-2.6.39.1/drivers/tty/serial/ip22zilog.c linux-2.6.39.1/drivers/tty/serial/ip22zilog.c
41122--- linux-2.6.39.1/drivers/tty/serial/ip22zilog.c 2011-05-19 00:06:34.000000000 -0400
41123+++ linux-2.6.39.1/drivers/tty/serial/ip22zilog.c 2011-05-22 19:36:32.000000000 -0400
41124@@ -928,7 +928,7 @@ static int ip22zilog_verify_port(struct
41125 return -EINVAL;
41126 }
41127
41128-static struct uart_ops ip22zilog_pops = {
41129+static const struct uart_ops ip22zilog_pops = {
41130 .tx_empty = ip22zilog_tx_empty,
41131 .set_mctrl = ip22zilog_set_mctrl,
41132 .get_mctrl = ip22zilog_get_mctrl,
41133diff -urNp linux-2.6.39.1/drivers/tty/serial/kgdboc.c linux-2.6.39.1/drivers/tty/serial/kgdboc.c
41134--- linux-2.6.39.1/drivers/tty/serial/kgdboc.c 2011-05-19 00:06:34.000000000 -0400
41135+++ linux-2.6.39.1/drivers/tty/serial/kgdboc.c 2011-05-22 19:36:32.000000000 -0400
41136@@ -22,7 +22,7 @@
41137
41138 #define MAX_CONFIG_LEN 40
41139
41140-static struct kgdb_io kgdboc_io_ops;
41141+static struct kgdb_io kgdboc_io_ops; /* cannot be const, see configure_kgdboc() */
41142
41143 /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
41144 static int configured = -1;
41145@@ -293,7 +293,7 @@ static void kgdboc_post_exp_handler(void
41146 kgdboc_restore_input();
41147 }
41148
41149-static struct kgdb_io kgdboc_io_ops = {
41150+static struct kgdb_io kgdboc_io_ops = { /* cannot be const, see configure_kgdboc() */
41151 .name = "kgdboc",
41152 .read_char = kgdboc_get_char,
41153 .write_char = kgdboc_put_char,
41154diff -urNp linux-2.6.39.1/drivers/tty/serial/m32r_sio.c linux-2.6.39.1/drivers/tty/serial/m32r_sio.c
41155--- linux-2.6.39.1/drivers/tty/serial/m32r_sio.c 2011-05-19 00:06:34.000000000 -0400
41156+++ linux-2.6.39.1/drivers/tty/serial/m32r_sio.c 2011-05-22 19:36:32.000000000 -0400
41157@@ -939,7 +939,7 @@ m32r_sio_type(struct uart_port *port)
41158 return uart_config[type].name;
41159 }
41160
41161-static struct uart_ops m32r_sio_pops = {
41162+static const struct uart_ops m32r_sio_pops = {
41163 .tx_empty = m32r_sio_tx_empty,
41164 .set_mctrl = m32r_sio_set_mctrl,
41165 .get_mctrl = m32r_sio_get_mctrl,
41166diff -urNp linux-2.6.39.1/drivers/tty/serial/max3100.c linux-2.6.39.1/drivers/tty/serial/max3100.c
41167--- linux-2.6.39.1/drivers/tty/serial/max3100.c 2011-05-19 00:06:34.000000000 -0400
41168+++ linux-2.6.39.1/drivers/tty/serial/max3100.c 2011-05-22 19:36:32.000000000 -0400
41169@@ -710,7 +710,7 @@ static void max3100_break_ctl(struct uar
41170 dev_dbg(&s->spi->dev, "%s\n", __func__);
41171 }
41172
41173-static struct uart_ops max3100_ops = {
41174+static const struct uart_ops max3100_ops = {
41175 .tx_empty = max3100_tx_empty,
41176 .set_mctrl = max3100_set_mctrl,
41177 .get_mctrl = max3100_get_mctrl,
41178diff -urNp linux-2.6.39.1/drivers/tty/serial/max3107.c linux-2.6.39.1/drivers/tty/serial/max3107.c
41179--- linux-2.6.39.1/drivers/tty/serial/max3107.c 2011-05-19 00:06:34.000000000 -0400
41180+++ linux-2.6.39.1/drivers/tty/serial/max3107.c 2011-05-22 19:36:32.000000000 -0400
41181@@ -910,7 +910,7 @@ static void max3107_break_ctl(struct uar
41182
41183
41184 /* Port functions */
41185-static struct uart_ops max3107_ops = {
41186+static const struct uart_ops max3107_ops = {
41187 .tx_empty = max3107_tx_empty,
41188 .set_mctrl = max3107_set_mctrl,
41189 .get_mctrl = max3107_get_mctrl,
41190diff -urNp linux-2.6.39.1/drivers/tty/serial/mfd.c linux-2.6.39.1/drivers/tty/serial/mfd.c
41191--- linux-2.6.39.1/drivers/tty/serial/mfd.c 2011-05-19 00:06:34.000000000 -0400
41192+++ linux-2.6.39.1/drivers/tty/serial/mfd.c 2011-05-22 19:36:32.000000000 -0400
41193@@ -1178,7 +1178,7 @@ static struct console serial_hsu_console
41194 };
41195 #endif
41196
41197-struct uart_ops serial_hsu_pops = {
41198+const struct uart_ops serial_hsu_pops = {
41199 .tx_empty = serial_hsu_tx_empty,
41200 .set_mctrl = serial_hsu_set_mctrl,
41201 .get_mctrl = serial_hsu_get_mctrl,
41202diff -urNp linux-2.6.39.1/drivers/tty/serial/mpc52xx_uart.c linux-2.6.39.1/drivers/tty/serial/mpc52xx_uart.c
41203--- linux-2.6.39.1/drivers/tty/serial/mpc52xx_uart.c 2011-05-19 00:06:34.000000000 -0400
41204+++ linux-2.6.39.1/drivers/tty/serial/mpc52xx_uart.c 2011-05-22 19:36:32.000000000 -0400
41205@@ -283,7 +283,7 @@ static irqreturn_t mpc52xx_psc_handle_ir
41206 return mpc5xxx_uart_process_int(port);
41207 }
41208
41209-static struct psc_ops mpc52xx_psc_ops = {
41210+static const struct psc_ops mpc52xx_psc_ops = {
41211 .fifo_init = mpc52xx_psc_fifo_init,
41212 .raw_rx_rdy = mpc52xx_psc_raw_rx_rdy,
41213 .raw_tx_rdy = mpc52xx_psc_raw_tx_rdy,
41214@@ -304,7 +304,7 @@ static struct psc_ops mpc52xx_psc_ops =
41215 .handle_irq = mpc52xx_psc_handle_irq,
41216 };
41217
41218-static struct psc_ops mpc5200b_psc_ops = {
41219+static const struct psc_ops mpc5200b_psc_ops = {
41220 .fifo_init = mpc52xx_psc_fifo_init,
41221 .raw_rx_rdy = mpc52xx_psc_raw_rx_rdy,
41222 .raw_tx_rdy = mpc52xx_psc_raw_tx_rdy,
41223@@ -571,7 +571,7 @@ static void mpc512x_psc_get_irq(struct u
41224 port->irq = psc_fifoc_irq;
41225 }
41226
41227-static struct psc_ops mpc512x_psc_ops = {
41228+static const struct psc_ops mpc512x_psc_ops = {
41229 .fifo_init = mpc512x_psc_fifo_init,
41230 .raw_rx_rdy = mpc512x_psc_raw_rx_rdy,
41231 .raw_tx_rdy = mpc512x_psc_raw_tx_rdy,
41232@@ -596,7 +596,7 @@ static struct psc_ops mpc512x_psc_ops =
41233 };
41234 #endif
41235
41236-static struct psc_ops *psc_ops;
41237+static const struct psc_ops *psc_ops;
41238
41239 /* ======================================================================== */
41240 /* UART operations */
41241@@ -905,7 +905,7 @@ mpc52xx_uart_verify_port(struct uart_por
41242 }
41243
41244
41245-static struct uart_ops mpc52xx_uart_ops = {
41246+static const struct uart_ops mpc52xx_uart_ops = {
41247 .tx_empty = mpc52xx_uart_tx_empty,
41248 .set_mctrl = mpc52xx_uart_set_mctrl,
41249 .get_mctrl = mpc52xx_uart_get_mctrl,
41250diff -urNp linux-2.6.39.1/drivers/tty/serial/mpsc.c linux-2.6.39.1/drivers/tty/serial/mpsc.c
41251--- linux-2.6.39.1/drivers/tty/serial/mpsc.c 2011-05-19 00:06:34.000000000 -0400
41252+++ linux-2.6.39.1/drivers/tty/serial/mpsc.c 2011-05-22 19:36:32.000000000 -0400
41253@@ -1663,7 +1663,7 @@ static void mpsc_put_poll_char(struct ua
41254 }
41255 #endif
41256
41257-static struct uart_ops mpsc_pops = {
41258+static const struct uart_ops mpsc_pops = {
41259 .tx_empty = mpsc_tx_empty,
41260 .set_mctrl = mpsc_set_mctrl,
41261 .get_mctrl = mpsc_get_mctrl,
41262diff -urNp linux-2.6.39.1/drivers/tty/serial/mrst_max3110.c linux-2.6.39.1/drivers/tty/serial/mrst_max3110.c
41263--- linux-2.6.39.1/drivers/tty/serial/mrst_max3110.c 2011-05-19 00:06:34.000000000 -0400
41264+++ linux-2.6.39.1/drivers/tty/serial/mrst_max3110.c 2011-05-22 19:36:32.000000000 -0400
41265@@ -393,6 +393,8 @@ static void max3110_con_receive(struct u
41266 int loop = 1, num, total = 0;
41267 u8 recv_buf[512], *pbuf;
41268
41269+ pax_track_stack();
41270+
41271 pbuf = recv_buf;
41272 do {
41273 num = max3110_read_multi(max, pbuf);
41274@@ -726,7 +728,7 @@ static void serial_m3110_enable_ms(struc
41275 {
41276 }
41277
41278-struct uart_ops serial_m3110_ops = {
41279+const struct uart_ops serial_m3110_ops = {
41280 .tx_empty = serial_m3110_tx_empty,
41281 .set_mctrl = serial_m3110_set_mctrl,
41282 .get_mctrl = serial_m3110_get_mctrl,
41283diff -urNp linux-2.6.39.1/drivers/tty/serial/msm_serial.c linux-2.6.39.1/drivers/tty/serial/msm_serial.c
41284--- linux-2.6.39.1/drivers/tty/serial/msm_serial.c 2011-05-19 00:06:34.000000000 -0400
41285+++ linux-2.6.39.1/drivers/tty/serial/msm_serial.c 2011-05-22 19:36:32.000000000 -0400
41286@@ -702,7 +702,7 @@ static void msm_power(struct uart_port *
41287 }
41288 }
41289
41290-static struct uart_ops msm_uart_pops = {
41291+static const struct uart_ops msm_uart_pops = {
41292 .tx_empty = msm_tx_empty,
41293 .set_mctrl = msm_set_mctrl,
41294 .get_mctrl = msm_get_mctrl,
41295diff -urNp linux-2.6.39.1/drivers/tty/serial/msm_serial_hs.c linux-2.6.39.1/drivers/tty/serial/msm_serial_hs.c
41296--- linux-2.6.39.1/drivers/tty/serial/msm_serial_hs.c 2011-05-19 00:06:34.000000000 -0400
41297+++ linux-2.6.39.1/drivers/tty/serial/msm_serial_hs.c 2011-05-22 19:36:32.000000000 -0400
41298@@ -360,7 +360,7 @@ struct msm_hs_port {
41299 static struct msm_hs_port q_uart_port[UARTDM_NR];
41300 static struct platform_driver msm_serial_hs_platform_driver;
41301 static struct uart_driver msm_hs_driver;
41302-static struct uart_ops msm_hs_ops;
41303+static const struct uart_ops msm_hs_ops;
41304 static struct workqueue_struct *msm_hs_workqueue;
41305
41306 #define UARTDM_TO_MSM(uart_port) \
41307@@ -1856,7 +1856,7 @@ static struct uart_driver msm_hs_driver
41308 .cons = 0,
41309 };
41310
41311-static struct uart_ops msm_hs_ops = {
41312+static const struct uart_ops msm_hs_ops = {
41313 .tx_empty = msm_hs_tx_empty,
41314 .set_mctrl = msm_hs_set_mctrl_locked,
41315 .get_mctrl = msm_hs_get_mctrl_locked,
41316diff -urNp linux-2.6.39.1/drivers/tty/serial/mux.c linux-2.6.39.1/drivers/tty/serial/mux.c
41317--- linux-2.6.39.1/drivers/tty/serial/mux.c 2011-05-19 00:06:34.000000000 -0400
41318+++ linux-2.6.39.1/drivers/tty/serial/mux.c 2011-05-22 19:36:32.000000000 -0400
41319@@ -442,7 +442,7 @@ static struct console mux_console = {
41320 #define MUX_CONSOLE NULL
41321 #endif
41322
41323-static struct uart_ops mux_pops = {
41324+static const struct uart_ops mux_pops = {
41325 .tx_empty = mux_tx_empty,
41326 .set_mctrl = mux_set_mctrl,
41327 .get_mctrl = mux_get_mctrl,
41328diff -urNp linux-2.6.39.1/drivers/tty/serial/mxs-auart.c linux-2.6.39.1/drivers/tty/serial/mxs-auart.c
41329--- linux-2.6.39.1/drivers/tty/serial/mxs-auart.c 2011-05-19 00:06:34.000000000 -0400
41330+++ linux-2.6.39.1/drivers/tty/serial/mxs-auart.c 2011-05-22 19:36:32.000000000 -0400
41331@@ -499,7 +499,7 @@ static void mxs_auart_enable_ms(struct u
41332 /* just empty */
41333 }
41334
41335-static struct uart_ops mxs_auart_ops = {
41336+static const struct uart_ops mxs_auart_ops = {
41337 .tx_empty = mxs_auart_tx_empty,
41338 .start_tx = mxs_auart_start_tx,
41339 .stop_tx = mxs_auart_stop_tx,
41340diff -urNp linux-2.6.39.1/drivers/tty/serial/netx-serial.c linux-2.6.39.1/drivers/tty/serial/netx-serial.c
41341--- linux-2.6.39.1/drivers/tty/serial/netx-serial.c 2011-05-19 00:06:34.000000000 -0400
41342+++ linux-2.6.39.1/drivers/tty/serial/netx-serial.c 2011-05-22 19:36:32.000000000 -0400
41343@@ -464,7 +464,7 @@ netx_verify_port(struct uart_port *port,
41344 return ret;
41345 }
41346
41347-static struct uart_ops netx_pops = {
41348+static const struct uart_ops netx_pops = {
41349 .tx_empty = netx_tx_empty,
41350 .set_mctrl = netx_set_mctrl,
41351 .get_mctrl = netx_get_mctrl,
41352diff -urNp linux-2.6.39.1/drivers/tty/serial/nwpserial.c linux-2.6.39.1/drivers/tty/serial/nwpserial.c
41353--- linux-2.6.39.1/drivers/tty/serial/nwpserial.c 2011-05-19 00:06:34.000000000 -0400
41354+++ linux-2.6.39.1/drivers/tty/serial/nwpserial.c 2011-05-22 19:36:32.000000000 -0400
41355@@ -303,7 +303,7 @@ static unsigned int nwpserial_tx_empty(s
41356 return ret & UART_LSR_TEMT ? TIOCSER_TEMT : 0;
41357 }
41358
41359-static struct uart_ops nwpserial_pops = {
41360+static const struct uart_ops nwpserial_pops = {
41361 .tx_empty = nwpserial_tx_empty,
41362 .set_mctrl = nwpserial_set_mctrl,
41363 .get_mctrl = nwpserial_get_mctrl,
41364diff -urNp linux-2.6.39.1/drivers/tty/serial/omap-serial.c linux-2.6.39.1/drivers/tty/serial/omap-serial.c
41365--- linux-2.6.39.1/drivers/tty/serial/omap-serial.c 2011-05-19 00:06:34.000000000 -0400
41366+++ linux-2.6.39.1/drivers/tty/serial/omap-serial.c 2011-05-22 19:36:32.000000000 -0400
41367@@ -1029,7 +1029,7 @@ static inline void serial_omap_add_conso
41368
41369 #endif
41370
41371-static struct uart_ops serial_omap_pops = {
41372+static const struct uart_ops serial_omap_pops = {
41373 .tx_empty = serial_omap_tx_empty,
41374 .set_mctrl = serial_omap_set_mctrl,
41375 .get_mctrl = serial_omap_get_mctrl,
41376diff -urNp linux-2.6.39.1/drivers/tty/serial/pch_uart.c linux-2.6.39.1/drivers/tty/serial/pch_uart.c
41377--- linux-2.6.39.1/drivers/tty/serial/pch_uart.c 2011-05-19 00:06:34.000000000 -0400
41378+++ linux-2.6.39.1/drivers/tty/serial/pch_uart.c 2011-05-22 19:36:32.000000000 -0400
41379@@ -1351,7 +1351,7 @@ static int pch_uart_verify_port(struct u
41380 return 0;
41381 }
41382
41383-static struct uart_ops pch_uart_ops = {
41384+static const struct uart_ops pch_uart_ops = {
41385 .tx_empty = pch_uart_tx_empty,
41386 .set_mctrl = pch_uart_set_mctrl,
41387 .get_mctrl = pch_uart_get_mctrl,
41388diff -urNp linux-2.6.39.1/drivers/tty/serial/pmac_zilog.c linux-2.6.39.1/drivers/tty/serial/pmac_zilog.c
41389--- linux-2.6.39.1/drivers/tty/serial/pmac_zilog.c 2011-05-19 00:06:34.000000000 -0400
41390+++ linux-2.6.39.1/drivers/tty/serial/pmac_zilog.c 2011-05-22 19:36:32.000000000 -0400
41391@@ -1427,7 +1427,7 @@ static void pmz_poll_put_char(struct uar
41392
41393 #endif /* CONFIG_CONSOLE_POLL */
41394
41395-static struct uart_ops pmz_pops = {
41396+static const struct uart_ops pmz_pops = {
41397 .tx_empty = pmz_tx_empty,
41398 .set_mctrl = pmz_set_mctrl,
41399 .get_mctrl = pmz_get_mctrl,
41400diff -urNp linux-2.6.39.1/drivers/tty/serial/pnx8xxx_uart.c linux-2.6.39.1/drivers/tty/serial/pnx8xxx_uart.c
41401--- linux-2.6.39.1/drivers/tty/serial/pnx8xxx_uart.c 2011-05-19 00:06:34.000000000 -0400
41402+++ linux-2.6.39.1/drivers/tty/serial/pnx8xxx_uart.c 2011-05-22 19:36:32.000000000 -0400
41403@@ -614,7 +614,7 @@ pnx8xxx_verify_port(struct uart_port *po
41404 return ret;
41405 }
41406
41407-static struct uart_ops pnx8xxx_pops = {
41408+static const struct uart_ops pnx8xxx_pops = {
41409 .tx_empty = pnx8xxx_tx_empty,
41410 .set_mctrl = pnx8xxx_set_mctrl,
41411 .get_mctrl = pnx8xxx_get_mctrl,
41412diff -urNp linux-2.6.39.1/drivers/tty/serial/pxa.c linux-2.6.39.1/drivers/tty/serial/pxa.c
41413--- linux-2.6.39.1/drivers/tty/serial/pxa.c 2011-05-19 00:06:34.000000000 -0400
41414+++ linux-2.6.39.1/drivers/tty/serial/pxa.c 2011-05-22 19:36:32.000000000 -0400
41415@@ -706,7 +706,7 @@ static struct console serial_pxa_console
41416 #define PXA_CONSOLE NULL
41417 #endif
41418
41419-struct uart_ops serial_pxa_pops = {
41420+const struct uart_ops serial_pxa_pops = {
41421 .tx_empty = serial_pxa_tx_empty,
41422 .set_mctrl = serial_pxa_set_mctrl,
41423 .get_mctrl = serial_pxa_get_mctrl,
41424diff -urNp linux-2.6.39.1/drivers/tty/serial/sa1100.c linux-2.6.39.1/drivers/tty/serial/sa1100.c
41425--- linux-2.6.39.1/drivers/tty/serial/sa1100.c 2011-05-19 00:06:34.000000000 -0400
41426+++ linux-2.6.39.1/drivers/tty/serial/sa1100.c 2011-05-22 19:36:32.000000000 -0400
41427@@ -577,7 +577,7 @@ sa1100_verify_port(struct uart_port *por
41428 return ret;
41429 }
41430
41431-static struct uart_ops sa1100_pops = {
41432+static const struct uart_ops sa1100_pops = {
41433 .tx_empty = sa1100_tx_empty,
41434 .set_mctrl = sa1100_set_mctrl,
41435 .get_mctrl = sa1100_get_mctrl,
41436diff -urNp linux-2.6.39.1/drivers/tty/serial/samsung.c linux-2.6.39.1/drivers/tty/serial/samsung.c
41437--- linux-2.6.39.1/drivers/tty/serial/samsung.c 2011-05-19 00:06:34.000000000 -0400
41438+++ linux-2.6.39.1/drivers/tty/serial/samsung.c 2011-05-22 19:36:32.000000000 -0400
41439@@ -860,7 +860,7 @@ static struct console s3c24xx_serial_con
41440 #define S3C24XX_SERIAL_CONSOLE NULL
41441 #endif
41442
41443-static struct uart_ops s3c24xx_serial_ops = {
41444+static const struct uart_ops s3c24xx_serial_ops = {
41445 .pm = s3c24xx_serial_pm,
41446 .tx_empty = s3c24xx_serial_tx_empty,
41447 .get_mctrl = s3c24xx_serial_get_mctrl,
41448diff -urNp linux-2.6.39.1/drivers/tty/serial/sc26xx.c linux-2.6.39.1/drivers/tty/serial/sc26xx.c
41449--- linux-2.6.39.1/drivers/tty/serial/sc26xx.c 2011-05-19 00:06:34.000000000 -0400
41450+++ linux-2.6.39.1/drivers/tty/serial/sc26xx.c 2011-05-22 19:36:32.000000000 -0400
41451@@ -515,7 +515,7 @@ static int sc26xx_verify_port(struct uar
41452 return -EINVAL;
41453 }
41454
41455-static struct uart_ops sc26xx_ops = {
41456+static const struct uart_ops sc26xx_ops = {
41457 .tx_empty = sc26xx_tx_empty,
41458 .set_mctrl = sc26xx_set_mctrl,
41459 .get_mctrl = sc26xx_get_mctrl,
41460diff -urNp linux-2.6.39.1/drivers/tty/serial/serial_ks8695.c linux-2.6.39.1/drivers/tty/serial/serial_ks8695.c
41461--- linux-2.6.39.1/drivers/tty/serial/serial_ks8695.c 2011-05-19 00:06:34.000000000 -0400
41462+++ linux-2.6.39.1/drivers/tty/serial/serial_ks8695.c 2011-05-22 19:36:32.000000000 -0400
41463@@ -528,7 +528,7 @@ static int ks8695uart_verify_port(struct
41464 return ret;
41465 }
41466
41467-static struct uart_ops ks8695uart_pops = {
41468+static const struct uart_ops ks8695uart_pops = {
41469 .tx_empty = ks8695uart_tx_empty,
41470 .set_mctrl = ks8695uart_set_mctrl,
41471 .get_mctrl = ks8695uart_get_mctrl,
41472diff -urNp linux-2.6.39.1/drivers/tty/serial/serial_txx9.c linux-2.6.39.1/drivers/tty/serial/serial_txx9.c
41473--- linux-2.6.39.1/drivers/tty/serial/serial_txx9.c 2011-05-19 00:06:34.000000000 -0400
41474+++ linux-2.6.39.1/drivers/tty/serial/serial_txx9.c 2011-05-22 19:36:32.000000000 -0400
41475@@ -857,7 +857,7 @@ serial_txx9_type(struct uart_port *port)
41476 return "txx9";
41477 }
41478
41479-static struct uart_ops serial_txx9_pops = {
41480+static const struct uart_ops serial_txx9_pops = {
41481 .tx_empty = serial_txx9_tx_empty,
41482 .set_mctrl = serial_txx9_set_mctrl,
41483 .get_mctrl = serial_txx9_get_mctrl,
41484diff -urNp linux-2.6.39.1/drivers/tty/serial/sn_console.c linux-2.6.39.1/drivers/tty/serial/sn_console.c
41485--- linux-2.6.39.1/drivers/tty/serial/sn_console.c 2011-05-19 00:06:34.000000000 -0400
41486+++ linux-2.6.39.1/drivers/tty/serial/sn_console.c 2011-05-22 19:36:32.000000000 -0400
41487@@ -388,7 +388,7 @@ static void snp_config_port(struct uart_
41488
41489 /* Associate the uart functions above - given to serial core */
41490
41491-static struct uart_ops sn_console_ops = {
41492+static const struct uart_ops sn_console_ops = {
41493 .tx_empty = snp_tx_empty,
41494 .set_mctrl = snp_set_mctrl,
41495 .get_mctrl = snp_get_mctrl,
41496diff -urNp linux-2.6.39.1/drivers/tty/serial/sunhv.c linux-2.6.39.1/drivers/tty/serial/sunhv.c
41497--- linux-2.6.39.1/drivers/tty/serial/sunhv.c 2011-05-19 00:06:34.000000000 -0400
41498+++ linux-2.6.39.1/drivers/tty/serial/sunhv.c 2011-05-22 19:36:32.000000000 -0400
41499@@ -168,12 +168,12 @@ struct sunhv_ops {
41500 int (*receive_chars)(struct uart_port *port, struct tty_struct *tty);
41501 };
41502
41503-static struct sunhv_ops bychar_ops = {
41504+static const struct sunhv_ops bychar_ops = {
41505 .transmit_chars = transmit_chars_putchar,
41506 .receive_chars = receive_chars_getchar,
41507 };
41508
41509-static struct sunhv_ops bywrite_ops = {
41510+static const struct sunhv_ops bywrite_ops = {
41511 .transmit_chars = transmit_chars_write,
41512 .receive_chars = receive_chars_read,
41513 };
41514@@ -370,7 +370,7 @@ static int sunhv_verify_port(struct uart
41515 return -EINVAL;
41516 }
41517
41518-static struct uart_ops sunhv_pops = {
41519+static const struct uart_ops sunhv_pops = {
41520 .tx_empty = sunhv_tx_empty,
41521 .set_mctrl = sunhv_set_mctrl,
41522 .get_mctrl = sunhv_get_mctrl,
41523diff -urNp linux-2.6.39.1/drivers/tty/serial/sunsab.c linux-2.6.39.1/drivers/tty/serial/sunsab.c
41524--- linux-2.6.39.1/drivers/tty/serial/sunsab.c 2011-05-19 00:06:34.000000000 -0400
41525+++ linux-2.6.39.1/drivers/tty/serial/sunsab.c 2011-05-22 19:36:32.000000000 -0400
41526@@ -804,7 +804,7 @@ static int sunsab_verify_port(struct uar
41527 return -EINVAL;
41528 }
41529
41530-static struct uart_ops sunsab_pops = {
41531+static const struct uart_ops sunsab_pops = {
41532 .tx_empty = sunsab_tx_empty,
41533 .set_mctrl = sunsab_set_mctrl,
41534 .get_mctrl = sunsab_get_mctrl,
41535diff -urNp linux-2.6.39.1/drivers/tty/serial/sunsu.c linux-2.6.39.1/drivers/tty/serial/sunsu.c
41536--- linux-2.6.39.1/drivers/tty/serial/sunsu.c 2011-05-19 00:06:34.000000000 -0400
41537+++ linux-2.6.39.1/drivers/tty/serial/sunsu.c 2011-05-22 19:36:32.000000000 -0400
41538@@ -946,7 +946,7 @@ sunsu_type(struct uart_port *port)
41539 return uart_config[type].name;
41540 }
41541
41542-static struct uart_ops sunsu_pops = {
41543+static const struct uart_ops sunsu_pops = {
41544 .tx_empty = sunsu_tx_empty,
41545 .set_mctrl = sunsu_set_mctrl,
41546 .get_mctrl = sunsu_get_mctrl,
41547diff -urNp linux-2.6.39.1/drivers/tty/serial/sunzilog.c linux-2.6.39.1/drivers/tty/serial/sunzilog.c
41548--- linux-2.6.39.1/drivers/tty/serial/sunzilog.c 2011-05-19 00:06:34.000000000 -0400
41549+++ linux-2.6.39.1/drivers/tty/serial/sunzilog.c 2011-05-22 19:36:32.000000000 -0400
41550@@ -1042,7 +1042,7 @@ static void sunzilog_put_poll_char(struc
41551 }
41552 #endif /* CONFIG_CONSOLE_POLL */
41553
41554-static struct uart_ops sunzilog_pops = {
41555+static const struct uart_ops sunzilog_pops = {
41556 .tx_empty = sunzilog_tx_empty,
41557 .set_mctrl = sunzilog_set_mctrl,
41558 .get_mctrl = sunzilog_get_mctrl,
41559diff -urNp linux-2.6.39.1/drivers/tty/serial/timbuart.c linux-2.6.39.1/drivers/tty/serial/timbuart.c
41560--- linux-2.6.39.1/drivers/tty/serial/timbuart.c 2011-05-19 00:06:34.000000000 -0400
41561+++ linux-2.6.39.1/drivers/tty/serial/timbuart.c 2011-05-22 19:36:32.000000000 -0400
41562@@ -394,7 +394,7 @@ static int timbuart_verify_port(struct u
41563 return -EINVAL;
41564 }
41565
41566-static struct uart_ops timbuart_ops = {
41567+static const struct uart_ops timbuart_ops = {
41568 .tx_empty = timbuart_tx_empty,
41569 .set_mctrl = timbuart_set_mctrl,
41570 .get_mctrl = timbuart_get_mctrl,
41571diff -urNp linux-2.6.39.1/drivers/tty/serial/uartlite.c linux-2.6.39.1/drivers/tty/serial/uartlite.c
41572--- linux-2.6.39.1/drivers/tty/serial/uartlite.c 2011-05-19 00:06:34.000000000 -0400
41573+++ linux-2.6.39.1/drivers/tty/serial/uartlite.c 2011-05-22 19:36:32.000000000 -0400
41574@@ -331,7 +331,7 @@ static void ulite_put_poll_char(struct u
41575 }
41576 #endif
41577
41578-static struct uart_ops ulite_ops = {
41579+static const struct uart_ops ulite_ops = {
41580 .tx_empty = ulite_tx_empty,
41581 .set_mctrl = ulite_set_mctrl,
41582 .get_mctrl = ulite_get_mctrl,
41583diff -urNp linux-2.6.39.1/drivers/tty/serial/ucc_uart.c linux-2.6.39.1/drivers/tty/serial/ucc_uart.c
41584--- linux-2.6.39.1/drivers/tty/serial/ucc_uart.c 2011-05-19 00:06:34.000000000 -0400
41585+++ linux-2.6.39.1/drivers/tty/serial/ucc_uart.c 2011-05-22 19:36:32.000000000 -0400
41586@@ -1088,7 +1088,7 @@ static int qe_uart_verify_port(struct ua
41587 *
41588 * Details on these functions can be found in Documentation/serial/driver
41589 */
41590-static struct uart_ops qe_uart_pops = {
41591+static const struct uart_ops qe_uart_pops = {
41592 .tx_empty = qe_uart_tx_empty,
41593 .set_mctrl = qe_uart_set_mctrl,
41594 .get_mctrl = qe_uart_get_mctrl,
41595diff -urNp linux-2.6.39.1/drivers/tty/serial/vr41xx_siu.c linux-2.6.39.1/drivers/tty/serial/vr41xx_siu.c
41596--- linux-2.6.39.1/drivers/tty/serial/vr41xx_siu.c 2011-05-19 00:06:34.000000000 -0400
41597+++ linux-2.6.39.1/drivers/tty/serial/vr41xx_siu.c 2011-05-22 19:36:32.000000000 -0400
41598@@ -683,7 +683,7 @@ static int siu_verify_port(struct uart_p
41599 return 0;
41600 }
41601
41602-static struct uart_ops siu_uart_ops = {
41603+static const struct uart_ops siu_uart_ops = {
41604 .tx_empty = siu_tx_empty,
41605 .set_mctrl = siu_set_mctrl,
41606 .get_mctrl = siu_get_mctrl,
41607diff -urNp linux-2.6.39.1/drivers/tty/serial/vt8500_serial.c linux-2.6.39.1/drivers/tty/serial/vt8500_serial.c
41608--- linux-2.6.39.1/drivers/tty/serial/vt8500_serial.c 2011-05-19 00:06:34.000000000 -0400
41609+++ linux-2.6.39.1/drivers/tty/serial/vt8500_serial.c 2011-05-22 19:36:32.000000000 -0400
41610@@ -519,7 +519,7 @@ static struct console vt8500_console = {
41611 #define VT8500_CONSOLE NULL
41612 #endif
41613
41614-static struct uart_ops vt8500_uart_pops = {
41615+static const struct uart_ops vt8500_uart_pops = {
41616 .tx_empty = vt8500_tx_empty,
41617 .set_mctrl = vt8500_set_mctrl,
41618 .get_mctrl = vt8500_get_mctrl,
41619diff -urNp linux-2.6.39.1/drivers/tty/serial/zs.c linux-2.6.39.1/drivers/tty/serial/zs.c
41620--- linux-2.6.39.1/drivers/tty/serial/zs.c 2011-05-19 00:06:34.000000000 -0400
41621+++ linux-2.6.39.1/drivers/tty/serial/zs.c 2011-05-22 19:36:32.000000000 -0400
41622@@ -1044,7 +1044,7 @@ static int zs_verify_port(struct uart_po
41623 }
41624
41625
41626-static struct uart_ops zs_ops = {
41627+static const struct uart_ops zs_ops = {
41628 .tx_empty = zs_tx_empty,
41629 .set_mctrl = zs_set_mctrl,
41630 .get_mctrl = zs_get_mctrl,
41631diff -urNp linux-2.6.39.1/drivers/tty/tty_io.c linux-2.6.39.1/drivers/tty/tty_io.c
41632--- linux-2.6.39.1/drivers/tty/tty_io.c 2011-05-19 00:06:34.000000000 -0400
41633+++ linux-2.6.39.1/drivers/tty/tty_io.c 2011-05-22 19:36:32.000000000 -0400
41634@@ -139,21 +139,11 @@ EXPORT_SYMBOL(tty_mutex);
41635 /* Spinlock to protect the tty->tty_files list */
41636 DEFINE_SPINLOCK(tty_files_lock);
41637
41638-static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
41639-static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
41640 ssize_t redirected_tty_write(struct file *, const char __user *,
41641 size_t, loff_t *);
41642-static unsigned int tty_poll(struct file *, poll_table *);
41643 static int tty_open(struct inode *, struct file *);
41644 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
41645-#ifdef CONFIG_COMPAT
41646-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
41647- unsigned long arg);
41648-#else
41649-#define tty_compat_ioctl NULL
41650-#endif
41651 static int __tty_fasync(int fd, struct file *filp, int on);
41652-static int tty_fasync(int fd, struct file *filp, int on);
41653 static void release_tty(struct tty_struct *tty, int idx);
41654 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
41655 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
41656@@ -937,7 +927,7 @@ EXPORT_SYMBOL(start_tty);
41657 * read calls may be outstanding in parallel.
41658 */
41659
41660-static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
41661+ssize_t tty_read(struct file *file, char __user *buf, size_t count,
41662 loff_t *ppos)
41663 {
41664 int i;
41665@@ -963,6 +953,8 @@ static ssize_t tty_read(struct file *fil
41666 return i;
41667 }
41668
41669+EXPORT_SYMBOL(tty_read);
41670+
41671 void tty_write_unlock(struct tty_struct *tty)
41672 {
41673 mutex_unlock(&tty->atomic_write_lock);
41674@@ -1112,7 +1104,7 @@ void tty_write_message(struct tty_struct
41675 * write method will not be invoked in parallel for each device.
41676 */
41677
41678-static ssize_t tty_write(struct file *file, const char __user *buf,
41679+ssize_t tty_write(struct file *file, const char __user *buf,
41680 size_t count, loff_t *ppos)
41681 {
41682 struct inode *inode = file->f_path.dentry->d_inode;
41683@@ -1138,6 +1130,8 @@ static ssize_t tty_write(struct file *fi
41684 return ret;
41685 }
41686
41687+EXPORT_SYMBOL(tty_write);
41688+
41689 ssize_t redirected_tty_write(struct file *file, const char __user *buf,
41690 size_t count, loff_t *ppos)
41691 {
41692@@ -1777,6 +1771,8 @@ int tty_release(struct inode *inode, str
41693 return 0;
41694 }
41695
41696+EXPORT_SYMBOL(tty_release);
41697+
41698 /**
41699 * tty_open - open a tty device
41700 * @inode: inode of device file
41701@@ -1968,7 +1964,7 @@ got_driver:
41702 * may be re-entered freely by other callers.
41703 */
41704
41705-static unsigned int tty_poll(struct file *filp, poll_table *wait)
41706+unsigned int tty_poll(struct file *filp, poll_table *wait)
41707 {
41708 struct tty_struct *tty = file_tty(filp);
41709 struct tty_ldisc *ld;
41710@@ -1984,6 +1980,8 @@ static unsigned int tty_poll(struct file
41711 return ret;
41712 }
41713
41714+EXPORT_SYMBOL(tty_poll);
41715+
41716 static int __tty_fasync(int fd, struct file *filp, int on)
41717 {
41718 struct tty_struct *tty = file_tty(filp);
41719@@ -2025,7 +2023,7 @@ out:
41720 return retval;
41721 }
41722
41723-static int tty_fasync(int fd, struct file *filp, int on)
41724+int tty_fasync(int fd, struct file *filp, int on)
41725 {
41726 int retval;
41727 tty_lock();
41728@@ -2034,6 +2032,8 @@ static int tty_fasync(int fd, struct fil
41729 return retval;
41730 }
41731
41732+EXPORT_SYMBOL(tty_fasync);
41733+
41734 /**
41735 * tiocsti - fake input character
41736 * @tty: tty to fake input into
41737@@ -2695,8 +2695,10 @@ long tty_ioctl(struct file *file, unsign
41738 return retval;
41739 }
41740
41741+EXPORT_SYMBOL(tty_ioctl);
41742+
41743 #ifdef CONFIG_COMPAT
41744-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
41745+long tty_compat_ioctl(struct file *file, unsigned int cmd,
41746 unsigned long arg)
41747 {
41748 struct inode *inode = file->f_dentry->d_inode;
41749@@ -2720,6 +2722,9 @@ static long tty_compat_ioctl(struct file
41750
41751 return retval;
41752 }
41753+
41754+EXPORT_SYMBOL(tty_compat_ioctl);
41755+
41756 #endif
41757
41758 /*
41759@@ -3198,11 +3203,6 @@ struct tty_struct *get_current_tty(void)
41760 }
41761 EXPORT_SYMBOL_GPL(get_current_tty);
41762
41763-void tty_default_fops(struct file_operations *fops)
41764-{
41765- *fops = tty_fops;
41766-}
41767-
41768 /*
41769 * Initialize the console device. This is called *early*, so
41770 * we can't necessarily depend on lots of kernel help here.
41771diff -urNp linux-2.6.39.1/drivers/tty/tty_ldisc.c linux-2.6.39.1/drivers/tty/tty_ldisc.c
41772--- linux-2.6.39.1/drivers/tty/tty_ldisc.c 2011-05-19 00:06:34.000000000 -0400
41773+++ linux-2.6.39.1/drivers/tty/tty_ldisc.c 2011-05-22 19:36:32.000000000 -0400
41774@@ -74,7 +74,7 @@ static void put_ldisc(struct tty_ldisc *
41775 if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
41776 struct tty_ldisc_ops *ldo = ld->ops;
41777
41778- ldo->refcount--;
41779+ atomic_dec(&ldo->refcount);
41780 module_put(ldo->owner);
41781 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
41782
41783@@ -109,7 +109,7 @@ int tty_register_ldisc(int disc, struct
41784 spin_lock_irqsave(&tty_ldisc_lock, flags);
41785 tty_ldiscs[disc] = new_ldisc;
41786 new_ldisc->num = disc;
41787- new_ldisc->refcount = 0;
41788+ atomic_set(&new_ldisc->refcount, 0);
41789 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
41790
41791 return ret;
41792@@ -137,7 +137,7 @@ int tty_unregister_ldisc(int disc)
41793 return -EINVAL;
41794
41795 spin_lock_irqsave(&tty_ldisc_lock, flags);
41796- if (tty_ldiscs[disc]->refcount)
41797+ if (atomic_read(&tty_ldiscs[disc]->refcount))
41798 ret = -EBUSY;
41799 else
41800 tty_ldiscs[disc] = NULL;
41801@@ -158,7 +158,7 @@ static struct tty_ldisc_ops *get_ldops(i
41802 if (ldops) {
41803 ret = ERR_PTR(-EAGAIN);
41804 if (try_module_get(ldops->owner)) {
41805- ldops->refcount++;
41806+ atomic_inc(&ldops->refcount);
41807 ret = ldops;
41808 }
41809 }
41810@@ -171,7 +171,7 @@ static void put_ldops(struct tty_ldisc_o
41811 unsigned long flags;
41812
41813 spin_lock_irqsave(&tty_ldisc_lock, flags);
41814- ldops->refcount--;
41815+ atomic_dec(&ldops->refcount);
41816 module_put(ldops->owner);
41817 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
41818 }
41819diff -urNp linux-2.6.39.1/drivers/tty/vt/keyboard.c linux-2.6.39.1/drivers/tty/vt/keyboard.c
41820--- linux-2.6.39.1/drivers/tty/vt/keyboard.c 2011-05-19 00:06:34.000000000 -0400
41821+++ linux-2.6.39.1/drivers/tty/vt/keyboard.c 2011-05-22 20:32:43.000000000 -0400
41822@@ -658,6 +658,16 @@ static void k_spec(struct vc_data *vc, u
41823 kbd->kbdmode == VC_OFF) &&
41824 value != KVAL(K_SAK))
41825 return; /* SAK is allowed even in raw mode */
41826+
41827+#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
41828+ {
41829+ void *func = fn_handler[value];
41830+ if (func == fn_show_state || func == fn_show_ptregs ||
41831+ func == fn_show_mem)
41832+ return;
41833+ }
41834+#endif
41835+
41836 fn_handler[value](vc);
41837 }
41838
41839diff -urNp linux-2.6.39.1/drivers/tty/vt/vt.c linux-2.6.39.1/drivers/tty/vt/vt.c
41840--- linux-2.6.39.1/drivers/tty/vt/vt.c 2011-05-19 00:06:34.000000000 -0400
41841+++ linux-2.6.39.1/drivers/tty/vt/vt.c 2011-05-22 19:36:32.000000000 -0400
41842@@ -261,7 +261,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier
41843
41844 static void notify_write(struct vc_data *vc, unsigned int unicode)
41845 {
41846- struct vt_notifier_param param = { .vc = vc, unicode = unicode };
41847+ struct vt_notifier_param param = { .vc = vc, .c = unicode };
41848 atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, &param);
41849 }
41850
41851diff -urNp linux-2.6.39.1/drivers/tty/vt/vt_ioctl.c linux-2.6.39.1/drivers/tty/vt/vt_ioctl.c
41852--- linux-2.6.39.1/drivers/tty/vt/vt_ioctl.c 2011-05-19 00:06:34.000000000 -0400
41853+++ linux-2.6.39.1/drivers/tty/vt/vt_ioctl.c 2011-05-22 19:41:37.000000000 -0400
41854@@ -209,9 +209,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __
41855 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
41856 return -EFAULT;
41857
41858- if (!capable(CAP_SYS_TTY_CONFIG))
41859- perm = 0;
41860-
41861 switch (cmd) {
41862 case KDGKBENT:
41863 key_map = key_maps[s];
41864@@ -223,6 +220,9 @@ do_kdsk_ioctl(int cmd, struct kbentry __
41865 val = (i ? K_HOLE : K_NOSUCHMAP);
41866 return put_user(val, &user_kbe->kb_value);
41867 case KDSKBENT:
41868+ if (!capable(CAP_SYS_TTY_CONFIG))
41869+ perm = 0;
41870+
41871 if (!perm)
41872 return -EPERM;
41873 if (!i && v == K_NOSUCHMAP) {
41874@@ -324,9 +324,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
41875 int i, j, k;
41876 int ret;
41877
41878- if (!capable(CAP_SYS_TTY_CONFIG))
41879- perm = 0;
41880-
41881 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
41882 if (!kbs) {
41883 ret = -ENOMEM;
41884@@ -360,6 +357,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
41885 kfree(kbs);
41886 return ((p && *p) ? -EOVERFLOW : 0);
41887 case KDSKBSENT:
41888+ if (!capable(CAP_SYS_TTY_CONFIG))
41889+ perm = 0;
41890+
41891 if (!perm) {
41892 ret = -EPERM;
41893 goto reterr;
41894diff -urNp linux-2.6.39.1/drivers/uio/uio.c linux-2.6.39.1/drivers/uio/uio.c
41895--- linux-2.6.39.1/drivers/uio/uio.c 2011-05-19 00:06:34.000000000 -0400
41896+++ linux-2.6.39.1/drivers/uio/uio.c 2011-05-22 19:36:32.000000000 -0400
41897@@ -25,6 +25,7 @@
41898 #include <linux/kobject.h>
41899 #include <linux/cdev.h>
41900 #include <linux/uio_driver.h>
41901+#include <asm/local.h>
41902
41903 #define UIO_MAX_DEVICES (1U << MINORBITS)
41904
41905@@ -32,10 +33,10 @@ struct uio_device {
41906 struct module *owner;
41907 struct device *dev;
41908 int minor;
41909- atomic_t event;
41910+ atomic_unchecked_t event;
41911 struct fasync_struct *async_queue;
41912 wait_queue_head_t wait;
41913- int vma_count;
41914+ local_t vma_count;
41915 struct uio_info *info;
41916 struct kobject *map_dir;
41917 struct kobject *portio_dir;
41918@@ -242,7 +243,7 @@ static ssize_t show_event(struct device
41919 struct device_attribute *attr, char *buf)
41920 {
41921 struct uio_device *idev = dev_get_drvdata(dev);
41922- return sprintf(buf, "%u\n", (unsigned int)atomic_read(&idev->event));
41923+ return sprintf(buf, "%u\n", (unsigned int)atomic_read_unchecked(&idev->event));
41924 }
41925
41926 static struct device_attribute uio_class_attributes[] = {
41927@@ -402,7 +403,7 @@ void uio_event_notify(struct uio_info *i
41928 {
41929 struct uio_device *idev = info->uio_dev;
41930
41931- atomic_inc(&idev->event);
41932+ atomic_inc_unchecked(&idev->event);
41933 wake_up_interruptible(&idev->wait);
41934 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
41935 }
41936@@ -455,7 +456,7 @@ static int uio_open(struct inode *inode,
41937 }
41938
41939 listener->dev = idev;
41940- listener->event_count = atomic_read(&idev->event);
41941+ listener->event_count = atomic_read_unchecked(&idev->event);
41942 filep->private_data = listener;
41943
41944 if (idev->info->open) {
41945@@ -506,7 +507,7 @@ static unsigned int uio_poll(struct file
41946 return -EIO;
41947
41948 poll_wait(filep, &idev->wait, wait);
41949- if (listener->event_count != atomic_read(&idev->event))
41950+ if (listener->event_count != atomic_read_unchecked(&idev->event))
41951 return POLLIN | POLLRDNORM;
41952 return 0;
41953 }
41954@@ -531,7 +532,7 @@ static ssize_t uio_read(struct file *fil
41955 do {
41956 set_current_state(TASK_INTERRUPTIBLE);
41957
41958- event_count = atomic_read(&idev->event);
41959+ event_count = atomic_read_unchecked(&idev->event);
41960 if (event_count != listener->event_count) {
41961 if (copy_to_user(buf, &event_count, count))
41962 retval = -EFAULT;
41963@@ -602,13 +603,13 @@ static int uio_find_mem_index(struct vm_
41964 static void uio_vma_open(struct vm_area_struct *vma)
41965 {
41966 struct uio_device *idev = vma->vm_private_data;
41967- idev->vma_count++;
41968+ local_inc(&idev->vma_count);
41969 }
41970
41971 static void uio_vma_close(struct vm_area_struct *vma)
41972 {
41973 struct uio_device *idev = vma->vm_private_data;
41974- idev->vma_count--;
41975+ local_dec(&idev->vma_count);
41976 }
41977
41978 static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
41979@@ -819,7 +820,7 @@ int __uio_register_device(struct module
41980 idev->owner = owner;
41981 idev->info = info;
41982 init_waitqueue_head(&idev->wait);
41983- atomic_set(&idev->event, 0);
41984+ atomic_set_unchecked(&idev->event, 0);
41985
41986 ret = uio_get_minor(idev);
41987 if (ret)
41988diff -urNp linux-2.6.39.1/drivers/usb/atm/cxacru.c linux-2.6.39.1/drivers/usb/atm/cxacru.c
41989--- linux-2.6.39.1/drivers/usb/atm/cxacru.c 2011-05-19 00:06:34.000000000 -0400
41990+++ linux-2.6.39.1/drivers/usb/atm/cxacru.c 2011-05-22 19:36:32.000000000 -0400
41991@@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_c
41992 ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp);
41993 if (ret < 2)
41994 return -EINVAL;
41995- if (index < 0 || index > 0x7f)
41996+ if (index > 0x7f)
41997 return -EINVAL;
41998 pos += tmp;
41999
42000diff -urNp linux-2.6.39.1/drivers/usb/atm/usbatm.c linux-2.6.39.1/drivers/usb/atm/usbatm.c
42001--- linux-2.6.39.1/drivers/usb/atm/usbatm.c 2011-05-19 00:06:34.000000000 -0400
42002+++ linux-2.6.39.1/drivers/usb/atm/usbatm.c 2011-05-22 19:36:32.000000000 -0400
42003@@ -332,7 +332,7 @@ static void usbatm_extract_one_cell(stru
42004 if (printk_ratelimit())
42005 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
42006 __func__, vpi, vci);
42007- atomic_inc(&vcc->stats->rx_err);
42008+ atomic_inc_unchecked(&vcc->stats->rx_err);
42009 return;
42010 }
42011
42012@@ -360,7 +360,7 @@ static void usbatm_extract_one_cell(stru
42013 if (length > ATM_MAX_AAL5_PDU) {
42014 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
42015 __func__, length, vcc);
42016- atomic_inc(&vcc->stats->rx_err);
42017+ atomic_inc_unchecked(&vcc->stats->rx_err);
42018 goto out;
42019 }
42020
42021@@ -369,14 +369,14 @@ static void usbatm_extract_one_cell(stru
42022 if (sarb->len < pdu_length) {
42023 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
42024 __func__, pdu_length, sarb->len, vcc);
42025- atomic_inc(&vcc->stats->rx_err);
42026+ atomic_inc_unchecked(&vcc->stats->rx_err);
42027 goto out;
42028 }
42029
42030 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
42031 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
42032 __func__, vcc);
42033- atomic_inc(&vcc->stats->rx_err);
42034+ atomic_inc_unchecked(&vcc->stats->rx_err);
42035 goto out;
42036 }
42037
42038@@ -386,7 +386,7 @@ static void usbatm_extract_one_cell(stru
42039 if (printk_ratelimit())
42040 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
42041 __func__, length);
42042- atomic_inc(&vcc->stats->rx_drop);
42043+ atomic_inc_unchecked(&vcc->stats->rx_drop);
42044 goto out;
42045 }
42046
42047@@ -411,7 +411,7 @@ static void usbatm_extract_one_cell(stru
42048
42049 vcc->push(vcc, skb);
42050
42051- atomic_inc(&vcc->stats->rx);
42052+ atomic_inc_unchecked(&vcc->stats->rx);
42053 out:
42054 skb_trim(sarb, 0);
42055 }
42056@@ -614,7 +614,7 @@ static void usbatm_tx_process(unsigned l
42057 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
42058
42059 usbatm_pop(vcc, skb);
42060- atomic_inc(&vcc->stats->tx);
42061+ atomic_inc_unchecked(&vcc->stats->tx);
42062
42063 skb = skb_dequeue(&instance->sndqueue);
42064 }
42065@@ -773,11 +773,11 @@ static int usbatm_atm_proc_read(struct a
42066 if (!left--)
42067 return sprintf(page,
42068 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
42069- atomic_read(&atm_dev->stats.aal5.tx),
42070- atomic_read(&atm_dev->stats.aal5.tx_err),
42071- atomic_read(&atm_dev->stats.aal5.rx),
42072- atomic_read(&atm_dev->stats.aal5.rx_err),
42073- atomic_read(&atm_dev->stats.aal5.rx_drop));
42074+ atomic_read_unchecked(&atm_dev->stats.aal5.tx),
42075+ atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
42076+ atomic_read_unchecked(&atm_dev->stats.aal5.rx),
42077+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
42078+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
42079
42080 if (!left--) {
42081 if (instance->disconnected)
42082diff -urNp linux-2.6.39.1/drivers/usb/core/devices.c linux-2.6.39.1/drivers/usb/core/devices.c
42083--- linux-2.6.39.1/drivers/usb/core/devices.c 2011-05-19 00:06:34.000000000 -0400
42084+++ linux-2.6.39.1/drivers/usb/core/devices.c 2011-05-22 19:36:32.000000000 -0400
42085@@ -126,7 +126,7 @@ static const char *format_endpt =
42086 * time it gets called.
42087 */
42088 static struct device_connect_event {
42089- atomic_t count;
42090+ atomic_unchecked_t count;
42091 wait_queue_head_t wait;
42092 } device_event = {
42093 .count = ATOMIC_INIT(1),
42094@@ -164,7 +164,7 @@ static const struct class_info clas_info
42095
42096 void usbfs_conn_disc_event(void)
42097 {
42098- atomic_add(2, &device_event.count);
42099+ atomic_add_unchecked(2, &device_event.count);
42100 wake_up(&device_event.wait);
42101 }
42102
42103@@ -648,7 +648,7 @@ static unsigned int usb_device_poll(stru
42104
42105 poll_wait(file, &device_event.wait, wait);
42106
42107- event_count = atomic_read(&device_event.count);
42108+ event_count = atomic_read_unchecked(&device_event.count);
42109 if (file->f_version != event_count) {
42110 file->f_version = event_count;
42111 return POLLIN | POLLRDNORM;
42112diff -urNp linux-2.6.39.1/drivers/usb/core/hcd.c linux-2.6.39.1/drivers/usb/core/hcd.c
42113--- linux-2.6.39.1/drivers/usb/core/hcd.c 2011-06-03 00:04:14.000000000 -0400
42114+++ linux-2.6.39.1/drivers/usb/core/hcd.c 2011-06-03 00:32:07.000000000 -0400
42115@@ -2574,7 +2574,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
42116
42117 #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
42118
42119-struct usb_mon_operations *mon_ops;
42120+const struct usb_mon_operations *mon_ops;
42121
42122 /*
42123 * The registration is unlocked.
42124@@ -2584,7 +2584,7 @@ struct usb_mon_operations *mon_ops;
42125 * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
42126 */
42127
42128-int usb_mon_register (struct usb_mon_operations *ops)
42129+int usb_mon_register (const struct usb_mon_operations *ops)
42130 {
42131
42132 if (mon_ops)
42133diff -urNp linux-2.6.39.1/drivers/usb/core/message.c linux-2.6.39.1/drivers/usb/core/message.c
42134--- linux-2.6.39.1/drivers/usb/core/message.c 2011-05-19 00:06:34.000000000 -0400
42135+++ linux-2.6.39.1/drivers/usb/core/message.c 2011-05-22 19:36:32.000000000 -0400
42136@@ -869,8 +869,8 @@ char *usb_cache_string(struct usb_device
42137 buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
42138 if (buf) {
42139 len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
42140- if (len > 0) {
42141- smallbuf = kmalloc(++len, GFP_NOIO);
42142+ if (len++ > 0) {
42143+ smallbuf = kmalloc(len, GFP_NOIO);
42144 if (!smallbuf)
42145 return buf;
42146 memcpy(smallbuf, buf, len);
42147diff -urNp linux-2.6.39.1/drivers/usb/early/ehci-dbgp.c linux-2.6.39.1/drivers/usb/early/ehci-dbgp.c
42148--- linux-2.6.39.1/drivers/usb/early/ehci-dbgp.c 2011-05-19 00:06:34.000000000 -0400
42149+++ linux-2.6.39.1/drivers/usb/early/ehci-dbgp.c 2011-05-22 19:36:32.000000000 -0400
42150@@ -96,7 +96,7 @@ static inline u32 dbgp_len_update(u32 x,
42151 }
42152
42153 #ifdef CONFIG_KGDB
42154-static struct kgdb_io kgdbdbgp_io_ops;
42155+static struct kgdb_io kgdbdbgp_io_ops; /* cannot be const, see kgdbdbgp_parse_config */
42156 #define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops)
42157 #else
42158 #define dbgp_kgdb_mode (0)
42159@@ -1026,7 +1026,7 @@ static void kgdbdbgp_write_char(u8 chr)
42160 early_dbgp_write(NULL, &chr, 1);
42161 }
42162
42163-static struct kgdb_io kgdbdbgp_io_ops = {
42164+static struct kgdb_io kgdbdbgp_io_ops = { /* cannot be const, see kgdbdbgp_parse_config() */
42165 .name = "kgdbdbgp",
42166 .read_char = kgdbdbgp_read_char,
42167 .write_char = kgdbdbgp_write_char,
42168diff -urNp linux-2.6.39.1/drivers/usb/gadget/fsl_qe_udc.c linux-2.6.39.1/drivers/usb/gadget/fsl_qe_udc.c
42169--- linux-2.6.39.1/drivers/usb/gadget/fsl_qe_udc.c 2011-05-19 00:06:34.000000000 -0400
42170+++ linux-2.6.39.1/drivers/usb/gadget/fsl_qe_udc.c 2011-05-22 19:36:32.000000000 -0400
42171@@ -1859,7 +1859,7 @@ out:
42172 return status;
42173 }
42174
42175-static struct usb_ep_ops qe_ep_ops = {
42176+static const struct usb_ep_ops qe_ep_ops = {
42177 .enable = qe_ep_enable,
42178 .disable = qe_ep_disable,
42179
42180@@ -1928,7 +1928,7 @@ static int qe_pullup(struct usb_gadget *
42181 }
42182
42183 /* defined in usb_gadget.h */
42184-static struct usb_gadget_ops qe_gadget_ops = {
42185+static const struct usb_gadget_ops qe_gadget_ops = {
42186 .get_frame = qe_get_frame,
42187 .wakeup = qe_wakeup,
42188 /* .set_selfpowered = qe_set_selfpowered,*/ /* always selfpowered */
42189diff -urNp linux-2.6.39.1/drivers/usb/gadget/fsl_udc_core.c linux-2.6.39.1/drivers/usb/gadget/fsl_udc_core.c
42190--- linux-2.6.39.1/drivers/usb/gadget/fsl_udc_core.c 2011-05-19 00:06:34.000000000 -0400
42191+++ linux-2.6.39.1/drivers/usb/gadget/fsl_udc_core.c 2011-05-22 19:36:32.000000000 -0400
42192@@ -1003,7 +1003,7 @@ static void fsl_ep_fifo_flush(struct usb
42193 } while (fsl_readl(&dr_regs->endptstatus) & bits);
42194 }
42195
42196-static struct usb_ep_ops fsl_ep_ops = {
42197+static const struct usb_ep_ops fsl_ep_ops = {
42198 .enable = fsl_ep_enable,
42199 .disable = fsl_ep_disable,
42200
42201@@ -1114,7 +1114,7 @@ static int fsl_pullup(struct usb_gadget
42202 }
42203
42204 /* defined in gadget.h */
42205-static struct usb_gadget_ops fsl_gadget_ops = {
42206+static const struct usb_gadget_ops fsl_gadget_ops = {
42207 .get_frame = fsl_get_frame,
42208 .wakeup = fsl_wakeup,
42209 /* .set_selfpowered = fsl_set_selfpowered, */ /* Always selfpowered */
42210diff -urNp linux-2.6.39.1/drivers/usb/gadget/fusb300_udc.c linux-2.6.39.1/drivers/usb/gadget/fusb300_udc.c
42211--- linux-2.6.39.1/drivers/usb/gadget/fusb300_udc.c 2011-05-19 00:06:34.000000000 -0400
42212+++ linux-2.6.39.1/drivers/usb/gadget/fusb300_udc.c 2011-05-22 19:36:32.000000000 -0400
42213@@ -527,7 +527,7 @@ static void fusb300_fifo_flush(struct us
42214 {
42215 }
42216
42217-static struct usb_ep_ops fusb300_ep_ops = {
42218+static const struct usb_ep_ops fusb300_ep_ops = {
42219 .enable = fusb300_enable,
42220 .disable = fusb300_disable,
42221
42222@@ -1570,7 +1570,7 @@ static int fusb300_udc_pullup(struct usb
42223 return 0;
42224 }
42225
42226-static struct usb_gadget_ops fusb300_gadget_ops = {
42227+static const struct usb_gadget_ops fusb300_gadget_ops = {
42228 .pullup = fusb300_udc_pullup,
42229 };
42230
42231diff -urNp linux-2.6.39.1/drivers/usb/gadget/goku_udc.c linux-2.6.39.1/drivers/usb/gadget/goku_udc.c
42232--- linux-2.6.39.1/drivers/usb/gadget/goku_udc.c 2011-05-19 00:06:34.000000000 -0400
42233+++ linux-2.6.39.1/drivers/usb/gadget/goku_udc.c 2011-05-22 19:36:32.000000000 -0400
42234@@ -973,7 +973,7 @@ static void goku_fifo_flush(struct usb_e
42235 command(regs, COMMAND_FIFO_CLEAR, ep->num);
42236 }
42237
42238-static struct usb_ep_ops goku_ep_ops = {
42239+static const struct usb_ep_ops goku_ep_ops = {
42240 .enable = goku_ep_enable,
42241 .disable = goku_ep_disable,
42242
42243diff -urNp linux-2.6.39.1/drivers/usb/gadget/imx_udc.c linux-2.6.39.1/drivers/usb/gadget/imx_udc.c
42244--- linux-2.6.39.1/drivers/usb/gadget/imx_udc.c 2011-05-19 00:06:34.000000000 -0400
42245+++ linux-2.6.39.1/drivers/usb/gadget/imx_udc.c 2011-05-22 19:36:32.000000000 -0400
42246@@ -937,7 +937,7 @@ static void imx_ep_fifo_flush(struct usb
42247 local_irq_restore(flags);
42248 }
42249
42250-static struct usb_ep_ops imx_ep_ops = {
42251+static const struct usb_ep_ops imx_ep_ops = {
42252 .enable = imx_ep_enable,
42253 .disable = imx_ep_disable,
42254
42255diff -urNp linux-2.6.39.1/drivers/usb/gadget/m66592-udc.c linux-2.6.39.1/drivers/usb/gadget/m66592-udc.c
42256--- linux-2.6.39.1/drivers/usb/gadget/m66592-udc.c 2011-05-19 00:06:34.000000000 -0400
42257+++ linux-2.6.39.1/drivers/usb/gadget/m66592-udc.c 2011-05-22 19:36:32.000000000 -0400
42258@@ -1437,7 +1437,7 @@ static void m66592_fifo_flush(struct usb
42259 spin_unlock_irqrestore(&ep->m66592->lock, flags);
42260 }
42261
42262-static struct usb_ep_ops m66592_ep_ops = {
42263+static const struct usb_ep_ops m66592_ep_ops = {
42264 .enable = m66592_enable,
42265 .disable = m66592_disable,
42266
42267@@ -1542,7 +1542,7 @@ static int m66592_get_frame(struct usb_g
42268 return m66592_read(m66592, M66592_FRMNUM) & 0x03FF;
42269 }
42270
42271-static struct usb_gadget_ops m66592_gadget_ops = {
42272+static const struct usb_gadget_ops m66592_gadget_ops = {
42273 .get_frame = m66592_get_frame,
42274 };
42275
42276diff -urNp linux-2.6.39.1/drivers/usb/gadget/mv_udc_core.c linux-2.6.39.1/drivers/usb/gadget/mv_udc_core.c
42277--- linux-2.6.39.1/drivers/usb/gadget/mv_udc_core.c 2011-05-19 00:06:34.000000000 -0400
42278+++ linux-2.6.39.1/drivers/usb/gadget/mv_udc_core.c 2011-05-22 19:36:32.000000000 -0400
42279@@ -972,7 +972,7 @@ static int mv_ep_set_wedge(struct usb_ep
42280 return mv_ep_set_halt_wedge(_ep, 1, 1);
42281 }
42282
42283-static struct usb_ep_ops mv_ep_ops = {
42284+static const struct usb_ep_ops mv_ep_ops = {
42285 .enable = mv_ep_enable,
42286 .disable = mv_ep_disable,
42287
42288diff -urNp linux-2.6.39.1/drivers/usb/gadget/omap_udc.c linux-2.6.39.1/drivers/usb/gadget/omap_udc.c
42289--- linux-2.6.39.1/drivers/usb/gadget/omap_udc.c 2011-05-19 00:06:34.000000000 -0400
42290+++ linux-2.6.39.1/drivers/usb/gadget/omap_udc.c 2011-05-22 19:36:32.000000000 -0400
42291@@ -1177,7 +1177,7 @@ done:
42292 return status;
42293 }
42294
42295-static struct usb_ep_ops omap_ep_ops = {
42296+static const struct usb_ep_ops omap_ep_ops = {
42297 .enable = omap_ep_enable,
42298 .disable = omap_ep_disable,
42299
42300@@ -1374,7 +1374,7 @@ static int omap_pullup(struct usb_gadget
42301 return 0;
42302 }
42303
42304-static struct usb_gadget_ops omap_gadget_ops = {
42305+static const struct usb_gadget_ops omap_gadget_ops = {
42306 .get_frame = omap_get_frame,
42307 .wakeup = omap_wakeup,
42308 .set_selfpowered = omap_set_selfpowered,
42309diff -urNp linux-2.6.39.1/drivers/usb/gadget/pxa25x_udc.c linux-2.6.39.1/drivers/usb/gadget/pxa25x_udc.c
42310--- linux-2.6.39.1/drivers/usb/gadget/pxa25x_udc.c 2011-05-19 00:06:34.000000000 -0400
42311+++ linux-2.6.39.1/drivers/usb/gadget/pxa25x_udc.c 2011-05-22 19:36:32.000000000 -0400
42312@@ -896,7 +896,7 @@ static void pxa25x_ep_fifo_flush(struct
42313 }
42314
42315
42316-static struct usb_ep_ops pxa25x_ep_ops = {
42317+static const struct usb_ep_ops pxa25x_ep_ops = {
42318 .enable = pxa25x_ep_enable,
42319 .disable = pxa25x_ep_disable,
42320
42321diff -urNp linux-2.6.39.1/drivers/usb/gadget/pxa27x_udc.c linux-2.6.39.1/drivers/usb/gadget/pxa27x_udc.c
42322--- linux-2.6.39.1/drivers/usb/gadget/pxa27x_udc.c 2011-05-19 00:06:34.000000000 -0400
42323+++ linux-2.6.39.1/drivers/usb/gadget/pxa27x_udc.c 2011-05-22 19:36:32.000000000 -0400
42324@@ -1491,7 +1491,7 @@ static int pxa_ep_disable(struct usb_ep
42325 return 0;
42326 }
42327
42328-static struct usb_ep_ops pxa_ep_ops = {
42329+static const struct usb_ep_ops pxa_ep_ops = {
42330 .enable = pxa_ep_enable,
42331 .disable = pxa_ep_disable,
42332
42333diff -urNp linux-2.6.39.1/drivers/usb/gadget/r8a66597-udc.c linux-2.6.39.1/drivers/usb/gadget/r8a66597-udc.c
42334--- linux-2.6.39.1/drivers/usb/gadget/r8a66597-udc.c 2011-05-19 00:06:34.000000000 -0400
42335+++ linux-2.6.39.1/drivers/usb/gadget/r8a66597-udc.c 2011-05-22 19:36:32.000000000 -0400
42336@@ -1392,7 +1392,7 @@ static void r8a66597_fifo_flush(struct u
42337 spin_unlock_irqrestore(&ep->r8a66597->lock, flags);
42338 }
42339
42340-static struct usb_ep_ops r8a66597_ep_ops = {
42341+static const struct usb_ep_ops r8a66597_ep_ops = {
42342 .enable = r8a66597_enable,
42343 .disable = r8a66597_disable,
42344
42345@@ -1497,7 +1497,7 @@ static int r8a66597_get_frame(struct usb
42346 return r8a66597_read(r8a66597, FRMNUM) & 0x03FF;
42347 }
42348
42349-static struct usb_gadget_ops r8a66597_gadget_ops = {
42350+static const struct usb_gadget_ops r8a66597_gadget_ops = {
42351 .get_frame = r8a66597_get_frame,
42352 };
42353
42354diff -urNp linux-2.6.39.1/drivers/usb/gadget/s3c-hsotg.c linux-2.6.39.1/drivers/usb/gadget/s3c-hsotg.c
42355--- linux-2.6.39.1/drivers/usb/gadget/s3c-hsotg.c 2011-05-19 00:06:34.000000000 -0400
42356+++ linux-2.6.39.1/drivers/usb/gadget/s3c-hsotg.c 2011-05-22 19:36:32.000000000 -0400
42357@@ -2461,7 +2461,7 @@ static int s3c_hsotg_ep_sethalt(struct u
42358 return 0;
42359 }
42360
42361-static struct usb_ep_ops s3c_hsotg_ep_ops = {
42362+static const struct usb_ep_ops s3c_hsotg_ep_ops = {
42363 .enable = s3c_hsotg_ep_enable,
42364 .disable = s3c_hsotg_ep_disable,
42365 .alloc_request = s3c_hsotg_ep_alloc_request,
42366@@ -2725,7 +2725,7 @@ static int s3c_hsotg_gadget_getframe(str
42367 return s3c_hsotg_read_frameno(to_hsotg(gadget));
42368 }
42369
42370-static struct usb_gadget_ops s3c_hsotg_gadget_ops = {
42371+static const struct usb_gadget_ops s3c_hsotg_gadget_ops = {
42372 .get_frame = s3c_hsotg_gadget_getframe,
42373 };
42374
42375diff -urNp linux-2.6.39.1/drivers/usb/gadget/uvc_queue.c linux-2.6.39.1/drivers/usb/gadget/uvc_queue.c
42376--- linux-2.6.39.1/drivers/usb/gadget/uvc_queue.c 2011-05-19 00:06:34.000000000 -0400
42377+++ linux-2.6.39.1/drivers/usb/gadget/uvc_queue.c 2011-05-22 19:36:32.000000000 -0400
42378@@ -400,7 +400,7 @@ static void uvc_vm_close(struct vm_area_
42379 buffer->vma_use_count--;
42380 }
42381
42382-static struct vm_operations_struct uvc_vm_ops = {
42383+static const struct vm_operations_struct uvc_vm_ops = {
42384 .open = uvc_vm_open,
42385 .close = uvc_vm_close,
42386 };
42387diff -urNp linux-2.6.39.1/drivers/usb/host/ehci-fsl.c linux-2.6.39.1/drivers/usb/host/ehci-fsl.c
42388--- linux-2.6.39.1/drivers/usb/host/ehci-fsl.c 2011-05-19 00:06:34.000000000 -0400
42389+++ linux-2.6.39.1/drivers/usb/host/ehci-fsl.c 2011-05-22 19:36:32.000000000 -0400
42390@@ -380,7 +380,7 @@ static int ehci_fsl_drv_restore(struct d
42391 return 0;
42392 }
42393
42394-static struct dev_pm_ops ehci_fsl_pm_ops = {
42395+static const struct dev_pm_ops ehci_fsl_pm_ops = {
42396 .suspend = ehci_fsl_drv_suspend,
42397 .resume = ehci_fsl_drv_resume,
42398 .restore = ehci_fsl_drv_restore,
42399diff -urNp linux-2.6.39.1/drivers/usb/host/xhci-mem.c linux-2.6.39.1/drivers/usb/host/xhci-mem.c
42400--- linux-2.6.39.1/drivers/usb/host/xhci-mem.c 2011-06-03 00:04:14.000000000 -0400
42401+++ linux-2.6.39.1/drivers/usb/host/xhci-mem.c 2011-06-03 00:32:07.000000000 -0400
42402@@ -1670,6 +1670,8 @@ static int xhci_check_trb_in_td_math(str
42403 unsigned int num_tests;
42404 int i, ret;
42405
42406+ pax_track_stack();
42407+
42408 num_tests = ARRAY_SIZE(simple_test_vector);
42409 for (i = 0; i < num_tests; i++) {
42410 ret = xhci_test_trb_in_td(xhci,
42411diff -urNp linux-2.6.39.1/drivers/usb/mon/mon_main.c linux-2.6.39.1/drivers/usb/mon/mon_main.c
42412--- linux-2.6.39.1/drivers/usb/mon/mon_main.c 2011-05-19 00:06:34.000000000 -0400
42413+++ linux-2.6.39.1/drivers/usb/mon/mon_main.c 2011-05-22 19:36:32.000000000 -0400
42414@@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
42415 /*
42416 * Ops
42417 */
42418-static struct usb_mon_operations mon_ops_0 = {
42419+static const struct usb_mon_operations mon_ops_0 = {
42420 .urb_submit = mon_submit,
42421 .urb_submit_error = mon_submit_error,
42422 .urb_complete = mon_complete,
42423diff -urNp linux-2.6.39.1/drivers/usb/musb/cppi_dma.h linux-2.6.39.1/drivers/usb/musb/cppi_dma.h
42424--- linux-2.6.39.1/drivers/usb/musb/cppi_dma.h 2011-05-19 00:06:34.000000000 -0400
42425+++ linux-2.6.39.1/drivers/usb/musb/cppi_dma.h 2011-05-22 19:36:32.000000000 -0400
42426@@ -113,7 +113,7 @@ struct cppi_channel {
42427
42428 /* CPPI DMA controller object */
42429 struct cppi {
42430- struct dma_controller controller;
42431+ const struct dma_controller controller;
42432 struct musb *musb;
42433 void __iomem *mregs; /* Mentor regs */
42434 void __iomem *tibase; /* TI/CPPI regs */
42435diff -urNp linux-2.6.39.1/drivers/usb/otg/msm_otg.c linux-2.6.39.1/drivers/usb/otg/msm_otg.c
42436--- linux-2.6.39.1/drivers/usb/otg/msm_otg.c 2011-05-19 00:06:34.000000000 -0400
42437+++ linux-2.6.39.1/drivers/usb/otg/msm_otg.c 2011-05-22 19:36:32.000000000 -0400
42438@@ -95,7 +95,7 @@ static int ulpi_write(struct otg_transce
42439 return 0;
42440 }
42441
42442-static struct otg_io_access_ops msm_otg_io_ops = {
42443+static const struct otg_io_access_ops msm_otg_io_ops = {
42444 .read = ulpi_read,
42445 .write = ulpi_write,
42446 };
42447diff -urNp linux-2.6.39.1/drivers/usb/otg/ulpi_viewport.c linux-2.6.39.1/drivers/usb/otg/ulpi_viewport.c
42448--- linux-2.6.39.1/drivers/usb/otg/ulpi_viewport.c 2011-05-19 00:06:34.000000000 -0400
42449+++ linux-2.6.39.1/drivers/usb/otg/ulpi_viewport.c 2011-05-22 19:36:32.000000000 -0400
42450@@ -74,7 +74,7 @@ static int ulpi_viewport_write(struct ot
42451 return ulpi_viewport_wait(view, ULPI_VIEW_RUN);
42452 }
42453
42454-struct otg_io_access_ops ulpi_viewport_access_ops = {
42455+const struct otg_io_access_ops ulpi_viewport_access_ops = {
42456 .read = ulpi_viewport_read,
42457 .write = ulpi_viewport_write,
42458 };
42459diff -urNp linux-2.6.39.1/drivers/usb/serial/ftdi_sio.c linux-2.6.39.1/drivers/usb/serial/ftdi_sio.c
42460--- linux-2.6.39.1/drivers/usb/serial/ftdi_sio.c 2011-06-03 00:04:14.000000000 -0400
42461+++ linux-2.6.39.1/drivers/usb/serial/ftdi_sio.c 2011-06-03 00:32:07.000000000 -0400
42462@@ -104,27 +104,27 @@ static int ftdi_stmclite_probe(struct
42463 static void ftdi_USB_UIRT_setup(struct ftdi_private *priv);
42464 static void ftdi_HE_TIRA1_setup(struct ftdi_private *priv);
42465
42466-static struct ftdi_sio_quirk ftdi_jtag_quirk = {
42467+static const struct ftdi_sio_quirk ftdi_jtag_quirk = {
42468 .probe = ftdi_jtag_probe,
42469 };
42470
42471-static struct ftdi_sio_quirk ftdi_mtxorb_hack_quirk = {
42472+static const struct ftdi_sio_quirk ftdi_mtxorb_hack_quirk = {
42473 .probe = ftdi_mtxorb_hack_setup,
42474 };
42475
42476-static struct ftdi_sio_quirk ftdi_NDI_device_quirk = {
42477+static const struct ftdi_sio_quirk ftdi_NDI_device_quirk = {
42478 .probe = ftdi_NDI_device_setup,
42479 };
42480
42481-static struct ftdi_sio_quirk ftdi_USB_UIRT_quirk = {
42482+static const struct ftdi_sio_quirk ftdi_USB_UIRT_quirk = {
42483 .port_probe = ftdi_USB_UIRT_setup,
42484 };
42485
42486-static struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
42487+static const struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
42488 .port_probe = ftdi_HE_TIRA1_setup,
42489 };
42490
42491-static struct ftdi_sio_quirk ftdi_stmclite_quirk = {
42492+static const struct ftdi_sio_quirk ftdi_stmclite_quirk = {
42493 .probe = ftdi_stmclite_probe,
42494 };
42495
42496diff -urNp linux-2.6.39.1/drivers/usb/wusbcore/wa-hc.h linux-2.6.39.1/drivers/usb/wusbcore/wa-hc.h
42497--- linux-2.6.39.1/drivers/usb/wusbcore/wa-hc.h 2011-05-19 00:06:34.000000000 -0400
42498+++ linux-2.6.39.1/drivers/usb/wusbcore/wa-hc.h 2011-05-22 19:36:32.000000000 -0400
42499@@ -192,7 +192,7 @@ struct wahc {
42500 struct list_head xfer_delayed_list;
42501 spinlock_t xfer_list_lock;
42502 struct work_struct xfer_work;
42503- atomic_t xfer_id_count;
42504+ atomic_unchecked_t xfer_id_count;
42505 };
42506
42507
42508@@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *
42509 INIT_LIST_HEAD(&wa->xfer_delayed_list);
42510 spin_lock_init(&wa->xfer_list_lock);
42511 INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
42512- atomic_set(&wa->xfer_id_count, 1);
42513+ atomic_set_unchecked(&wa->xfer_id_count, 1);
42514 }
42515
42516 /**
42517diff -urNp linux-2.6.39.1/drivers/usb/wusbcore/wa-xfer.c linux-2.6.39.1/drivers/usb/wusbcore/wa-xfer.c
42518--- linux-2.6.39.1/drivers/usb/wusbcore/wa-xfer.c 2011-05-19 00:06:34.000000000 -0400
42519+++ linux-2.6.39.1/drivers/usb/wusbcore/wa-xfer.c 2011-05-22 19:36:32.000000000 -0400
42520@@ -294,7 +294,7 @@ out:
42521 */
42522 static void wa_xfer_id_init(struct wa_xfer *xfer)
42523 {
42524- xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
42525+ xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
42526 }
42527
42528 /*
42529diff -urNp linux-2.6.39.1/drivers/vhost/vhost.c linux-2.6.39.1/drivers/vhost/vhost.c
42530--- linux-2.6.39.1/drivers/vhost/vhost.c 2011-05-19 00:06:34.000000000 -0400
42531+++ linux-2.6.39.1/drivers/vhost/vhost.c 2011-05-22 19:36:32.000000000 -0400
42532@@ -580,7 +580,7 @@ static int init_used(struct vhost_virtqu
42533 return get_user(vq->last_used_idx, &used->idx);
42534 }
42535
42536-static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
42537+static long vhost_set_vring(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
42538 {
42539 struct file *eventfp, *filep = NULL,
42540 *pollstart = NULL, *pollstop = NULL;
42541diff -urNp linux-2.6.39.1/drivers/video/backlight/corgi_lcd.c linux-2.6.39.1/drivers/video/backlight/corgi_lcd.c
42542--- linux-2.6.39.1/drivers/video/backlight/corgi_lcd.c 2011-05-19 00:06:34.000000000 -0400
42543+++ linux-2.6.39.1/drivers/video/backlight/corgi_lcd.c 2011-05-22 19:36:32.000000000 -0400
42544@@ -383,7 +383,7 @@ static int corgi_lcd_get_power(struct lc
42545 return lcd->power;
42546 }
42547
42548-static struct lcd_ops corgi_lcd_ops = {
42549+static const struct lcd_ops corgi_lcd_ops = {
42550 .get_power = corgi_lcd_get_power,
42551 .set_power = corgi_lcd_set_power,
42552 .set_mode = corgi_lcd_set_mode,
42553diff -urNp linux-2.6.39.1/drivers/video/backlight/cr_bllcd.c linux-2.6.39.1/drivers/video/backlight/cr_bllcd.c
42554--- linux-2.6.39.1/drivers/video/backlight/cr_bllcd.c 2011-05-19 00:06:34.000000000 -0400
42555+++ linux-2.6.39.1/drivers/video/backlight/cr_bllcd.c 2011-05-22 19:36:32.000000000 -0400
42556@@ -165,7 +165,7 @@ static int cr_lcd_set_power(struct lcd_d
42557 return 0;
42558 }
42559
42560-static struct lcd_ops cr_lcd_ops = {
42561+static const struct lcd_ops cr_lcd_ops = {
42562 .set_power = cr_lcd_set_power,
42563 };
42564
42565diff -urNp linux-2.6.39.1/drivers/video/backlight/ili9320.c linux-2.6.39.1/drivers/video/backlight/ili9320.c
42566--- linux-2.6.39.1/drivers/video/backlight/ili9320.c 2011-05-19 00:06:34.000000000 -0400
42567+++ linux-2.6.39.1/drivers/video/backlight/ili9320.c 2011-05-22 19:36:32.000000000 -0400
42568@@ -166,7 +166,7 @@ static int ili9320_get_power(struct lcd_
42569 return lcd->power;
42570 }
42571
42572-static struct lcd_ops ili9320_ops = {
42573+static const struct lcd_ops ili9320_ops = {
42574 .get_power = ili9320_get_power,
42575 .set_power = ili9320_set_power,
42576 };
42577diff -urNp linux-2.6.39.1/drivers/video/backlight/jornada720_lcd.c linux-2.6.39.1/drivers/video/backlight/jornada720_lcd.c
42578--- linux-2.6.39.1/drivers/video/backlight/jornada720_lcd.c 2011-05-19 00:06:34.000000000 -0400
42579+++ linux-2.6.39.1/drivers/video/backlight/jornada720_lcd.c 2011-05-22 19:36:32.000000000 -0400
42580@@ -87,7 +87,7 @@ static int jornada_lcd_set_power(struct
42581 return 0;
42582 }
42583
42584-static struct lcd_ops jornada_lcd_props = {
42585+static const struct lcd_ops jornada_lcd_props = {
42586 .get_contrast = jornada_lcd_get_contrast,
42587 .set_contrast = jornada_lcd_set_contrast,
42588 .get_power = jornada_lcd_get_power,
42589diff -urNp linux-2.6.39.1/drivers/video/backlight/l4f00242t03.c linux-2.6.39.1/drivers/video/backlight/l4f00242t03.c
42590--- linux-2.6.39.1/drivers/video/backlight/l4f00242t03.c 2011-05-19 00:06:34.000000000 -0400
42591+++ linux-2.6.39.1/drivers/video/backlight/l4f00242t03.c 2011-05-22 19:36:32.000000000 -0400
42592@@ -149,7 +149,7 @@ static int l4f00242t03_lcd_power_set(str
42593 return 0;
42594 }
42595
42596-static struct lcd_ops l4f_ops = {
42597+static const struct lcd_ops l4f_ops = {
42598 .set_power = l4f00242t03_lcd_power_set,
42599 .get_power = l4f00242t03_lcd_power_get,
42600 };
42601diff -urNp linux-2.6.39.1/drivers/video/backlight/lcd.c linux-2.6.39.1/drivers/video/backlight/lcd.c
42602--- linux-2.6.39.1/drivers/video/backlight/lcd.c 2011-05-19 00:06:34.000000000 -0400
42603+++ linux-2.6.39.1/drivers/video/backlight/lcd.c 2011-05-22 19:36:32.000000000 -0400
42604@@ -192,7 +192,7 @@ static struct device_attribute lcd_devic
42605 * or a pointer to the newly allocated device.
42606 */
42607 struct lcd_device *lcd_device_register(const char *name, struct device *parent,
42608- void *devdata, struct lcd_ops *ops)
42609+ void *devdata, const struct lcd_ops *ops)
42610 {
42611 struct lcd_device *new_ld;
42612 int rc;
42613diff -urNp linux-2.6.39.1/drivers/video/backlight/ld9040.c linux-2.6.39.1/drivers/video/backlight/ld9040.c
42614--- linux-2.6.39.1/drivers/video/backlight/ld9040.c 2011-05-19 00:06:34.000000000 -0400
42615+++ linux-2.6.39.1/drivers/video/backlight/ld9040.c 2011-05-22 19:36:32.000000000 -0400
42616@@ -651,7 +651,7 @@ static int ld9040_set_brightness(struct
42617 return ret;
42618 }
42619
42620-static struct lcd_ops ld9040_lcd_ops = {
42621+static const struct lcd_ops ld9040_lcd_ops = {
42622 .set_power = ld9040_set_power,
42623 .get_power = ld9040_get_power,
42624 };
42625diff -urNp linux-2.6.39.1/drivers/video/backlight/lms283gf05.c linux-2.6.39.1/drivers/video/backlight/lms283gf05.c
42626--- linux-2.6.39.1/drivers/video/backlight/lms283gf05.c 2011-05-19 00:06:34.000000000 -0400
42627+++ linux-2.6.39.1/drivers/video/backlight/lms283gf05.c 2011-05-22 19:36:32.000000000 -0400
42628@@ -144,7 +144,7 @@ static int lms283gf05_power_set(struct l
42629 return 0;
42630 }
42631
42632-static struct lcd_ops lms_ops = {
42633+static const struct lcd_ops lms_ops = {
42634 .set_power = lms283gf05_power_set,
42635 .get_power = NULL,
42636 };
42637diff -urNp linux-2.6.39.1/drivers/video/backlight/ltv350qv.c linux-2.6.39.1/drivers/video/backlight/ltv350qv.c
42638--- linux-2.6.39.1/drivers/video/backlight/ltv350qv.c 2011-05-19 00:06:34.000000000 -0400
42639+++ linux-2.6.39.1/drivers/video/backlight/ltv350qv.c 2011-05-22 19:36:32.000000000 -0400
42640@@ -221,7 +221,7 @@ static int ltv350qv_get_power(struct lcd
42641 return lcd->power;
42642 }
42643
42644-static struct lcd_ops ltv_ops = {
42645+static const struct lcd_ops ltv_ops = {
42646 .get_power = ltv350qv_get_power,
42647 .set_power = ltv350qv_set_power,
42648 };
42649diff -urNp linux-2.6.39.1/drivers/video/backlight/platform_lcd.c linux-2.6.39.1/drivers/video/backlight/platform_lcd.c
42650--- linux-2.6.39.1/drivers/video/backlight/platform_lcd.c 2011-05-19 00:06:34.000000000 -0400
42651+++ linux-2.6.39.1/drivers/video/backlight/platform_lcd.c 2011-05-22 19:36:32.000000000 -0400
42652@@ -66,7 +66,7 @@ static int platform_lcd_match(struct lcd
42653 return plcd->us->parent == info->device;
42654 }
42655
42656-static struct lcd_ops platform_lcd_ops = {
42657+static const struct lcd_ops platform_lcd_ops = {
42658 .get_power = platform_lcd_get_power,
42659 .set_power = platform_lcd_set_power,
42660 .check_fb = platform_lcd_match,
42661diff -urNp linux-2.6.39.1/drivers/video/backlight/s6e63m0.c linux-2.6.39.1/drivers/video/backlight/s6e63m0.c
42662--- linux-2.6.39.1/drivers/video/backlight/s6e63m0.c 2011-05-19 00:06:34.000000000 -0400
42663+++ linux-2.6.39.1/drivers/video/backlight/s6e63m0.c 2011-05-22 19:36:32.000000000 -0400
42664@@ -644,7 +644,7 @@ static int s6e63m0_set_brightness(struct
42665 return ret;
42666 }
42667
42668-static struct lcd_ops s6e63m0_lcd_ops = {
42669+static const struct lcd_ops s6e63m0_lcd_ops = {
42670 .set_power = s6e63m0_set_power,
42671 .get_power = s6e63m0_get_power,
42672 };
42673diff -urNp linux-2.6.39.1/drivers/video/backlight/tdo24m.c linux-2.6.39.1/drivers/video/backlight/tdo24m.c
42674--- linux-2.6.39.1/drivers/video/backlight/tdo24m.c 2011-05-19 00:06:34.000000000 -0400
42675+++ linux-2.6.39.1/drivers/video/backlight/tdo24m.c 2011-05-22 19:36:32.000000000 -0400
42676@@ -322,7 +322,7 @@ static int tdo24m_set_mode(struct lcd_de
42677 return lcd->adj_mode(lcd, mode);
42678 }
42679
42680-static struct lcd_ops tdo24m_ops = {
42681+static const struct lcd_ops tdo24m_ops = {
42682 .get_power = tdo24m_get_power,
42683 .set_power = tdo24m_set_power,
42684 .set_mode = tdo24m_set_mode,
42685diff -urNp linux-2.6.39.1/drivers/video/backlight/tosa_lcd.c linux-2.6.39.1/drivers/video/backlight/tosa_lcd.c
42686--- linux-2.6.39.1/drivers/video/backlight/tosa_lcd.c 2011-05-19 00:06:34.000000000 -0400
42687+++ linux-2.6.39.1/drivers/video/backlight/tosa_lcd.c 2011-05-22 19:36:32.000000000 -0400
42688@@ -163,7 +163,7 @@ static int tosa_lcd_set_mode(struct lcd_
42689 return 0;
42690 }
42691
42692-static struct lcd_ops tosa_lcd_ops = {
42693+static const struct lcd_ops tosa_lcd_ops = {
42694 .set_power = tosa_lcd_set_power,
42695 .get_power = tosa_lcd_get_power,
42696 .set_mode = tosa_lcd_set_mode,
42697diff -urNp linux-2.6.39.1/drivers/video/bf537-lq035.c linux-2.6.39.1/drivers/video/bf537-lq035.c
42698--- linux-2.6.39.1/drivers/video/bf537-lq035.c 2011-05-19 00:06:34.000000000 -0400
42699+++ linux-2.6.39.1/drivers/video/bf537-lq035.c 2011-05-22 19:36:32.000000000 -0400
42700@@ -682,7 +682,7 @@ static int bfin_lcd_check_fb(struct lcd_
42701 return 0;
42702 }
42703
42704-static struct lcd_ops bfin_lcd_ops = {
42705+static const struct lcd_ops bfin_lcd_ops = {
42706 .get_power = bfin_lcd_get_power,
42707 .set_power = bfin_lcd_set_power,
42708 .get_contrast = bfin_lcd_get_contrast,
42709diff -urNp linux-2.6.39.1/drivers/video/bf54x-lq043fb.c linux-2.6.39.1/drivers/video/bf54x-lq043fb.c
42710--- linux-2.6.39.1/drivers/video/bf54x-lq043fb.c 2011-05-19 00:06:34.000000000 -0400
42711+++ linux-2.6.39.1/drivers/video/bf54x-lq043fb.c 2011-05-22 19:36:32.000000000 -0400
42712@@ -467,7 +467,7 @@ static int bfin_lcd_check_fb(struct lcd_
42713 return 0;
42714 }
42715
42716-static struct lcd_ops bfin_lcd_ops = {
42717+static const struct lcd_ops bfin_lcd_ops = {
42718 .get_power = bfin_lcd_get_power,
42719 .set_power = bfin_lcd_set_power,
42720 .get_contrast = bfin_lcd_get_contrast,
42721diff -urNp linux-2.6.39.1/drivers/video/bfin-t350mcqb-fb.c linux-2.6.39.1/drivers/video/bfin-t350mcqb-fb.c
42722--- linux-2.6.39.1/drivers/video/bfin-t350mcqb-fb.c 2011-05-19 00:06:34.000000000 -0400
42723+++ linux-2.6.39.1/drivers/video/bfin-t350mcqb-fb.c 2011-05-22 19:36:32.000000000 -0400
42724@@ -387,7 +387,7 @@ static int bfin_lcd_check_fb(struct lcd_
42725 return 0;
42726 }
42727
42728-static struct lcd_ops bfin_lcd_ops = {
42729+static const struct lcd_ops bfin_lcd_ops = {
42730 .get_power = bfin_lcd_get_power,
42731 .set_power = bfin_lcd_set_power,
42732 .get_contrast = bfin_lcd_get_contrast,
42733diff -urNp linux-2.6.39.1/drivers/video/fbcmap.c linux-2.6.39.1/drivers/video/fbcmap.c
42734--- linux-2.6.39.1/drivers/video/fbcmap.c 2011-05-19 00:06:34.000000000 -0400
42735+++ linux-2.6.39.1/drivers/video/fbcmap.c 2011-05-22 19:36:32.000000000 -0400
42736@@ -285,8 +285,7 @@ int fb_set_user_cmap(struct fb_cmap_user
42737 rc = -ENODEV;
42738 goto out;
42739 }
42740- if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
42741- !info->fbops->fb_setcmap)) {
42742+ if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
42743 rc = -EINVAL;
42744 goto out1;
42745 }
42746diff -urNp linux-2.6.39.1/drivers/video/fbmem.c linux-2.6.39.1/drivers/video/fbmem.c
42747--- linux-2.6.39.1/drivers/video/fbmem.c 2011-05-19 00:06:34.000000000 -0400
42748+++ linux-2.6.39.1/drivers/video/fbmem.c 2011-05-22 19:36:32.000000000 -0400
42749@@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_in
42750 image->dx += image->width + 8;
42751 }
42752 } else if (rotate == FB_ROTATE_UD) {
42753- for (x = 0; x < num && image->dx >= 0; x++) {
42754+ for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
42755 info->fbops->fb_imageblit(info, image);
42756 image->dx -= image->width + 8;
42757 }
42758@@ -440,7 +440,7 @@ static void fb_do_show_logo(struct fb_in
42759 image->dy += image->height + 8;
42760 }
42761 } else if (rotate == FB_ROTATE_CCW) {
42762- for (x = 0; x < num && image->dy >= 0; x++) {
42763+ for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
42764 info->fbops->fb_imageblit(info, image);
42765 image->dy -= image->height + 8;
42766 }
42767@@ -939,6 +939,8 @@ fb_set_var(struct fb_info *info, struct
42768 int flags = info->flags;
42769 int ret = 0;
42770
42771+ pax_track_stack();
42772+
42773 if (var->activate & FB_ACTIVATE_INV_MODE) {
42774 struct fb_videomode mode1, mode2;
42775
42776@@ -1064,6 +1066,8 @@ static long do_fb_ioctl(struct fb_info *
42777 void __user *argp = (void __user *)arg;
42778 long ret = 0;
42779
42780+ pax_track_stack();
42781+
42782 switch (cmd) {
42783 case FBIOGET_VSCREENINFO:
42784 if (!lock_fb_info(info))
42785@@ -1143,7 +1147,7 @@ static long do_fb_ioctl(struct fb_info *
42786 return -EFAULT;
42787 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
42788 return -EINVAL;
42789- if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
42790+ if (con2fb.framebuffer >= FB_MAX)
42791 return -EINVAL;
42792 if (!registered_fb[con2fb.framebuffer])
42793 request_module("fb%d", con2fb.framebuffer);
42794diff -urNp linux-2.6.39.1/drivers/video/geode/display_gx1.c linux-2.6.39.1/drivers/video/geode/display_gx1.c
42795--- linux-2.6.39.1/drivers/video/geode/display_gx1.c 2011-05-19 00:06:34.000000000 -0400
42796+++ linux-2.6.39.1/drivers/video/geode/display_gx1.c 2011-05-22 19:36:32.000000000 -0400
42797@@ -208,7 +208,7 @@ static void gx1_set_hw_palette_reg(struc
42798 writel(val, par->dc_regs + DC_PAL_DATA);
42799 }
42800
42801-struct geode_dc_ops gx1_dc_ops = {
42802+const struct geode_dc_ops gx1_dc_ops = {
42803 .set_mode = gx1_set_mode,
42804 .set_palette_reg = gx1_set_hw_palette_reg,
42805 };
42806diff -urNp linux-2.6.39.1/drivers/video/geode/display_gx1.h linux-2.6.39.1/drivers/video/geode/display_gx1.h
42807--- linux-2.6.39.1/drivers/video/geode/display_gx1.h 2011-05-19 00:06:34.000000000 -0400
42808+++ linux-2.6.39.1/drivers/video/geode/display_gx1.h 2011-05-22 19:36:32.000000000 -0400
42809@@ -18,7 +18,7 @@
42810 unsigned gx1_gx_base(void);
42811 int gx1_frame_buffer_size(void);
42812
42813-extern struct geode_dc_ops gx1_dc_ops;
42814+extern const struct geode_dc_ops gx1_dc_ops;
42815
42816 /* GX1 configuration I/O registers */
42817
42818diff -urNp linux-2.6.39.1/drivers/video/geode/geodefb.h linux-2.6.39.1/drivers/video/geode/geodefb.h
42819--- linux-2.6.39.1/drivers/video/geode/geodefb.h 2011-05-19 00:06:34.000000000 -0400
42820+++ linux-2.6.39.1/drivers/video/geode/geodefb.h 2011-05-22 19:36:32.000000000 -0400
42821@@ -31,8 +31,8 @@ struct geodefb_par {
42822 int panel_y;
42823 void __iomem *dc_regs;
42824 void __iomem *vid_regs;
42825- struct geode_dc_ops *dc_ops;
42826- struct geode_vid_ops *vid_ops;
42827+ const struct geode_dc_ops *dc_ops;
42828+ const struct geode_vid_ops *vid_ops;
42829 };
42830
42831 #endif /* !__GEODEFB_H__ */
42832diff -urNp linux-2.6.39.1/drivers/video/geode/video_cs5530.c linux-2.6.39.1/drivers/video/geode/video_cs5530.c
42833--- linux-2.6.39.1/drivers/video/geode/video_cs5530.c 2011-05-19 00:06:34.000000000 -0400
42834+++ linux-2.6.39.1/drivers/video/geode/video_cs5530.c 2011-05-22 19:36:32.000000000 -0400
42835@@ -186,7 +186,7 @@ static int cs5530_blank_display(struct f
42836 return 0;
42837 }
42838
42839-struct geode_vid_ops cs5530_vid_ops = {
42840+const struct geode_vid_ops cs5530_vid_ops = {
42841 .set_dclk = cs5530_set_dclk_frequency,
42842 .configure_display = cs5530_configure_display,
42843 .blank_display = cs5530_blank_display,
42844diff -urNp linux-2.6.39.1/drivers/video/geode/video_cs5530.h linux-2.6.39.1/drivers/video/geode/video_cs5530.h
42845--- linux-2.6.39.1/drivers/video/geode/video_cs5530.h 2011-05-19 00:06:34.000000000 -0400
42846+++ linux-2.6.39.1/drivers/video/geode/video_cs5530.h 2011-05-22 19:36:32.000000000 -0400
42847@@ -15,7 +15,7 @@
42848 #ifndef __VIDEO_CS5530_H__
42849 #define __VIDEO_CS5530_H__
42850
42851-extern struct geode_vid_ops cs5530_vid_ops;
42852+extern const struct geode_vid_ops cs5530_vid_ops;
42853
42854 /* CS5530 Video device registers */
42855
42856diff -urNp linux-2.6.39.1/drivers/video/i810/i810_accel.c linux-2.6.39.1/drivers/video/i810/i810_accel.c
42857--- linux-2.6.39.1/drivers/video/i810/i810_accel.c 2011-05-19 00:06:34.000000000 -0400
42858+++ linux-2.6.39.1/drivers/video/i810/i810_accel.c 2011-05-22 19:36:32.000000000 -0400
42859@@ -73,6 +73,7 @@ static inline int wait_for_space(struct
42860 }
42861 }
42862 printk("ringbuffer lockup!!!\n");
42863+ printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
42864 i810_report_error(mmio);
42865 par->dev_flags |= LOCKUP;
42866 info->pixmap.scan_align = 1;
42867diff -urNp linux-2.6.39.1/drivers/video/matrox/matroxfb_base.c linux-2.6.39.1/drivers/video/matrox/matroxfb_base.c
42868--- linux-2.6.39.1/drivers/video/matrox/matroxfb_base.c 2011-05-19 00:06:34.000000000 -0400
42869+++ linux-2.6.39.1/drivers/video/matrox/matroxfb_base.c 2011-05-22 19:36:32.000000000 -0400
42870@@ -1232,7 +1232,7 @@ static struct fb_ops matroxfb_ops = {
42871 #define RSText 0x7
42872 #define RSText8 0x8
42873 /* 9-F */
42874-static struct { struct fb_bitfield red, green, blue, transp; int bits_per_pixel; } colors[] = {
42875+static const struct { struct fb_bitfield red, green, blue, transp; int bits_per_pixel; } colors[] = {
42876 { { 0, 8, 0}, { 0, 8, 0}, { 0, 8, 0}, { 0, 0, 0}, 8 },
42877 { { 10, 5, 0}, { 5, 5, 0}, { 0, 5, 0}, { 15, 1, 0}, 16 },
42878 { { 11, 5, 0}, { 5, 6, 0}, { 0, 5, 0}, { 0, 0, 0}, 16 },
42879diff -urNp linux-2.6.39.1/drivers/video/omap/lcd_ams_delta.c linux-2.6.39.1/drivers/video/omap/lcd_ams_delta.c
42880--- linux-2.6.39.1/drivers/video/omap/lcd_ams_delta.c 2011-05-19 00:06:34.000000000 -0400
42881+++ linux-2.6.39.1/drivers/video/omap/lcd_ams_delta.c 2011-05-22 19:36:32.000000000 -0400
42882@@ -87,7 +87,7 @@ static int ams_delta_lcd_get_contrast(st
42883 return ams_delta_lcd & AMS_DELTA_MAX_CONTRAST;
42884 }
42885
42886-static struct lcd_ops ams_delta_lcd_ops = {
42887+static const struct lcd_ops ams_delta_lcd_ops = {
42888 .get_power = ams_delta_lcd_get_power,
42889 .set_power = ams_delta_lcd_set_power,
42890 .get_contrast = ams_delta_lcd_get_contrast,
42891diff -urNp linux-2.6.39.1/drivers/video/pxa3xx-gcu.c linux-2.6.39.1/drivers/video/pxa3xx-gcu.c
42892--- linux-2.6.39.1/drivers/video/pxa3xx-gcu.c 2011-05-19 00:06:34.000000000 -0400
42893+++ linux-2.6.39.1/drivers/video/pxa3xx-gcu.c 2011-05-22 19:36:32.000000000 -0400
42894@@ -103,7 +103,7 @@ struct pxa3xx_gcu_priv {
42895 dma_addr_t shared_phys;
42896 struct resource *resource_mem;
42897 struct miscdevice misc_dev;
42898- struct file_operations misc_fops;
42899+ const struct file_operations misc_fops;
42900 wait_queue_head_t wait_idle;
42901 wait_queue_head_t wait_free;
42902 spinlock_t spinlock;
42903diff -urNp linux-2.6.39.1/drivers/video/sh_mobile_lcdcfb.c linux-2.6.39.1/drivers/video/sh_mobile_lcdcfb.c
42904--- linux-2.6.39.1/drivers/video/sh_mobile_lcdcfb.c 2011-05-19 00:06:34.000000000 -0400
42905+++ linux-2.6.39.1/drivers/video/sh_mobile_lcdcfb.c 2011-05-22 19:36:32.000000000 -0400
42906@@ -245,7 +245,7 @@ static unsigned long lcdc_sys_read_data(
42907 return lcdc_read(ch->lcdc, _LDDRDR) & 0x3ffff;
42908 }
42909
42910-struct sh_mobile_lcdc_sys_bus_ops sh_mobile_lcdc_sys_bus_ops = {
42911+const struct sh_mobile_lcdc_sys_bus_ops sh_mobile_lcdc_sys_bus_ops = {
42912 lcdc_sys_write_index,
42913 lcdc_sys_write_data,
42914 lcdc_sys_read_data,
42915diff -urNp linux-2.6.39.1/drivers/video/udlfb.c linux-2.6.39.1/drivers/video/udlfb.c
42916--- linux-2.6.39.1/drivers/video/udlfb.c 2011-05-19 00:06:34.000000000 -0400
42917+++ linux-2.6.39.1/drivers/video/udlfb.c 2011-05-22 19:36:32.000000000 -0400
42918@@ -584,11 +584,11 @@ int dlfb_handle_damage(struct dlfb_data
42919 dlfb_urb_completion(urb);
42920
42921 error:
42922- atomic_add(bytes_sent, &dev->bytes_sent);
42923- atomic_add(bytes_identical, &dev->bytes_identical);
42924- atomic_add(width*height*2, &dev->bytes_rendered);
42925+ atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
42926+ atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
42927+ atomic_add_unchecked(width*height*2, &dev->bytes_rendered);
42928 end_cycles = get_cycles();
42929- atomic_add(((unsigned int) ((end_cycles - start_cycles)
42930+ atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
42931 >> 10)), /* Kcycles */
42932 &dev->cpu_kcycles_used);
42933
42934@@ -709,11 +709,11 @@ static void dlfb_dpy_deferred_io(struct
42935 dlfb_urb_completion(urb);
42936
42937 error:
42938- atomic_add(bytes_sent, &dev->bytes_sent);
42939- atomic_add(bytes_identical, &dev->bytes_identical);
42940- atomic_add(bytes_rendered, &dev->bytes_rendered);
42941+ atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
42942+ atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
42943+ atomic_add_unchecked(bytes_rendered, &dev->bytes_rendered);
42944 end_cycles = get_cycles();
42945- atomic_add(((unsigned int) ((end_cycles - start_cycles)
42946+ atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
42947 >> 10)), /* Kcycles */
42948 &dev->cpu_kcycles_used);
42949 }
42950@@ -1301,7 +1301,7 @@ static ssize_t metrics_bytes_rendered_sh
42951 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42952 struct dlfb_data *dev = fb_info->par;
42953 return snprintf(buf, PAGE_SIZE, "%u\n",
42954- atomic_read(&dev->bytes_rendered));
42955+ atomic_read_unchecked(&dev->bytes_rendered));
42956 }
42957
42958 static ssize_t metrics_bytes_identical_show(struct device *fbdev,
42959@@ -1309,7 +1309,7 @@ static ssize_t metrics_bytes_identical_s
42960 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42961 struct dlfb_data *dev = fb_info->par;
42962 return snprintf(buf, PAGE_SIZE, "%u\n",
42963- atomic_read(&dev->bytes_identical));
42964+ atomic_read_unchecked(&dev->bytes_identical));
42965 }
42966
42967 static ssize_t metrics_bytes_sent_show(struct device *fbdev,
42968@@ -1317,7 +1317,7 @@ static ssize_t metrics_bytes_sent_show(s
42969 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42970 struct dlfb_data *dev = fb_info->par;
42971 return snprintf(buf, PAGE_SIZE, "%u\n",
42972- atomic_read(&dev->bytes_sent));
42973+ atomic_read_unchecked(&dev->bytes_sent));
42974 }
42975
42976 static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
42977@@ -1325,7 +1325,7 @@ static ssize_t metrics_cpu_kcycles_used_
42978 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42979 struct dlfb_data *dev = fb_info->par;
42980 return snprintf(buf, PAGE_SIZE, "%u\n",
42981- atomic_read(&dev->cpu_kcycles_used));
42982+ atomic_read_unchecked(&dev->cpu_kcycles_used));
42983 }
42984
42985 static ssize_t edid_show(
42986@@ -1382,10 +1382,10 @@ static ssize_t metrics_reset_store(struc
42987 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42988 struct dlfb_data *dev = fb_info->par;
42989
42990- atomic_set(&dev->bytes_rendered, 0);
42991- atomic_set(&dev->bytes_identical, 0);
42992- atomic_set(&dev->bytes_sent, 0);
42993- atomic_set(&dev->cpu_kcycles_used, 0);
42994+ atomic_set_unchecked(&dev->bytes_rendered, 0);
42995+ atomic_set_unchecked(&dev->bytes_identical, 0);
42996+ atomic_set_unchecked(&dev->bytes_sent, 0);
42997+ atomic_set_unchecked(&dev->cpu_kcycles_used, 0);
42998
42999 return count;
43000 }
43001diff -urNp linux-2.6.39.1/drivers/video/uvesafb.c linux-2.6.39.1/drivers/video/uvesafb.c
43002--- linux-2.6.39.1/drivers/video/uvesafb.c 2011-05-19 00:06:34.000000000 -0400
43003+++ linux-2.6.39.1/drivers/video/uvesafb.c 2011-05-22 19:36:32.000000000 -0400
43004@@ -19,6 +19,7 @@
43005 #include <linux/io.h>
43006 #include <linux/mutex.h>
43007 #include <linux/slab.h>
43008+#include <linux/moduleloader.h>
43009 #include <video/edid.h>
43010 #include <video/uvesafb.h>
43011 #ifdef CONFIG_X86
43012@@ -121,7 +122,7 @@ static int uvesafb_helper_start(void)
43013 NULL,
43014 };
43015
43016- return call_usermodehelper(v86d_path, argv, envp, 1);
43017+ return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
43018 }
43019
43020 /*
43021@@ -569,10 +570,32 @@ static int __devinit uvesafb_vbe_getpmi(
43022 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
43023 par->pmi_setpal = par->ypan = 0;
43024 } else {
43025+
43026+#ifdef CONFIG_PAX_KERNEXEC
43027+#ifdef CONFIG_MODULES
43028+ par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
43029+#endif
43030+ if (!par->pmi_code) {
43031+ par->pmi_setpal = par->ypan = 0;
43032+ return 0;
43033+ }
43034+#endif
43035+
43036 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
43037 + task->t.regs.edi);
43038+
43039+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43040+ pax_open_kernel();
43041+ memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
43042+ pax_close_kernel();
43043+
43044+ par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
43045+ par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
43046+#else
43047 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
43048 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
43049+#endif
43050+
43051 printk(KERN_INFO "uvesafb: protected mode interface info at "
43052 "%04x:%04x\n",
43053 (u16)task->t.regs.es, (u16)task->t.regs.edi);
43054@@ -1821,6 +1844,11 @@ out:
43055 if (par->vbe_modes)
43056 kfree(par->vbe_modes);
43057
43058+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43059+ if (par->pmi_code)
43060+ module_free_exec(NULL, par->pmi_code);
43061+#endif
43062+
43063 framebuffer_release(info);
43064 return err;
43065 }
43066@@ -1847,6 +1875,12 @@ static int uvesafb_remove(struct platfor
43067 kfree(par->vbe_state_orig);
43068 if (par->vbe_state_saved)
43069 kfree(par->vbe_state_saved);
43070+
43071+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43072+ if (par->pmi_code)
43073+ module_free_exec(NULL, par->pmi_code);
43074+#endif
43075+
43076 }
43077
43078 framebuffer_release(info);
43079@@ -2013,7 +2047,7 @@ static int param_set_scroll(const char *
43080
43081 return 0;
43082 }
43083-static struct kernel_param_ops param_ops_scroll = {
43084+static const struct kernel_param_ops param_ops_scroll = {
43085 .set = param_set_scroll,
43086 };
43087 #define param_check_scroll(name, p) __param_check(name, p, void)
43088diff -urNp linux-2.6.39.1/drivers/video/vesafb.c linux-2.6.39.1/drivers/video/vesafb.c
43089--- linux-2.6.39.1/drivers/video/vesafb.c 2011-05-19 00:06:34.000000000 -0400
43090+++ linux-2.6.39.1/drivers/video/vesafb.c 2011-05-22 19:36:32.000000000 -0400
43091@@ -9,6 +9,7 @@
43092 */
43093
43094 #include <linux/module.h>
43095+#include <linux/moduleloader.h>
43096 #include <linux/kernel.h>
43097 #include <linux/errno.h>
43098 #include <linux/string.h>
43099@@ -52,8 +53,8 @@ static int vram_remap __initdata; /*
43100 static int vram_total __initdata; /* Set total amount of memory */
43101 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
43102 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
43103-static void (*pmi_start)(void) __read_mostly;
43104-static void (*pmi_pal) (void) __read_mostly;
43105+static void (*pmi_start)(void) __read_only;
43106+static void (*pmi_pal) (void) __read_only;
43107 static int depth __read_mostly;
43108 static int vga_compat __read_mostly;
43109 /* --------------------------------------------------------------------- */
43110@@ -232,6 +233,7 @@ static int __init vesafb_probe(struct pl
43111 unsigned int size_vmode;
43112 unsigned int size_remap;
43113 unsigned int size_total;
43114+ void *pmi_code = NULL;
43115
43116 if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
43117 return -ENODEV;
43118@@ -274,10 +276,6 @@ static int __init vesafb_probe(struct pl
43119 size_remap = size_total;
43120 vesafb_fix.smem_len = size_remap;
43121
43122-#ifndef __i386__
43123- screen_info.vesapm_seg = 0;
43124-#endif
43125-
43126 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
43127 printk(KERN_WARNING
43128 "vesafb: cannot reserve video memory at 0x%lx\n",
43129@@ -306,9 +304,21 @@ static int __init vesafb_probe(struct pl
43130 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
43131 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
43132
43133+#ifdef __i386__
43134+
43135+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43136+ pmi_code = module_alloc_exec(screen_info.vesapm_size);
43137+ if (!pmi_code)
43138+#elif !defined(CONFIG_PAX_KERNEXEC)
43139+ if (0)
43140+#endif
43141+
43142+#endif
43143+ screen_info.vesapm_seg = 0;
43144+
43145 if (screen_info.vesapm_seg) {
43146- printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
43147- screen_info.vesapm_seg,screen_info.vesapm_off);
43148+ printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
43149+ screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
43150 }
43151
43152 if (screen_info.vesapm_seg < 0xc000)
43153@@ -316,9 +326,25 @@ static int __init vesafb_probe(struct pl
43154
43155 if (ypan || pmi_setpal) {
43156 unsigned short *pmi_base;
43157- pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
43158- pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
43159- pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
43160+
43161+ pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
43162+
43163+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43164+ pax_open_kernel();
43165+ memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
43166+#else
43167+ pmi_code = pmi_base;
43168+#endif
43169+
43170+ pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
43171+ pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
43172+
43173+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43174+ pmi_start = ktva_ktla(pmi_start);
43175+ pmi_pal = ktva_ktla(pmi_pal);
43176+ pax_close_kernel();
43177+#endif
43178+
43179 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
43180 if (pmi_base[3]) {
43181 printk(KERN_INFO "vesafb: pmi: ports = ");
43182@@ -487,6 +513,11 @@ static int __init vesafb_probe(struct pl
43183 info->node, info->fix.id);
43184 return 0;
43185 err:
43186+
43187+#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43188+ module_free_exec(NULL, pmi_code);
43189+#endif
43190+
43191 if (info->screen_base)
43192 iounmap(info->screen_base);
43193 framebuffer_release(info);
43194diff -urNp linux-2.6.39.1/drivers/virtio/virtio_balloon.c linux-2.6.39.1/drivers/virtio/virtio_balloon.c
43195--- linux-2.6.39.1/drivers/virtio/virtio_balloon.c 2011-05-19 00:06:34.000000000 -0400
43196+++ linux-2.6.39.1/drivers/virtio/virtio_balloon.c 2011-05-22 19:36:32.000000000 -0400
43197@@ -176,6 +176,8 @@ static void update_balloon_stats(struct
43198 struct sysinfo i;
43199 int idx = 0;
43200
43201+ pax_track_stack();
43202+
43203 all_vm_events(events);
43204 si_meminfo(&i);
43205
43206diff -urNp linux-2.6.39.1/drivers/xen/gntalloc.c linux-2.6.39.1/drivers/xen/gntalloc.c
43207--- linux-2.6.39.1/drivers/xen/gntalloc.c 2011-05-19 00:06:34.000000000 -0400
43208+++ linux-2.6.39.1/drivers/xen/gntalloc.c 2011-05-22 19:36:32.000000000 -0400
43209@@ -440,7 +440,7 @@ static void gntalloc_vma_close(struct vm
43210 spin_unlock(&gref_lock);
43211 }
43212
43213-static struct vm_operations_struct gntalloc_vmops = {
43214+static const struct vm_operations_struct gntalloc_vmops = {
43215 .close = gntalloc_vma_close,
43216 };
43217
43218diff -urNp linux-2.6.39.1/drivers/xen/gntdev.c linux-2.6.39.1/drivers/xen/gntdev.c
43219--- linux-2.6.39.1/drivers/xen/gntdev.c 2011-05-19 00:06:34.000000000 -0400
43220+++ linux-2.6.39.1/drivers/xen/gntdev.c 2011-05-22 19:36:32.000000000 -0400
43221@@ -340,7 +340,7 @@ static void gntdev_vma_close(struct vm_a
43222 gntdev_put_map(map);
43223 }
43224
43225-static struct vm_operations_struct gntdev_vmops = {
43226+static const struct vm_operations_struct gntdev_vmops = {
43227 .close = gntdev_vma_close,
43228 };
43229
43230@@ -404,7 +404,7 @@ static void mn_release(struct mmu_notifi
43231 spin_unlock(&priv->lock);
43232 }
43233
43234-struct mmu_notifier_ops gntdev_mmu_ops = {
43235+const struct mmu_notifier_ops gntdev_mmu_ops = {
43236 .release = mn_release,
43237 .invalidate_page = mn_invl_page,
43238 .invalidate_range_start = mn_invl_range_start,
43239diff -urNp linux-2.6.39.1/drivers/xen/xenfs/privcmd.c linux-2.6.39.1/drivers/xen/xenfs/privcmd.c
43240--- linux-2.6.39.1/drivers/xen/xenfs/privcmd.c 2011-05-19 00:06:34.000000000 -0400
43241+++ linux-2.6.39.1/drivers/xen/xenfs/privcmd.c 2011-05-22 19:36:32.000000000 -0400
43242@@ -268,7 +268,7 @@ static int mmap_return_errors(void *data
43243 return put_user(*mfnp, st->user++);
43244 }
43245
43246-static struct vm_operations_struct privcmd_vm_ops;
43247+static const struct vm_operations_struct privcmd_vm_ops;
43248
43249 static long privcmd_ioctl_mmap_batch(void __user *udata)
43250 {
43251@@ -369,7 +369,7 @@ static int privcmd_fault(struct vm_area_
43252 return VM_FAULT_SIGBUS;
43253 }
43254
43255-static struct vm_operations_struct privcmd_vm_ops = {
43256+static const struct vm_operations_struct privcmd_vm_ops = {
43257 .fault = privcmd_fault
43258 };
43259
43260diff -urNp linux-2.6.39.1/fs/9p/vfs_inode.c linux-2.6.39.1/fs/9p/vfs_inode.c
43261--- linux-2.6.39.1/fs/9p/vfs_inode.c 2011-05-19 00:06:34.000000000 -0400
43262+++ linux-2.6.39.1/fs/9p/vfs_inode.c 2011-05-22 19:36:32.000000000 -0400
43263@@ -1210,7 +1210,7 @@ static void *v9fs_vfs_follow_link(struct
43264 void
43265 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
43266 {
43267- char *s = nd_get_link(nd);
43268+ const char *s = nd_get_link(nd);
43269
43270 P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
43271 IS_ERR(s) ? "<error>" : s);
43272diff -urNp linux-2.6.39.1/fs/aio.c linux-2.6.39.1/fs/aio.c
43273--- linux-2.6.39.1/fs/aio.c 2011-05-19 00:06:34.000000000 -0400
43274+++ linux-2.6.39.1/fs/aio.c 2011-06-03 01:00:34.000000000 -0400
43275@@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx
43276 size += sizeof(struct io_event) * nr_events;
43277 nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
43278
43279- if (nr_pages < 0)
43280+ if (nr_pages <= 0)
43281 return -EINVAL;
43282
43283 nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
43284@@ -1088,6 +1088,8 @@ static int read_events(struct kioctx *ct
43285 struct aio_timeout to;
43286 int retry = 0;
43287
43288+ pax_track_stack();
43289+
43290 /* needed to zero any padding within an entry (there shouldn't be
43291 * any, but C is fun!
43292 */
43293@@ -1381,22 +1383,27 @@ static ssize_t aio_fsync(struct kiocb *i
43294 static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
43295 {
43296 ssize_t ret;
43297+ struct iovec iovstack;
43298
43299 #ifdef CONFIG_COMPAT
43300 if (compat)
43301 ret = compat_rw_copy_check_uvector(type,
43302 (struct compat_iovec __user *)kiocb->ki_buf,
43303- kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
43304+ kiocb->ki_nbytes, 1, &iovstack,
43305 &kiocb->ki_iovec);
43306 else
43307 #endif
43308 ret = rw_copy_check_uvector(type,
43309 (struct iovec __user *)kiocb->ki_buf,
43310- kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
43311+ kiocb->ki_nbytes, 1, &iovstack,
43312 &kiocb->ki_iovec);
43313 if (ret < 0)
43314 goto out;
43315
43316+ if (kiocb->ki_iovec == &iovstack) {
43317+ kiocb->ki_inline_vec = iovstack;
43318+ kiocb->ki_iovec = &kiocb->ki_inline_vec;
43319+ }
43320 kiocb->ki_nr_segs = kiocb->ki_nbytes;
43321 kiocb->ki_cur_seg = 0;
43322 /* ki_nbytes/left now reflect bytes instead of segs */
43323diff -urNp linux-2.6.39.1/fs/attr.c linux-2.6.39.1/fs/attr.c
43324--- linux-2.6.39.1/fs/attr.c 2011-05-19 00:06:34.000000000 -0400
43325+++ linux-2.6.39.1/fs/attr.c 2011-05-22 19:41:37.000000000 -0400
43326@@ -98,6 +98,7 @@ int inode_newsize_ok(const struct inode
43327 unsigned long limit;
43328
43329 limit = rlimit(RLIMIT_FSIZE);
43330+ gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
43331 if (limit != RLIM_INFINITY && offset > limit)
43332 goto out_sig;
43333 if (offset > inode->i_sb->s_maxbytes)
43334diff -urNp linux-2.6.39.1/fs/befs/linuxvfs.c linux-2.6.39.1/fs/befs/linuxvfs.c
43335--- linux-2.6.39.1/fs/befs/linuxvfs.c 2011-05-19 00:06:34.000000000 -0400
43336+++ linux-2.6.39.1/fs/befs/linuxvfs.c 2011-05-22 19:36:32.000000000 -0400
43337@@ -498,7 +498,7 @@ static void befs_put_link(struct dentry
43338 {
43339 befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
43340 if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
43341- char *link = nd_get_link(nd);
43342+ const char *link = nd_get_link(nd);
43343 if (!IS_ERR(link))
43344 kfree(link);
43345 }
43346diff -urNp linux-2.6.39.1/fs/binfmt_aout.c linux-2.6.39.1/fs/binfmt_aout.c
43347--- linux-2.6.39.1/fs/binfmt_aout.c 2011-05-19 00:06:34.000000000 -0400
43348+++ linux-2.6.39.1/fs/binfmt_aout.c 2011-05-22 19:41:37.000000000 -0400
43349@@ -16,6 +16,7 @@
43350 #include <linux/string.h>
43351 #include <linux/fs.h>
43352 #include <linux/file.h>
43353+#include <linux/security.h>
43354 #include <linux/stat.h>
43355 #include <linux/fcntl.h>
43356 #include <linux/ptrace.h>
43357@@ -86,6 +87,8 @@ static int aout_core_dump(struct coredum
43358 #endif
43359 # define START_STACK(u) ((void __user *)u.start_stack)
43360
43361+ memset(&dump, 0, sizeof(dump));
43362+
43363 fs = get_fs();
43364 set_fs(KERNEL_DS);
43365 has_dumped = 1;
43366@@ -97,10 +100,12 @@ static int aout_core_dump(struct coredum
43367
43368 /* If the size of the dump file exceeds the rlimit, then see what would happen
43369 if we wrote the stack, but not the data area. */
43370+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
43371 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit)
43372 dump.u_dsize = 0;
43373
43374 /* Make sure we have enough room to write the stack and data areas. */
43375+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
43376 if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit)
43377 dump.u_ssize = 0;
43378
43379@@ -234,6 +239,8 @@ static int load_aout_binary(struct linux
43380 rlim = rlimit(RLIMIT_DATA);
43381 if (rlim >= RLIM_INFINITY)
43382 rlim = ~0;
43383+
43384+ gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
43385 if (ex.a_data + ex.a_bss > rlim)
43386 return -ENOMEM;
43387
43388@@ -262,6 +269,27 @@ static int load_aout_binary(struct linux
43389 install_exec_creds(bprm);
43390 current->flags &= ~PF_FORKNOEXEC;
43391
43392+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
43393+ current->mm->pax_flags = 0UL;
43394+#endif
43395+
43396+#ifdef CONFIG_PAX_PAGEEXEC
43397+ if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
43398+ current->mm->pax_flags |= MF_PAX_PAGEEXEC;
43399+
43400+#ifdef CONFIG_PAX_EMUTRAMP
43401+ if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
43402+ current->mm->pax_flags |= MF_PAX_EMUTRAMP;
43403+#endif
43404+
43405+#ifdef CONFIG_PAX_MPROTECT
43406+ if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
43407+ current->mm->pax_flags |= MF_PAX_MPROTECT;
43408+#endif
43409+
43410+ }
43411+#endif
43412+
43413 if (N_MAGIC(ex) == OMAGIC) {
43414 unsigned long text_addr, map_size;
43415 loff_t pos;
43416@@ -334,7 +362,7 @@ static int load_aout_binary(struct linux
43417
43418 down_write(&current->mm->mmap_sem);
43419 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
43420- PROT_READ | PROT_WRITE | PROT_EXEC,
43421+ PROT_READ | PROT_WRITE,
43422 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
43423 fd_offset + ex.a_text);
43424 up_write(&current->mm->mmap_sem);
43425diff -urNp linux-2.6.39.1/fs/binfmt_elf.c linux-2.6.39.1/fs/binfmt_elf.c
43426--- linux-2.6.39.1/fs/binfmt_elf.c 2011-05-19 00:06:34.000000000 -0400
43427+++ linux-2.6.39.1/fs/binfmt_elf.c 2011-05-22 19:41:37.000000000 -0400
43428@@ -51,6 +51,10 @@ static int elf_core_dump(struct coredump
43429 #define elf_core_dump NULL
43430 #endif
43431
43432+#ifdef CONFIG_PAX_MPROTECT
43433+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
43434+#endif
43435+
43436 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
43437 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
43438 #else
43439@@ -70,6 +74,11 @@ static struct linux_binfmt elf_format =
43440 .load_binary = load_elf_binary,
43441 .load_shlib = load_elf_library,
43442 .core_dump = elf_core_dump,
43443+
43444+#ifdef CONFIG_PAX_MPROTECT
43445+ .handle_mprotect= elf_handle_mprotect,
43446+#endif
43447+
43448 .min_coredump = ELF_EXEC_PAGESIZE,
43449 };
43450
43451@@ -77,6 +86,8 @@ static struct linux_binfmt elf_format =
43452
43453 static int set_brk(unsigned long start, unsigned long end)
43454 {
43455+ unsigned long e = end;
43456+
43457 start = ELF_PAGEALIGN(start);
43458 end = ELF_PAGEALIGN(end);
43459 if (end > start) {
43460@@ -87,7 +98,7 @@ static int set_brk(unsigned long start,
43461 if (BAD_ADDR(addr))
43462 return addr;
43463 }
43464- current->mm->start_brk = current->mm->brk = end;
43465+ current->mm->start_brk = current->mm->brk = e;
43466 return 0;
43467 }
43468
43469@@ -148,12 +159,15 @@ create_elf_tables(struct linux_binprm *b
43470 elf_addr_t __user *u_rand_bytes;
43471 const char *k_platform = ELF_PLATFORM;
43472 const char *k_base_platform = ELF_BASE_PLATFORM;
43473- unsigned char k_rand_bytes[16];
43474+ u32 k_rand_bytes[4];
43475 int items;
43476 elf_addr_t *elf_info;
43477 int ei_index = 0;
43478 const struct cred *cred = current_cred();
43479 struct vm_area_struct *vma;
43480+ unsigned long saved_auxv[AT_VECTOR_SIZE];
43481+
43482+ pax_track_stack();
43483
43484 /*
43485 * In some cases (e.g. Hyper-Threading), we want to avoid L1
43486@@ -195,8 +209,12 @@ create_elf_tables(struct linux_binprm *b
43487 * Generate 16 random bytes for userspace PRNG seeding.
43488 */
43489 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
43490- u_rand_bytes = (elf_addr_t __user *)
43491- STACK_ALLOC(p, sizeof(k_rand_bytes));
43492+ srandom32(k_rand_bytes[0] ^ random32());
43493+ srandom32(k_rand_bytes[1] ^ random32());
43494+ srandom32(k_rand_bytes[2] ^ random32());
43495+ srandom32(k_rand_bytes[3] ^ random32());
43496+ p = STACK_ROUND(p, sizeof(k_rand_bytes));
43497+ u_rand_bytes = (elf_addr_t __user *) p;
43498 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
43499 return -EFAULT;
43500
43501@@ -308,9 +326,11 @@ create_elf_tables(struct linux_binprm *b
43502 return -EFAULT;
43503 current->mm->env_end = p;
43504
43505+ memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
43506+
43507 /* Put the elf_info on the stack in the right place. */
43508 sp = (elf_addr_t __user *)envp + 1;
43509- if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
43510+ if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
43511 return -EFAULT;
43512 return 0;
43513 }
43514@@ -381,10 +401,10 @@ static unsigned long load_elf_interp(str
43515 {
43516 struct elf_phdr *elf_phdata;
43517 struct elf_phdr *eppnt;
43518- unsigned long load_addr = 0;
43519+ unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
43520 int load_addr_set = 0;
43521 unsigned long last_bss = 0, elf_bss = 0;
43522- unsigned long error = ~0UL;
43523+ unsigned long error = -EINVAL;
43524 unsigned long total_size;
43525 int retval, i, size;
43526
43527@@ -430,6 +450,11 @@ static unsigned long load_elf_interp(str
43528 goto out_close;
43529 }
43530
43531+#ifdef CONFIG_PAX_SEGMEXEC
43532+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
43533+ pax_task_size = SEGMEXEC_TASK_SIZE;
43534+#endif
43535+
43536 eppnt = elf_phdata;
43537 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
43538 if (eppnt->p_type == PT_LOAD) {
43539@@ -473,8 +498,8 @@ static unsigned long load_elf_interp(str
43540 k = load_addr + eppnt->p_vaddr;
43541 if (BAD_ADDR(k) ||
43542 eppnt->p_filesz > eppnt->p_memsz ||
43543- eppnt->p_memsz > TASK_SIZE ||
43544- TASK_SIZE - eppnt->p_memsz < k) {
43545+ eppnt->p_memsz > pax_task_size ||
43546+ pax_task_size - eppnt->p_memsz < k) {
43547 error = -ENOMEM;
43548 goto out_close;
43549 }
43550@@ -528,6 +553,193 @@ out:
43551 return error;
43552 }
43553
43554+#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
43555+static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
43556+{
43557+ unsigned long pax_flags = 0UL;
43558+
43559+#ifdef CONFIG_PAX_PAGEEXEC
43560+ if (elf_phdata->p_flags & PF_PAGEEXEC)
43561+ pax_flags |= MF_PAX_PAGEEXEC;
43562+#endif
43563+
43564+#ifdef CONFIG_PAX_SEGMEXEC
43565+ if (elf_phdata->p_flags & PF_SEGMEXEC)
43566+ pax_flags |= MF_PAX_SEGMEXEC;
43567+#endif
43568+
43569+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
43570+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43571+ if ((__supported_pte_mask & _PAGE_NX))
43572+ pax_flags &= ~MF_PAX_SEGMEXEC;
43573+ else
43574+ pax_flags &= ~MF_PAX_PAGEEXEC;
43575+ }
43576+#endif
43577+
43578+#ifdef CONFIG_PAX_EMUTRAMP
43579+ if (elf_phdata->p_flags & PF_EMUTRAMP)
43580+ pax_flags |= MF_PAX_EMUTRAMP;
43581+#endif
43582+
43583+#ifdef CONFIG_PAX_MPROTECT
43584+ if (elf_phdata->p_flags & PF_MPROTECT)
43585+ pax_flags |= MF_PAX_MPROTECT;
43586+#endif
43587+
43588+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
43589+ if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
43590+ pax_flags |= MF_PAX_RANDMMAP;
43591+#endif
43592+
43593+ return pax_flags;
43594+}
43595+#endif
43596+
43597+#ifdef CONFIG_PAX_PT_PAX_FLAGS
43598+static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
43599+{
43600+ unsigned long pax_flags = 0UL;
43601+
43602+#ifdef CONFIG_PAX_PAGEEXEC
43603+ if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
43604+ pax_flags |= MF_PAX_PAGEEXEC;
43605+#endif
43606+
43607+#ifdef CONFIG_PAX_SEGMEXEC
43608+ if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
43609+ pax_flags |= MF_PAX_SEGMEXEC;
43610+#endif
43611+
43612+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
43613+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43614+ if ((__supported_pte_mask & _PAGE_NX))
43615+ pax_flags &= ~MF_PAX_SEGMEXEC;
43616+ else
43617+ pax_flags &= ~MF_PAX_PAGEEXEC;
43618+ }
43619+#endif
43620+
43621+#ifdef CONFIG_PAX_EMUTRAMP
43622+ if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
43623+ pax_flags |= MF_PAX_EMUTRAMP;
43624+#endif
43625+
43626+#ifdef CONFIG_PAX_MPROTECT
43627+ if (!(elf_phdata->p_flags & PF_NOMPROTECT))
43628+ pax_flags |= MF_PAX_MPROTECT;
43629+#endif
43630+
43631+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
43632+ if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
43633+ pax_flags |= MF_PAX_RANDMMAP;
43634+#endif
43635+
43636+ return pax_flags;
43637+}
43638+#endif
43639+
43640+#ifdef CONFIG_PAX_EI_PAX
43641+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
43642+{
43643+ unsigned long pax_flags = 0UL;
43644+
43645+#ifdef CONFIG_PAX_PAGEEXEC
43646+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
43647+ pax_flags |= MF_PAX_PAGEEXEC;
43648+#endif
43649+
43650+#ifdef CONFIG_PAX_SEGMEXEC
43651+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
43652+ pax_flags |= MF_PAX_SEGMEXEC;
43653+#endif
43654+
43655+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
43656+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43657+ if ((__supported_pte_mask & _PAGE_NX))
43658+ pax_flags &= ~MF_PAX_SEGMEXEC;
43659+ else
43660+ pax_flags &= ~MF_PAX_PAGEEXEC;
43661+ }
43662+#endif
43663+
43664+#ifdef CONFIG_PAX_EMUTRAMP
43665+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
43666+ pax_flags |= MF_PAX_EMUTRAMP;
43667+#endif
43668+
43669+#ifdef CONFIG_PAX_MPROTECT
43670+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
43671+ pax_flags |= MF_PAX_MPROTECT;
43672+#endif
43673+
43674+#ifdef CONFIG_PAX_ASLR
43675+ if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
43676+ pax_flags |= MF_PAX_RANDMMAP;
43677+#endif
43678+
43679+ return pax_flags;
43680+}
43681+#endif
43682+
43683+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
43684+static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
43685+{
43686+ unsigned long pax_flags = 0UL;
43687+
43688+#ifdef CONFIG_PAX_PT_PAX_FLAGS
43689+ unsigned long i;
43690+ int found_flags = 0;
43691+#endif
43692+
43693+#ifdef CONFIG_PAX_EI_PAX
43694+ pax_flags = pax_parse_ei_pax(elf_ex);
43695+#endif
43696+
43697+#ifdef CONFIG_PAX_PT_PAX_FLAGS
43698+ for (i = 0UL; i < elf_ex->e_phnum; i++)
43699+ if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
43700+ if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
43701+ ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
43702+ ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
43703+ ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
43704+ ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
43705+ return -EINVAL;
43706+
43707+#ifdef CONFIG_PAX_SOFTMODE
43708+ if (pax_softmode)
43709+ pax_flags = pax_parse_softmode(&elf_phdata[i]);
43710+ else
43711+#endif
43712+
43713+ pax_flags = pax_parse_hardmode(&elf_phdata[i]);
43714+ found_flags = 1;
43715+ break;
43716+ }
43717+#endif
43718+
43719+#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS)
43720+ if (found_flags == 0) {
43721+ struct elf_phdr phdr;
43722+ memset(&phdr, 0, sizeof(phdr));
43723+ phdr.p_flags = PF_NOEMUTRAMP;
43724+#ifdef CONFIG_PAX_SOFTMODE
43725+ if (pax_softmode)
43726+ pax_flags = pax_parse_softmode(&phdr);
43727+ else
43728+#endif
43729+ pax_flags = pax_parse_hardmode(&phdr);
43730+ }
43731+#endif
43732+
43733+ if (0 > pax_check_flags(&pax_flags))
43734+ return -EINVAL;
43735+
43736+ current->mm->pax_flags = pax_flags;
43737+ return 0;
43738+}
43739+#endif
43740+
43741 /*
43742 * These are the functions used to load ELF style executables and shared
43743 * libraries. There is no binary dependent code anywhere else.
43744@@ -544,6 +756,11 @@ static unsigned long randomize_stack_top
43745 {
43746 unsigned int random_variable = 0;
43747
43748+#ifdef CONFIG_PAX_RANDUSTACK
43749+ if (randomize_va_space)
43750+ return stack_top - current->mm->delta_stack;
43751+#endif
43752+
43753 if ((current->flags & PF_RANDOMIZE) &&
43754 !(current->personality & ADDR_NO_RANDOMIZE)) {
43755 random_variable = get_random_int() & STACK_RND_MASK;
43756@@ -562,7 +779,7 @@ static int load_elf_binary(struct linux_
43757 unsigned long load_addr = 0, load_bias = 0;
43758 int load_addr_set = 0;
43759 char * elf_interpreter = NULL;
43760- unsigned long error;
43761+ unsigned long error = 0;
43762 struct elf_phdr *elf_ppnt, *elf_phdata;
43763 unsigned long elf_bss, elf_brk;
43764 int retval, i;
43765@@ -572,11 +789,11 @@ static int load_elf_binary(struct linux_
43766 unsigned long start_code, end_code, start_data, end_data;
43767 unsigned long reloc_func_desc __maybe_unused = 0;
43768 int executable_stack = EXSTACK_DEFAULT;
43769- unsigned long def_flags = 0;
43770 struct {
43771 struct elfhdr elf_ex;
43772 struct elfhdr interp_elf_ex;
43773 } *loc;
43774+ unsigned long pax_task_size = TASK_SIZE;
43775
43776 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
43777 if (!loc) {
43778@@ -714,11 +931,81 @@ static int load_elf_binary(struct linux_
43779
43780 /* OK, This is the point of no return */
43781 current->flags &= ~PF_FORKNOEXEC;
43782- current->mm->def_flags = def_flags;
43783+
43784+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
43785+ current->mm->pax_flags = 0UL;
43786+#endif
43787+
43788+#ifdef CONFIG_PAX_DLRESOLVE
43789+ current->mm->call_dl_resolve = 0UL;
43790+#endif
43791+
43792+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
43793+ current->mm->call_syscall = 0UL;
43794+#endif
43795+
43796+#ifdef CONFIG_PAX_ASLR
43797+ current->mm->delta_mmap = 0UL;
43798+ current->mm->delta_stack = 0UL;
43799+#endif
43800+
43801+ current->mm->def_flags = 0;
43802+
43803+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
43804+ if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
43805+ send_sig(SIGKILL, current, 0);
43806+ goto out_free_dentry;
43807+ }
43808+#endif
43809+
43810+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
43811+ pax_set_initial_flags(bprm);
43812+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
43813+ if (pax_set_initial_flags_func)
43814+ (pax_set_initial_flags_func)(bprm);
43815+#endif
43816+
43817+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
43818+ if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !(__supported_pte_mask & _PAGE_NX)) {
43819+ current->mm->context.user_cs_limit = PAGE_SIZE;
43820+ current->mm->def_flags |= VM_PAGEEXEC;
43821+ }
43822+#endif
43823+
43824+#ifdef CONFIG_PAX_SEGMEXEC
43825+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
43826+ current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
43827+ current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
43828+ pax_task_size = SEGMEXEC_TASK_SIZE;
43829+ current->mm->def_flags |= VM_NOHUGEPAGE;
43830+ }
43831+#endif
43832+
43833+#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
43834+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43835+ set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
43836+ put_cpu();
43837+ }
43838+#endif
43839
43840 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
43841 may depend on the personality. */
43842 SET_PERSONALITY(loc->elf_ex);
43843+
43844+#ifdef CONFIG_PAX_ASLR
43845+ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
43846+ current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
43847+ current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
43848+ }
43849+#endif
43850+
43851+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
43852+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43853+ executable_stack = EXSTACK_DISABLE_X;
43854+ current->personality &= ~READ_IMPLIES_EXEC;
43855+ } else
43856+#endif
43857+
43858 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
43859 current->personality |= READ_IMPLIES_EXEC;
43860
43861@@ -800,6 +1087,20 @@ static int load_elf_binary(struct linux_
43862 #else
43863 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
43864 #endif
43865+
43866+#ifdef CONFIG_PAX_RANDMMAP
43867+ /* PaX: randomize base address at the default exe base if requested */
43868+ if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
43869+#ifdef CONFIG_SPARC64
43870+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
43871+#else
43872+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
43873+#endif
43874+ load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
43875+ elf_flags |= MAP_FIXED;
43876+ }
43877+#endif
43878+
43879 }
43880
43881 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
43882@@ -832,9 +1133,9 @@ static int load_elf_binary(struct linux_
43883 * allowed task size. Note that p_filesz must always be
43884 * <= p_memsz so it is only necessary to check p_memsz.
43885 */
43886- if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
43887- elf_ppnt->p_memsz > TASK_SIZE ||
43888- TASK_SIZE - elf_ppnt->p_memsz < k) {
43889+ if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
43890+ elf_ppnt->p_memsz > pax_task_size ||
43891+ pax_task_size - elf_ppnt->p_memsz < k) {
43892 /* set_brk can never work. Avoid overflows. */
43893 send_sig(SIGKILL, current, 0);
43894 retval = -EINVAL;
43895@@ -862,6 +1163,11 @@ static int load_elf_binary(struct linux_
43896 start_data += load_bias;
43897 end_data += load_bias;
43898
43899+#ifdef CONFIG_PAX_RANDMMAP
43900+ if (current->mm->pax_flags & MF_PAX_RANDMMAP)
43901+ elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
43902+#endif
43903+
43904 /* Calling set_brk effectively mmaps the pages that we need
43905 * for the bss and break sections. We must do this before
43906 * mapping in the interpreter, to make sure it doesn't wind
43907@@ -873,9 +1179,11 @@ static int load_elf_binary(struct linux_
43908 goto out_free_dentry;
43909 }
43910 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
43911- send_sig(SIGSEGV, current, 0);
43912- retval = -EFAULT; /* Nobody gets to see this, but.. */
43913- goto out_free_dentry;
43914+ /*
43915+ * This bss-zeroing can fail if the ELF
43916+ * file specifies odd protections. So
43917+ * we don't check the return value
43918+ */
43919 }
43920
43921 if (elf_interpreter) {
43922@@ -1090,7 +1398,7 @@ out:
43923 * Decide what to dump of a segment, part, all or none.
43924 */
43925 static unsigned long vma_dump_size(struct vm_area_struct *vma,
43926- unsigned long mm_flags)
43927+ unsigned long mm_flags, long signr)
43928 {
43929 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
43930
43931@@ -1124,7 +1432,7 @@ static unsigned long vma_dump_size(struc
43932 if (vma->vm_file == NULL)
43933 return 0;
43934
43935- if (FILTER(MAPPED_PRIVATE))
43936+ if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
43937 goto whole;
43938
43939 /*
43940@@ -1346,9 +1654,9 @@ static void fill_auxv_note(struct memelf
43941 {
43942 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
43943 int i = 0;
43944- do
43945+ do {
43946 i += 2;
43947- while (auxv[i - 2] != AT_NULL);
43948+ } while (auxv[i - 2] != AT_NULL);
43949 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
43950 }
43951
43952@@ -1854,14 +2162,14 @@ static void fill_extnum_info(struct elfh
43953 }
43954
43955 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
43956- unsigned long mm_flags)
43957+ struct coredump_params *cprm)
43958 {
43959 struct vm_area_struct *vma;
43960 size_t size = 0;
43961
43962 for (vma = first_vma(current, gate_vma); vma != NULL;
43963 vma = next_vma(vma, gate_vma))
43964- size += vma_dump_size(vma, mm_flags);
43965+ size += vma_dump_size(vma, cprm->mm_flags, cprm->signr);
43966 return size;
43967 }
43968
43969@@ -1955,7 +2263,7 @@ static int elf_core_dump(struct coredump
43970
43971 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
43972
43973- offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
43974+ offset += elf_core_vma_data_size(gate_vma, cprm);
43975 offset += elf_core_extra_data_size();
43976 e_shoff = offset;
43977
43978@@ -1969,10 +2277,12 @@ static int elf_core_dump(struct coredump
43979 offset = dataoff;
43980
43981 size += sizeof(*elf);
43982+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
43983 if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
43984 goto end_coredump;
43985
43986 size += sizeof(*phdr4note);
43987+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
43988 if (size > cprm->limit
43989 || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
43990 goto end_coredump;
43991@@ -1986,7 +2296,7 @@ static int elf_core_dump(struct coredump
43992 phdr.p_offset = offset;
43993 phdr.p_vaddr = vma->vm_start;
43994 phdr.p_paddr = 0;
43995- phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
43996+ phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags, cprm->signr);
43997 phdr.p_memsz = vma->vm_end - vma->vm_start;
43998 offset += phdr.p_filesz;
43999 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
44000@@ -1997,6 +2307,7 @@ static int elf_core_dump(struct coredump
44001 phdr.p_align = ELF_EXEC_PAGESIZE;
44002
44003 size += sizeof(phdr);
44004+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
44005 if (size > cprm->limit
44006 || !dump_write(cprm->file, &phdr, sizeof(phdr)))
44007 goto end_coredump;
44008@@ -2021,7 +2332,7 @@ static int elf_core_dump(struct coredump
44009 unsigned long addr;
44010 unsigned long end;
44011
44012- end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
44013+ end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags, cprm->signr);
44014
44015 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
44016 struct page *page;
44017@@ -2030,6 +2341,7 @@ static int elf_core_dump(struct coredump
44018 page = get_dump_page(addr);
44019 if (page) {
44020 void *kaddr = kmap(page);
44021+ gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
44022 stop = ((size += PAGE_SIZE) > cprm->limit) ||
44023 !dump_write(cprm->file, kaddr,
44024 PAGE_SIZE);
44025@@ -2047,6 +2359,7 @@ static int elf_core_dump(struct coredump
44026
44027 if (e_phnum == PN_XNUM) {
44028 size += sizeof(*shdr4extnum);
44029+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
44030 if (size > cprm->limit
44031 || !dump_write(cprm->file, shdr4extnum,
44032 sizeof(*shdr4extnum)))
44033@@ -2067,6 +2380,97 @@ out:
44034
44035 #endif /* CONFIG_ELF_CORE */
44036
44037+#ifdef CONFIG_PAX_MPROTECT
44038+/* PaX: non-PIC ELF libraries need relocations on their executable segments
44039+ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
44040+ * we'll remove VM_MAYWRITE for good on RELRO segments.
44041+ *
44042+ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
44043+ * basis because we want to allow the common case and not the special ones.
44044+ */
44045+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
44046+{
44047+ struct elfhdr elf_h;
44048+ struct elf_phdr elf_p;
44049+ unsigned long i;
44050+ unsigned long oldflags;
44051+ bool is_textrel_rw, is_textrel_rx, is_relro;
44052+
44053+ if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
44054+ return;
44055+
44056+ oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
44057+ newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
44058+
44059+#ifdef CONFIG_PAX_ELFRELOCS
44060+ /* possible TEXTREL */
44061+ is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
44062+ is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
44063+#else
44064+ is_textrel_rw = false;
44065+ is_textrel_rx = false;
44066+#endif
44067+
44068+ /* possible RELRO */
44069+ is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
44070+
44071+ if (!is_textrel_rw && !is_textrel_rx && !is_relro)
44072+ return;
44073+
44074+ if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
44075+ memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
44076+
44077+#ifdef CONFIG_PAX_ETEXECRELOCS
44078+ ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
44079+#else
44080+ ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
44081+#endif
44082+
44083+ (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
44084+ !elf_check_arch(&elf_h) ||
44085+ elf_h.e_phentsize != sizeof(struct elf_phdr) ||
44086+ elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
44087+ return;
44088+
44089+ for (i = 0UL; i < elf_h.e_phnum; i++) {
44090+ if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
44091+ return;
44092+ switch (elf_p.p_type) {
44093+ case PT_DYNAMIC:
44094+ if (!is_textrel_rw && !is_textrel_rx)
44095+ continue;
44096+ i = 0UL;
44097+ while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
44098+ elf_dyn dyn;
44099+
44100+ if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
44101+ return;
44102+ if (dyn.d_tag == DT_NULL)
44103+ return;
44104+ if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
44105+ gr_log_textrel(vma);
44106+ if (is_textrel_rw)
44107+ vma->vm_flags |= VM_MAYWRITE;
44108+ else
44109+ /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
44110+ vma->vm_flags &= ~VM_MAYWRITE;
44111+ return;
44112+ }
44113+ i++;
44114+ }
44115+ return;
44116+
44117+ case PT_GNU_RELRO:
44118+ if (!is_relro)
44119+ continue;
44120+ if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
44121+ vma->vm_flags &= ~VM_MAYWRITE;
44122+ return;
44123+ }
44124+ }
44125+}
44126+#endif
44127+
44128 static int __init init_elf_binfmt(void)
44129 {
44130 return register_binfmt(&elf_format);
44131diff -urNp linux-2.6.39.1/fs/binfmt_flat.c linux-2.6.39.1/fs/binfmt_flat.c
44132--- linux-2.6.39.1/fs/binfmt_flat.c 2011-05-19 00:06:34.000000000 -0400
44133+++ linux-2.6.39.1/fs/binfmt_flat.c 2011-05-22 19:36:32.000000000 -0400
44134@@ -567,7 +567,9 @@ static int load_flat_file(struct linux_b
44135 realdatastart = (unsigned long) -ENOMEM;
44136 printk("Unable to allocate RAM for process data, errno %d\n",
44137 (int)-realdatastart);
44138+ down_write(&current->mm->mmap_sem);
44139 do_munmap(current->mm, textpos, text_len);
44140+ up_write(&current->mm->mmap_sem);
44141 ret = realdatastart;
44142 goto err;
44143 }
44144@@ -591,8 +593,10 @@ static int load_flat_file(struct linux_b
44145 }
44146 if (IS_ERR_VALUE(result)) {
44147 printk("Unable to read data+bss, errno %d\n", (int)-result);
44148+ down_write(&current->mm->mmap_sem);
44149 do_munmap(current->mm, textpos, text_len);
44150 do_munmap(current->mm, realdatastart, len);
44151+ up_write(&current->mm->mmap_sem);
44152 ret = result;
44153 goto err;
44154 }
44155@@ -661,8 +665,10 @@ static int load_flat_file(struct linux_b
44156 }
44157 if (IS_ERR_VALUE(result)) {
44158 printk("Unable to read code+data+bss, errno %d\n",(int)-result);
44159+ down_write(&current->mm->mmap_sem);
44160 do_munmap(current->mm, textpos, text_len + data_len + extra +
44161 MAX_SHARED_LIBS * sizeof(unsigned long));
44162+ up_write(&current->mm->mmap_sem);
44163 ret = result;
44164 goto err;
44165 }
44166diff -urNp linux-2.6.39.1/fs/bio.c linux-2.6.39.1/fs/bio.c
44167--- linux-2.6.39.1/fs/bio.c 2011-05-19 00:06:34.000000000 -0400
44168+++ linux-2.6.39.1/fs/bio.c 2011-05-22 19:36:32.000000000 -0400
44169@@ -1233,7 +1233,7 @@ static void bio_copy_kern_endio(struct b
44170 const int read = bio_data_dir(bio) == READ;
44171 struct bio_map_data *bmd = bio->bi_private;
44172 int i;
44173- char *p = bmd->sgvecs[0].iov_base;
44174+ char *p = (__force char *)bmd->sgvecs[0].iov_base;
44175
44176 __bio_for_each_segment(bvec, bio, i, 0) {
44177 char *addr = page_address(bvec->bv_page);
44178diff -urNp linux-2.6.39.1/fs/block_dev.c linux-2.6.39.1/fs/block_dev.c
44179--- linux-2.6.39.1/fs/block_dev.c 2011-06-03 00:04:14.000000000 -0400
44180+++ linux-2.6.39.1/fs/block_dev.c 2011-06-06 19:57:05.000000000 -0400
44181@@ -671,7 +671,7 @@ static bool bd_may_claim(struct block_de
44182 else if (bdev->bd_contains == bdev)
44183 return true; /* is a whole device which isn't held */
44184
44185- else if (whole->bd_holder == bd_may_claim)
44186+ else if (whole->bd_holder == (void *)bd_may_claim)
44187 return true; /* is a partition of a device that is being partitioned */
44188 else if (whole->bd_holder != NULL)
44189 return false; /* is a partition of a held device */
44190@@ -1272,8 +1272,8 @@ int blkdev_get(struct block_device *bdev
44191 * individual writeable reference is too fragile given the
44192 * way @mode is used in blkdev_get/put().
44193 */
44194- if ((disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE) &&
44195- !res && (mode & FMODE_WRITE) && !bdev->bd_write_holder) {
44196+ if (!res && (mode & FMODE_WRITE) && !bdev->bd_write_holder &&
44197+ (disk->flags & GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE)) {
44198 bdev->bd_write_holder = true;
44199 disk_block_events(disk);
44200 }
44201diff -urNp linux-2.6.39.1/fs/btrfs/compression.c linux-2.6.39.1/fs/btrfs/compression.c
44202--- linux-2.6.39.1/fs/btrfs/compression.c 2011-05-19 00:06:34.000000000 -0400
44203+++ linux-2.6.39.1/fs/btrfs/compression.c 2011-05-22 19:36:32.000000000 -0400
44204@@ -719,7 +719,7 @@ static int comp_num_workspace[BTRFS_COMP
44205 static atomic_t comp_alloc_workspace[BTRFS_COMPRESS_TYPES];
44206 static wait_queue_head_t comp_workspace_wait[BTRFS_COMPRESS_TYPES];
44207
44208-struct btrfs_compress_op *btrfs_compress_op[] = {
44209+const struct btrfs_compress_op *btrfs_compress_op[] = {
44210 &btrfs_zlib_compress,
44211 &btrfs_lzo_compress,
44212 };
44213diff -urNp linux-2.6.39.1/fs/btrfs/compression.h linux-2.6.39.1/fs/btrfs/compression.h
44214--- linux-2.6.39.1/fs/btrfs/compression.h 2011-05-19 00:06:34.000000000 -0400
44215+++ linux-2.6.39.1/fs/btrfs/compression.h 2011-05-22 19:36:32.000000000 -0400
44216@@ -77,7 +77,7 @@ struct btrfs_compress_op {
44217 size_t srclen, size_t destlen);
44218 };
44219
44220-extern struct btrfs_compress_op btrfs_zlib_compress;
44221-extern struct btrfs_compress_op btrfs_lzo_compress;
44222+extern const struct btrfs_compress_op btrfs_zlib_compress;
44223+extern const struct btrfs_compress_op btrfs_lzo_compress;
44224
44225 #endif
44226diff -urNp linux-2.6.39.1/fs/btrfs/ctree.c linux-2.6.39.1/fs/btrfs/ctree.c
44227--- linux-2.6.39.1/fs/btrfs/ctree.c 2011-05-19 00:06:34.000000000 -0400
44228+++ linux-2.6.39.1/fs/btrfs/ctree.c 2011-05-22 19:36:32.000000000 -0400
44229@@ -461,9 +461,12 @@ static noinline int __btrfs_cow_block(st
44230 free_extent_buffer(buf);
44231 add_root_to_dirty_list(root);
44232 } else {
44233- if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
44234- parent_start = parent->start;
44235- else
44236+ if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
44237+ if (parent)
44238+ parent_start = parent->start;
44239+ else
44240+ parent_start = 0;
44241+ } else
44242 parent_start = 0;
44243
44244 WARN_ON(trans->transid != btrfs_header_generation(parent));
44245@@ -3647,7 +3650,6 @@ setup_items_for_insert(struct btrfs_tran
44246
44247 ret = 0;
44248 if (slot == 0) {
44249- struct btrfs_disk_key disk_key;
44250 btrfs_cpu_key_to_disk(&disk_key, cpu_key);
44251 ret = fixup_low_keys(trans, root, path, &disk_key, 1);
44252 }
44253diff -urNp linux-2.6.39.1/fs/btrfs/disk-io.c linux-2.6.39.1/fs/btrfs/disk-io.c
44254--- linux-2.6.39.1/fs/btrfs/disk-io.c 2011-05-19 00:06:34.000000000 -0400
44255+++ linux-2.6.39.1/fs/btrfs/disk-io.c 2011-05-22 19:36:32.000000000 -0400
44256@@ -42,7 +42,7 @@
44257 #include "tree-log.h"
44258 #include "free-space-cache.h"
44259
44260-static struct extent_io_ops btree_extent_io_ops;
44261+static const struct extent_io_ops btree_extent_io_ops;
44262 static void end_workqueue_fn(struct btrfs_work *work);
44263 static void free_fs_root(struct btrfs_root *root);
44264 static void btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
44265@@ -3070,7 +3070,7 @@ static int btrfs_cleanup_transaction(str
44266 return 0;
44267 }
44268
44269-static struct extent_io_ops btree_extent_io_ops = {
44270+static const struct extent_io_ops btree_extent_io_ops = {
44271 .write_cache_pages_lock_hook = btree_lock_page_hook,
44272 .readpage_end_io_hook = btree_readpage_end_io_hook,
44273 .submit_bio_hook = btree_submit_bio_hook,
44274diff -urNp linux-2.6.39.1/fs/btrfs/extent_io.h linux-2.6.39.1/fs/btrfs/extent_io.h
44275--- linux-2.6.39.1/fs/btrfs/extent_io.h 2011-05-19 00:06:34.000000000 -0400
44276+++ linux-2.6.39.1/fs/btrfs/extent_io.h 2011-05-22 19:36:32.000000000 -0400
44277@@ -56,36 +56,36 @@ typedef int (extent_submit_bio_hook_t)(s
44278 struct bio *bio, int mirror_num,
44279 unsigned long bio_flags, u64 bio_offset);
44280 struct extent_io_ops {
44281- int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
44282+ int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
44283 u64 start, u64 end, int *page_started,
44284 unsigned long *nr_written);
44285- int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
44286- int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
44287+ int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
44288+ int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
44289 extent_submit_bio_hook_t *submit_bio_hook;
44290- int (*merge_bio_hook)(struct page *page, unsigned long offset,
44291+ int (* const merge_bio_hook)(struct page *page, unsigned long offset,
44292 size_t size, struct bio *bio,
44293 unsigned long bio_flags);
44294- int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
44295- int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
44296+ int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
44297+ int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
44298 u64 start, u64 end,
44299 struct extent_state *state);
44300- int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
44301+ int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
44302 u64 start, u64 end,
44303 struct extent_state *state);
44304- int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
44305+ int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
44306 struct extent_state *state);
44307- int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
44308+ int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
44309 struct extent_state *state, int uptodate);
44310- int (*set_bit_hook)(struct inode *inode, struct extent_state *state,
44311+ int (* const set_bit_hook)(struct inode *inode, struct extent_state *state,
44312 int *bits);
44313- int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
44314+ int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
44315 int *bits);
44316- int (*merge_extent_hook)(struct inode *inode,
44317+ int (* const merge_extent_hook)(struct inode *inode,
44318 struct extent_state *new,
44319 struct extent_state *other);
44320- int (*split_extent_hook)(struct inode *inode,
44321+ int (* const split_extent_hook)(struct inode *inode,
44322 struct extent_state *orig, u64 split);
44323- int (*write_cache_pages_lock_hook)(struct page *page);
44324+ int (* const write_cache_pages_lock_hook)(struct page *page);
44325 };
44326
44327 struct extent_io_tree {
44328@@ -95,7 +95,7 @@ struct extent_io_tree {
44329 u64 dirty_bytes;
44330 spinlock_t lock;
44331 spinlock_t buffer_lock;
44332- struct extent_io_ops *ops;
44333+ const struct extent_io_ops *ops;
44334 };
44335
44336 struct extent_state {
44337diff -urNp linux-2.6.39.1/fs/btrfs/free-space-cache.c linux-2.6.39.1/fs/btrfs/free-space-cache.c
44338--- linux-2.6.39.1/fs/btrfs/free-space-cache.c 2011-05-19 00:06:34.000000000 -0400
44339+++ linux-2.6.39.1/fs/btrfs/free-space-cache.c 2011-05-22 19:36:32.000000000 -0400
44340@@ -1910,8 +1910,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
44341 while(1) {
44342 if (entry->bytes < bytes ||
44343 (!entry->bitmap && entry->offset < min_start)) {
44344- struct rb_node *node;
44345-
44346 node = rb_next(&entry->offset_index);
44347 if (!node)
44348 break;
44349@@ -1925,7 +1923,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
44350 cluster, entry, bytes,
44351 min_start);
44352 if (ret == 0) {
44353- struct rb_node *node;
44354 node = rb_next(&entry->offset_index);
44355 if (!node)
44356 break;
44357diff -urNp linux-2.6.39.1/fs/btrfs/inode.c linux-2.6.39.1/fs/btrfs/inode.c
44358--- linux-2.6.39.1/fs/btrfs/inode.c 2011-05-19 00:06:34.000000000 -0400
44359+++ linux-2.6.39.1/fs/btrfs/inode.c 2011-05-22 20:42:42.000000000 -0400
44360@@ -65,7 +65,7 @@ static const struct inode_operations btr
44361 static const struct address_space_operations btrfs_aops;
44362 static const struct address_space_operations btrfs_symlink_aops;
44363 static const struct file_operations btrfs_dir_file_operations;
44364-static struct extent_io_ops btrfs_extent_io_ops;
44365+static const struct extent_io_ops btrfs_extent_io_ops;
44366
44367 static struct kmem_cache *btrfs_inode_cachep;
44368 struct kmem_cache *btrfs_trans_handle_cachep;
44369@@ -6947,7 +6947,7 @@ fail:
44370 return -ENOMEM;
44371 }
44372
44373-static int btrfs_getattr(struct vfsmount *mnt,
44374+int btrfs_getattr(struct vfsmount *mnt,
44375 struct dentry *dentry, struct kstat *stat)
44376 {
44377 struct inode *inode = dentry->d_inode;
44378@@ -6959,6 +6959,14 @@ static int btrfs_getattr(struct vfsmount
44379 return 0;
44380 }
44381
44382+EXPORT_SYMBOL(btrfs_getattr);
44383+
44384+dev_t get_btrfs_dev_from_inode(struct inode *inode)
44385+{
44386+ return BTRFS_I(inode)->root->anon_super.s_dev;
44387+}
44388+EXPORT_SYMBOL(get_btrfs_dev_from_inode);
44389+
44390 /*
44391 * If a file is moved, it will inherit the cow and compression flags of the new
44392 * directory.
44393@@ -7488,7 +7496,7 @@ static const struct file_operations btrf
44394 .fsync = btrfs_sync_file,
44395 };
44396
44397-static struct extent_io_ops btrfs_extent_io_ops = {
44398+static const struct extent_io_ops btrfs_extent_io_ops = {
44399 .fill_delalloc = run_delalloc_range,
44400 .submit_bio_hook = btrfs_submit_bio_hook,
44401 .merge_bio_hook = btrfs_merge_bio_hook,
44402diff -urNp linux-2.6.39.1/fs/btrfs/ioctl.c linux-2.6.39.1/fs/btrfs/ioctl.c
44403--- linux-2.6.39.1/fs/btrfs/ioctl.c 2011-05-19 00:06:34.000000000 -0400
44404+++ linux-2.6.39.1/fs/btrfs/ioctl.c 2011-05-22 19:41:37.000000000 -0400
44405@@ -2361,9 +2361,12 @@ long btrfs_ioctl_space_info(struct btrfs
44406 for (i = 0; i < num_types; i++) {
44407 struct btrfs_space_info *tmp;
44408
44409+ /* Don't copy in more than we allocated */
44410 if (!slot_count)
44411 break;
44412
44413+ slot_count--;
44414+
44415 info = NULL;
44416 rcu_read_lock();
44417 list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
44418@@ -2385,10 +2388,7 @@ long btrfs_ioctl_space_info(struct btrfs
44419 memcpy(dest, &space, sizeof(space));
44420 dest++;
44421 space_args.total_spaces++;
44422- slot_count--;
44423 }
44424- if (!slot_count)
44425- break;
44426 }
44427 up_read(&info->groups_sem);
44428 }
44429diff -urNp linux-2.6.39.1/fs/btrfs/lzo.c linux-2.6.39.1/fs/btrfs/lzo.c
44430--- linux-2.6.39.1/fs/btrfs/lzo.c 2011-05-19 00:06:34.000000000 -0400
44431+++ linux-2.6.39.1/fs/btrfs/lzo.c 2011-05-22 19:36:32.000000000 -0400
44432@@ -418,7 +418,7 @@ out:
44433 return ret;
44434 }
44435
44436-struct btrfs_compress_op btrfs_lzo_compress = {
44437+const struct btrfs_compress_op btrfs_lzo_compress = {
44438 .alloc_workspace = lzo_alloc_workspace,
44439 .free_workspace = lzo_free_workspace,
44440 .compress_pages = lzo_compress_pages,
44441diff -urNp linux-2.6.39.1/fs/btrfs/relocation.c linux-2.6.39.1/fs/btrfs/relocation.c
44442--- linux-2.6.39.1/fs/btrfs/relocation.c 2011-05-19 00:06:34.000000000 -0400
44443+++ linux-2.6.39.1/fs/btrfs/relocation.c 2011-05-22 19:36:32.000000000 -0400
44444@@ -1239,7 +1239,7 @@ static int __update_reloc_root(struct bt
44445 }
44446 spin_unlock(&rc->reloc_root_tree.lock);
44447
44448- BUG_ON((struct btrfs_root *)node->data != root);
44449+ BUG_ON(!node || (struct btrfs_root *)node->data != root);
44450
44451 if (!del) {
44452 spin_lock(&rc->reloc_root_tree.lock);
44453diff -urNp linux-2.6.39.1/fs/btrfs/zlib.c linux-2.6.39.1/fs/btrfs/zlib.c
44454--- linux-2.6.39.1/fs/btrfs/zlib.c 2011-05-19 00:06:34.000000000 -0400
44455+++ linux-2.6.39.1/fs/btrfs/zlib.c 2011-05-22 19:36:32.000000000 -0400
44456@@ -390,7 +390,7 @@ next:
44457 return ret;
44458 }
44459
44460-struct btrfs_compress_op btrfs_zlib_compress = {
44461+const struct btrfs_compress_op btrfs_zlib_compress = {
44462 .alloc_workspace = zlib_alloc_workspace,
44463 .free_workspace = zlib_free_workspace,
44464 .compress_pages = zlib_compress_pages,
44465diff -urNp linux-2.6.39.1/fs/cachefiles/bind.c linux-2.6.39.1/fs/cachefiles/bind.c
44466--- linux-2.6.39.1/fs/cachefiles/bind.c 2011-05-19 00:06:34.000000000 -0400
44467+++ linux-2.6.39.1/fs/cachefiles/bind.c 2011-05-22 19:36:32.000000000 -0400
44468@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
44469 args);
44470
44471 /* start by checking things over */
44472- ASSERT(cache->fstop_percent >= 0 &&
44473- cache->fstop_percent < cache->fcull_percent &&
44474+ ASSERT(cache->fstop_percent < cache->fcull_percent &&
44475 cache->fcull_percent < cache->frun_percent &&
44476 cache->frun_percent < 100);
44477
44478- ASSERT(cache->bstop_percent >= 0 &&
44479- cache->bstop_percent < cache->bcull_percent &&
44480+ ASSERT(cache->bstop_percent < cache->bcull_percent &&
44481 cache->bcull_percent < cache->brun_percent &&
44482 cache->brun_percent < 100);
44483
44484diff -urNp linux-2.6.39.1/fs/cachefiles/daemon.c linux-2.6.39.1/fs/cachefiles/daemon.c
44485--- linux-2.6.39.1/fs/cachefiles/daemon.c 2011-05-19 00:06:34.000000000 -0400
44486+++ linux-2.6.39.1/fs/cachefiles/daemon.c 2011-05-22 19:36:32.000000000 -0400
44487@@ -196,7 +196,7 @@ static ssize_t cachefiles_daemon_read(st
44488 if (n > buflen)
44489 return -EMSGSIZE;
44490
44491- if (copy_to_user(_buffer, buffer, n) != 0)
44492+ if (n > sizeof(buffer) || copy_to_user(_buffer, buffer, n) != 0)
44493 return -EFAULT;
44494
44495 return n;
44496@@ -222,7 +222,7 @@ static ssize_t cachefiles_daemon_write(s
44497 if (test_bit(CACHEFILES_DEAD, &cache->flags))
44498 return -EIO;
44499
44500- if (datalen < 0 || datalen > PAGE_SIZE - 1)
44501+ if (datalen > PAGE_SIZE - 1)
44502 return -EOPNOTSUPP;
44503
44504 /* drag the command string into the kernel so we can parse it */
44505@@ -386,7 +386,7 @@ static int cachefiles_daemon_fstop(struc
44506 if (args[0] != '%' || args[1] != '\0')
44507 return -EINVAL;
44508
44509- if (fstop < 0 || fstop >= cache->fcull_percent)
44510+ if (fstop >= cache->fcull_percent)
44511 return cachefiles_daemon_range_error(cache, args);
44512
44513 cache->fstop_percent = fstop;
44514@@ -458,7 +458,7 @@ static int cachefiles_daemon_bstop(struc
44515 if (args[0] != '%' || args[1] != '\0')
44516 return -EINVAL;
44517
44518- if (bstop < 0 || bstop >= cache->bcull_percent)
44519+ if (bstop >= cache->bcull_percent)
44520 return cachefiles_daemon_range_error(cache, args);
44521
44522 cache->bstop_percent = bstop;
44523diff -urNp linux-2.6.39.1/fs/cachefiles/internal.h linux-2.6.39.1/fs/cachefiles/internal.h
44524--- linux-2.6.39.1/fs/cachefiles/internal.h 2011-05-19 00:06:34.000000000 -0400
44525+++ linux-2.6.39.1/fs/cachefiles/internal.h 2011-05-22 19:36:32.000000000 -0400
44526@@ -57,7 +57,7 @@ struct cachefiles_cache {
44527 wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
44528 struct rb_root active_nodes; /* active nodes (can't be culled) */
44529 rwlock_t active_lock; /* lock for active_nodes */
44530- atomic_t gravecounter; /* graveyard uniquifier */
44531+ atomic_unchecked_t gravecounter; /* graveyard uniquifier */
44532 unsigned frun_percent; /* when to stop culling (% files) */
44533 unsigned fcull_percent; /* when to start culling (% files) */
44534 unsigned fstop_percent; /* when to stop allocating (% files) */
44535@@ -169,19 +169,19 @@ extern int cachefiles_check_in_use(struc
44536 * proc.c
44537 */
44538 #ifdef CONFIG_CACHEFILES_HISTOGRAM
44539-extern atomic_t cachefiles_lookup_histogram[HZ];
44540-extern atomic_t cachefiles_mkdir_histogram[HZ];
44541-extern atomic_t cachefiles_create_histogram[HZ];
44542+extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
44543+extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
44544+extern atomic_unchecked_t cachefiles_create_histogram[HZ];
44545
44546 extern int __init cachefiles_proc_init(void);
44547 extern void cachefiles_proc_cleanup(void);
44548 static inline
44549-void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
44550+void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
44551 {
44552 unsigned long jif = jiffies - start_jif;
44553 if (jif >= HZ)
44554 jif = HZ - 1;
44555- atomic_inc(&histogram[jif]);
44556+ atomic_inc_unchecked(&histogram[jif]);
44557 }
44558
44559 #else
44560diff -urNp linux-2.6.39.1/fs/cachefiles/namei.c linux-2.6.39.1/fs/cachefiles/namei.c
44561--- linux-2.6.39.1/fs/cachefiles/namei.c 2011-05-19 00:06:34.000000000 -0400
44562+++ linux-2.6.39.1/fs/cachefiles/namei.c 2011-05-22 19:36:32.000000000 -0400
44563@@ -318,7 +318,7 @@ try_again:
44564 /* first step is to make up a grave dentry in the graveyard */
44565 sprintf(nbuffer, "%08x%08x",
44566 (uint32_t) get_seconds(),
44567- (uint32_t) atomic_inc_return(&cache->gravecounter));
44568+ (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
44569
44570 /* do the multiway lock magic */
44571 trap = lock_rename(cache->graveyard, dir);
44572diff -urNp linux-2.6.39.1/fs/cachefiles/proc.c linux-2.6.39.1/fs/cachefiles/proc.c
44573--- linux-2.6.39.1/fs/cachefiles/proc.c 2011-05-19 00:06:34.000000000 -0400
44574+++ linux-2.6.39.1/fs/cachefiles/proc.c 2011-05-22 19:36:32.000000000 -0400
44575@@ -14,9 +14,9 @@
44576 #include <linux/seq_file.h>
44577 #include "internal.h"
44578
44579-atomic_t cachefiles_lookup_histogram[HZ];
44580-atomic_t cachefiles_mkdir_histogram[HZ];
44581-atomic_t cachefiles_create_histogram[HZ];
44582+atomic_unchecked_t cachefiles_lookup_histogram[HZ];
44583+atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
44584+atomic_unchecked_t cachefiles_create_histogram[HZ];
44585
44586 /*
44587 * display the latency histogram
44588@@ -35,9 +35,9 @@ static int cachefiles_histogram_show(str
44589 return 0;
44590 default:
44591 index = (unsigned long) v - 3;
44592- x = atomic_read(&cachefiles_lookup_histogram[index]);
44593- y = atomic_read(&cachefiles_mkdir_histogram[index]);
44594- z = atomic_read(&cachefiles_create_histogram[index]);
44595+ x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
44596+ y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
44597+ z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
44598 if (x == 0 && y == 0 && z == 0)
44599 return 0;
44600
44601diff -urNp linux-2.6.39.1/fs/cachefiles/rdwr.c linux-2.6.39.1/fs/cachefiles/rdwr.c
44602--- linux-2.6.39.1/fs/cachefiles/rdwr.c 2011-05-19 00:06:34.000000000 -0400
44603+++ linux-2.6.39.1/fs/cachefiles/rdwr.c 2011-05-22 19:36:32.000000000 -0400
44604@@ -945,7 +945,7 @@ int cachefiles_write_page(struct fscache
44605 old_fs = get_fs();
44606 set_fs(KERNEL_DS);
44607 ret = file->f_op->write(
44608- file, (const void __user *) data, len, &pos);
44609+ file, (__force const void __user *) data, len, &pos);
44610 set_fs(old_fs);
44611 kunmap(page);
44612 if (ret != len)
44613diff -urNp linux-2.6.39.1/fs/ceph/addr.c linux-2.6.39.1/fs/ceph/addr.c
44614--- linux-2.6.39.1/fs/ceph/addr.c 2011-05-19 00:06:34.000000000 -0400
44615+++ linux-2.6.39.1/fs/ceph/addr.c 2011-05-22 19:36:32.000000000 -0400
44616@@ -1164,7 +1164,7 @@ out:
44617 return ret;
44618 }
44619
44620-static struct vm_operations_struct ceph_vmops = {
44621+static const struct vm_operations_struct ceph_vmops = {
44622 .fault = filemap_fault,
44623 .page_mkwrite = ceph_page_mkwrite,
44624 };
44625diff -urNp linux-2.6.39.1/fs/ceph/dir.c linux-2.6.39.1/fs/ceph/dir.c
44626--- linux-2.6.39.1/fs/ceph/dir.c 2011-05-19 00:06:34.000000000 -0400
44627+++ linux-2.6.39.1/fs/ceph/dir.c 2011-05-22 19:36:32.000000000 -0400
44628@@ -226,7 +226,7 @@ static int ceph_readdir(struct file *fil
44629 struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
44630 struct ceph_mds_client *mdsc = fsc->mdsc;
44631 unsigned frag = fpos_frag(filp->f_pos);
44632- int off = fpos_off(filp->f_pos);
44633+ unsigned int off = fpos_off(filp->f_pos);
44634 int err;
44635 u32 ftype;
44636 struct ceph_mds_reply_info_parsed *rinfo;
44637@@ -360,7 +360,7 @@ more:
44638 rinfo = &fi->last_readdir->r_reply_info;
44639 dout("readdir frag %x num %d off %d chunkoff %d\n", frag,
44640 rinfo->dir_nr, off, fi->offset);
44641- while (off - fi->offset >= 0 && off - fi->offset < rinfo->dir_nr) {
44642+ while (off >= fi->offset && off - fi->offset < rinfo->dir_nr) {
44643 u64 pos = ceph_make_fpos(frag, off);
44644 struct ceph_mds_reply_inode *in =
44645 rinfo->dir_in[off - fi->offset].in;
44646diff -urNp linux-2.6.39.1/fs/cifs/cifs_debug.c linux-2.6.39.1/fs/cifs/cifs_debug.c
44647--- linux-2.6.39.1/fs/cifs/cifs_debug.c 2011-05-19 00:06:34.000000000 -0400
44648+++ linux-2.6.39.1/fs/cifs/cifs_debug.c 2011-05-22 19:36:32.000000000 -0400
44649@@ -279,25 +279,25 @@ static ssize_t cifs_stats_proc_write(str
44650 tcon = list_entry(tmp3,
44651 struct cifsTconInfo,
44652 tcon_list);
44653- atomic_set(&tcon->num_smbs_sent, 0);
44654- atomic_set(&tcon->num_writes, 0);
44655- atomic_set(&tcon->num_reads, 0);
44656- atomic_set(&tcon->num_oplock_brks, 0);
44657- atomic_set(&tcon->num_opens, 0);
44658- atomic_set(&tcon->num_posixopens, 0);
44659- atomic_set(&tcon->num_posixmkdirs, 0);
44660- atomic_set(&tcon->num_closes, 0);
44661- atomic_set(&tcon->num_deletes, 0);
44662- atomic_set(&tcon->num_mkdirs, 0);
44663- atomic_set(&tcon->num_rmdirs, 0);
44664- atomic_set(&tcon->num_renames, 0);
44665- atomic_set(&tcon->num_t2renames, 0);
44666- atomic_set(&tcon->num_ffirst, 0);
44667- atomic_set(&tcon->num_fnext, 0);
44668- atomic_set(&tcon->num_fclose, 0);
44669- atomic_set(&tcon->num_hardlinks, 0);
44670- atomic_set(&tcon->num_symlinks, 0);
44671- atomic_set(&tcon->num_locks, 0);
44672+ atomic_set_unchecked(&tcon->num_smbs_sent, 0);
44673+ atomic_set_unchecked(&tcon->num_writes, 0);
44674+ atomic_set_unchecked(&tcon->num_reads, 0);
44675+ atomic_set_unchecked(&tcon->num_oplock_brks, 0);
44676+ atomic_set_unchecked(&tcon->num_opens, 0);
44677+ atomic_set_unchecked(&tcon->num_posixopens, 0);
44678+ atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
44679+ atomic_set_unchecked(&tcon->num_closes, 0);
44680+ atomic_set_unchecked(&tcon->num_deletes, 0);
44681+ atomic_set_unchecked(&tcon->num_mkdirs, 0);
44682+ atomic_set_unchecked(&tcon->num_rmdirs, 0);
44683+ atomic_set_unchecked(&tcon->num_renames, 0);
44684+ atomic_set_unchecked(&tcon->num_t2renames, 0);
44685+ atomic_set_unchecked(&tcon->num_ffirst, 0);
44686+ atomic_set_unchecked(&tcon->num_fnext, 0);
44687+ atomic_set_unchecked(&tcon->num_fclose, 0);
44688+ atomic_set_unchecked(&tcon->num_hardlinks, 0);
44689+ atomic_set_unchecked(&tcon->num_symlinks, 0);
44690+ atomic_set_unchecked(&tcon->num_locks, 0);
44691 }
44692 }
44693 }
44694@@ -357,41 +357,41 @@ static int cifs_stats_proc_show(struct s
44695 if (tcon->need_reconnect)
44696 seq_puts(m, "\tDISCONNECTED ");
44697 seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
44698- atomic_read(&tcon->num_smbs_sent),
44699- atomic_read(&tcon->num_oplock_brks));
44700+ atomic_read_unchecked(&tcon->num_smbs_sent),
44701+ atomic_read_unchecked(&tcon->num_oplock_brks));
44702 seq_printf(m, "\nReads: %d Bytes: %lld",
44703- atomic_read(&tcon->num_reads),
44704+ atomic_read_unchecked(&tcon->num_reads),
44705 (long long)(tcon->bytes_read));
44706 seq_printf(m, "\nWrites: %d Bytes: %lld",
44707- atomic_read(&tcon->num_writes),
44708+ atomic_read_unchecked(&tcon->num_writes),
44709 (long long)(tcon->bytes_written));
44710 seq_printf(m, "\nFlushes: %d",
44711- atomic_read(&tcon->num_flushes));
44712+ atomic_read_unchecked(&tcon->num_flushes));
44713 seq_printf(m, "\nLocks: %d HardLinks: %d "
44714 "Symlinks: %d",
44715- atomic_read(&tcon->num_locks),
44716- atomic_read(&tcon->num_hardlinks),
44717- atomic_read(&tcon->num_symlinks));
44718+ atomic_read_unchecked(&tcon->num_locks),
44719+ atomic_read_unchecked(&tcon->num_hardlinks),
44720+ atomic_read_unchecked(&tcon->num_symlinks));
44721 seq_printf(m, "\nOpens: %d Closes: %d "
44722 "Deletes: %d",
44723- atomic_read(&tcon->num_opens),
44724- atomic_read(&tcon->num_closes),
44725- atomic_read(&tcon->num_deletes));
44726+ atomic_read_unchecked(&tcon->num_opens),
44727+ atomic_read_unchecked(&tcon->num_closes),
44728+ atomic_read_unchecked(&tcon->num_deletes));
44729 seq_printf(m, "\nPosix Opens: %d "
44730 "Posix Mkdirs: %d",
44731- atomic_read(&tcon->num_posixopens),
44732- atomic_read(&tcon->num_posixmkdirs));
44733+ atomic_read_unchecked(&tcon->num_posixopens),
44734+ atomic_read_unchecked(&tcon->num_posixmkdirs));
44735 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
44736- atomic_read(&tcon->num_mkdirs),
44737- atomic_read(&tcon->num_rmdirs));
44738+ atomic_read_unchecked(&tcon->num_mkdirs),
44739+ atomic_read_unchecked(&tcon->num_rmdirs));
44740 seq_printf(m, "\nRenames: %d T2 Renames %d",
44741- atomic_read(&tcon->num_renames),
44742- atomic_read(&tcon->num_t2renames));
44743+ atomic_read_unchecked(&tcon->num_renames),
44744+ atomic_read_unchecked(&tcon->num_t2renames));
44745 seq_printf(m, "\nFindFirst: %d FNext %d "
44746 "FClose %d",
44747- atomic_read(&tcon->num_ffirst),
44748- atomic_read(&tcon->num_fnext),
44749- atomic_read(&tcon->num_fclose));
44750+ atomic_read_unchecked(&tcon->num_ffirst),
44751+ atomic_read_unchecked(&tcon->num_fnext),
44752+ atomic_read_unchecked(&tcon->num_fclose));
44753 }
44754 }
44755 }
44756diff -urNp linux-2.6.39.1/fs/cifs/cifsglob.h linux-2.6.39.1/fs/cifs/cifsglob.h
44757--- linux-2.6.39.1/fs/cifs/cifsglob.h 2011-05-19 00:06:34.000000000 -0400
44758+++ linux-2.6.39.1/fs/cifs/cifsglob.h 2011-05-22 19:36:32.000000000 -0400
44759@@ -305,28 +305,28 @@ struct cifsTconInfo {
44760 __u16 Flags; /* optional support bits */
44761 enum statusEnum tidStatus;
44762 #ifdef CONFIG_CIFS_STATS
44763- atomic_t num_smbs_sent;
44764- atomic_t num_writes;
44765- atomic_t num_reads;
44766- atomic_t num_flushes;
44767- atomic_t num_oplock_brks;
44768- atomic_t num_opens;
44769- atomic_t num_closes;
44770- atomic_t num_deletes;
44771- atomic_t num_mkdirs;
44772- atomic_t num_posixopens;
44773- atomic_t num_posixmkdirs;
44774- atomic_t num_rmdirs;
44775- atomic_t num_renames;
44776- atomic_t num_t2renames;
44777- atomic_t num_ffirst;
44778- atomic_t num_fnext;
44779- atomic_t num_fclose;
44780- atomic_t num_hardlinks;
44781- atomic_t num_symlinks;
44782- atomic_t num_locks;
44783- atomic_t num_acl_get;
44784- atomic_t num_acl_set;
44785+ atomic_unchecked_t num_smbs_sent;
44786+ atomic_unchecked_t num_writes;
44787+ atomic_unchecked_t num_reads;
44788+ atomic_unchecked_t num_flushes;
44789+ atomic_unchecked_t num_oplock_brks;
44790+ atomic_unchecked_t num_opens;
44791+ atomic_unchecked_t num_closes;
44792+ atomic_unchecked_t num_deletes;
44793+ atomic_unchecked_t num_mkdirs;
44794+ atomic_unchecked_t num_posixopens;
44795+ atomic_unchecked_t num_posixmkdirs;
44796+ atomic_unchecked_t num_rmdirs;
44797+ atomic_unchecked_t num_renames;
44798+ atomic_unchecked_t num_t2renames;
44799+ atomic_unchecked_t num_ffirst;
44800+ atomic_unchecked_t num_fnext;
44801+ atomic_unchecked_t num_fclose;
44802+ atomic_unchecked_t num_hardlinks;
44803+ atomic_unchecked_t num_symlinks;
44804+ atomic_unchecked_t num_locks;
44805+ atomic_unchecked_t num_acl_get;
44806+ atomic_unchecked_t num_acl_set;
44807 #ifdef CONFIG_CIFS_STATS2
44808 unsigned long long time_writes;
44809 unsigned long long time_reads;
44810@@ -509,7 +509,7 @@ static inline char CIFS_DIR_SEP(const st
44811 }
44812
44813 #ifdef CONFIG_CIFS_STATS
44814-#define cifs_stats_inc atomic_inc
44815+#define cifs_stats_inc atomic_inc_unchecked
44816
44817 static inline void cifs_stats_bytes_written(struct cifsTconInfo *tcon,
44818 unsigned int bytes)
44819diff -urNp linux-2.6.39.1/fs/cifs/link.c linux-2.6.39.1/fs/cifs/link.c
44820--- linux-2.6.39.1/fs/cifs/link.c 2011-05-19 00:06:34.000000000 -0400
44821+++ linux-2.6.39.1/fs/cifs/link.c 2011-05-22 19:36:32.000000000 -0400
44822@@ -577,7 +577,7 @@ symlink_exit:
44823
44824 void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
44825 {
44826- char *p = nd_get_link(nd);
44827+ const char *p = nd_get_link(nd);
44828 if (!IS_ERR(p))
44829 kfree(p);
44830 }
44831diff -urNp linux-2.6.39.1/fs/coda/cache.c linux-2.6.39.1/fs/coda/cache.c
44832--- linux-2.6.39.1/fs/coda/cache.c 2011-05-19 00:06:34.000000000 -0400
44833+++ linux-2.6.39.1/fs/coda/cache.c 2011-05-22 19:36:32.000000000 -0400
44834@@ -24,7 +24,7 @@
44835 #include "coda_linux.h"
44836 #include "coda_cache.h"
44837
44838-static atomic_t permission_epoch = ATOMIC_INIT(0);
44839+static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
44840
44841 /* replace or extend an acl cache hit */
44842 void coda_cache_enter(struct inode *inode, int mask)
44843@@ -32,7 +32,7 @@ void coda_cache_enter(struct inode *inod
44844 struct coda_inode_info *cii = ITOC(inode);
44845
44846 spin_lock(&cii->c_lock);
44847- cii->c_cached_epoch = atomic_read(&permission_epoch);
44848+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
44849 if (cii->c_uid != current_fsuid()) {
44850 cii->c_uid = current_fsuid();
44851 cii->c_cached_perm = mask;
44852@@ -46,14 +46,14 @@ void coda_cache_clear_inode(struct inode
44853 {
44854 struct coda_inode_info *cii = ITOC(inode);
44855 spin_lock(&cii->c_lock);
44856- cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
44857+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
44858 spin_unlock(&cii->c_lock);
44859 }
44860
44861 /* remove all acl caches */
44862 void coda_cache_clear_all(struct super_block *sb)
44863 {
44864- atomic_inc(&permission_epoch);
44865+ atomic_inc_unchecked(&permission_epoch);
44866 }
44867
44868
44869@@ -66,7 +66,7 @@ int coda_cache_check(struct inode *inode
44870 spin_lock(&cii->c_lock);
44871 hit = (mask & cii->c_cached_perm) == mask &&
44872 cii->c_uid == current_fsuid() &&
44873- cii->c_cached_epoch == atomic_read(&permission_epoch);
44874+ cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
44875 spin_unlock(&cii->c_lock);
44876
44877 return hit;
44878diff -urNp linux-2.6.39.1/fs/compat_binfmt_elf.c linux-2.6.39.1/fs/compat_binfmt_elf.c
44879--- linux-2.6.39.1/fs/compat_binfmt_elf.c 2011-05-19 00:06:34.000000000 -0400
44880+++ linux-2.6.39.1/fs/compat_binfmt_elf.c 2011-05-22 19:36:32.000000000 -0400
44881@@ -30,11 +30,13 @@
44882 #undef elf_phdr
44883 #undef elf_shdr
44884 #undef elf_note
44885+#undef elf_dyn
44886 #undef elf_addr_t
44887 #define elfhdr elf32_hdr
44888 #define elf_phdr elf32_phdr
44889 #define elf_shdr elf32_shdr
44890 #define elf_note elf32_note
44891+#define elf_dyn Elf32_Dyn
44892 #define elf_addr_t Elf32_Addr
44893
44894 /*
44895diff -urNp linux-2.6.39.1/fs/compat.c linux-2.6.39.1/fs/compat.c
44896--- linux-2.6.39.1/fs/compat.c 2011-05-19 00:06:34.000000000 -0400
44897+++ linux-2.6.39.1/fs/compat.c 2011-05-22 19:41:37.000000000 -0400
44898@@ -566,7 +566,7 @@ ssize_t compat_rw_copy_check_uvector(int
44899 goto out;
44900
44901 ret = -EINVAL;
44902- if (nr_segs > UIO_MAXIOV || nr_segs < 0)
44903+ if (nr_segs > UIO_MAXIOV)
44904 goto out;
44905 if (nr_segs > fast_segs) {
44906 ret = -ENOMEM;
44907@@ -848,6 +848,7 @@ struct compat_old_linux_dirent {
44908
44909 struct compat_readdir_callback {
44910 struct compat_old_linux_dirent __user *dirent;
44911+ struct file * file;
44912 int result;
44913 };
44914
44915@@ -865,6 +866,10 @@ static int compat_fillonedir(void *__buf
44916 buf->result = -EOVERFLOW;
44917 return -EOVERFLOW;
44918 }
44919+
44920+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
44921+ return 0;
44922+
44923 buf->result++;
44924 dirent = buf->dirent;
44925 if (!access_ok(VERIFY_WRITE, dirent,
44926@@ -897,6 +902,7 @@ asmlinkage long compat_sys_old_readdir(u
44927
44928 buf.result = 0;
44929 buf.dirent = dirent;
44930+ buf.file = file;
44931
44932 error = vfs_readdir(file, compat_fillonedir, &buf);
44933 if (buf.result)
44934@@ -917,6 +923,7 @@ struct compat_linux_dirent {
44935 struct compat_getdents_callback {
44936 struct compat_linux_dirent __user *current_dir;
44937 struct compat_linux_dirent __user *previous;
44938+ struct file * file;
44939 int count;
44940 int error;
44941 };
44942@@ -938,6 +945,10 @@ static int compat_filldir(void *__buf, c
44943 buf->error = -EOVERFLOW;
44944 return -EOVERFLOW;
44945 }
44946+
44947+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
44948+ return 0;
44949+
44950 dirent = buf->previous;
44951 if (dirent) {
44952 if (__put_user(offset, &dirent->d_off))
44953@@ -985,6 +996,7 @@ asmlinkage long compat_sys_getdents(unsi
44954 buf.previous = NULL;
44955 buf.count = count;
44956 buf.error = 0;
44957+ buf.file = file;
44958
44959 error = vfs_readdir(file, compat_filldir, &buf);
44960 if (error >= 0)
44961@@ -1006,6 +1018,7 @@ out:
44962 struct compat_getdents_callback64 {
44963 struct linux_dirent64 __user *current_dir;
44964 struct linux_dirent64 __user *previous;
44965+ struct file * file;
44966 int count;
44967 int error;
44968 };
44969@@ -1022,6 +1035,10 @@ static int compat_filldir64(void * __buf
44970 buf->error = -EINVAL; /* only used if we fail.. */
44971 if (reclen > buf->count)
44972 return -EINVAL;
44973+
44974+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
44975+ return 0;
44976+
44977 dirent = buf->previous;
44978
44979 if (dirent) {
44980@@ -1073,6 +1090,7 @@ asmlinkage long compat_sys_getdents64(un
44981 buf.previous = NULL;
44982 buf.count = count;
44983 buf.error = 0;
44984+ buf.file = file;
44985
44986 error = vfs_readdir(file, compat_filldir64, &buf);
44987 if (error >= 0)
44988@@ -1436,6 +1454,11 @@ int compat_do_execve(char * filename,
44989 compat_uptr_t __user *envp,
44990 struct pt_regs * regs)
44991 {
44992+#ifdef CONFIG_GRKERNSEC
44993+ struct file *old_exec_file;
44994+ struct acl_subject_label *old_acl;
44995+ struct rlimit old_rlim[RLIM_NLIMITS];
44996+#endif
44997 struct linux_binprm *bprm;
44998 struct file *file;
44999 struct files_struct *displaced;
45000@@ -1472,6 +1495,19 @@ int compat_do_execve(char * filename,
45001 bprm->filename = filename;
45002 bprm->interp = filename;
45003
45004+ if (gr_process_user_ban()) {
45005+ retval = -EPERM;
45006+ goto out_file;
45007+ }
45008+
45009+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
45010+ retval = -EAGAIN;
45011+ if (gr_handle_nproc())
45012+ goto out_file;
45013+ retval = -EACCES;
45014+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
45015+ goto out_file;
45016+
45017 retval = bprm_mm_init(bprm);
45018 if (retval)
45019 goto out_file;
45020@@ -1501,9 +1537,40 @@ int compat_do_execve(char * filename,
45021 if (retval < 0)
45022 goto out;
45023
45024+ if (!gr_tpe_allow(file)) {
45025+ retval = -EACCES;
45026+ goto out;
45027+ }
45028+
45029+ if (gr_check_crash_exec(file)) {
45030+ retval = -EACCES;
45031+ goto out;
45032+ }
45033+
45034+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
45035+
45036+ gr_handle_exec_args_compat(bprm, argv);
45037+
45038+#ifdef CONFIG_GRKERNSEC
45039+ old_acl = current->acl;
45040+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
45041+ old_exec_file = current->exec_file;
45042+ get_file(file);
45043+ current->exec_file = file;
45044+#endif
45045+
45046+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
45047+ bprm->unsafe & LSM_UNSAFE_SHARE);
45048+ if (retval < 0)
45049+ goto out_fail;
45050+
45051 retval = search_binary_handler(bprm, regs);
45052 if (retval < 0)
45053- goto out;
45054+ goto out_fail;
45055+#ifdef CONFIG_GRKERNSEC
45056+ if (old_exec_file)
45057+ fput(old_exec_file);
45058+#endif
45059
45060 /* execve succeeded */
45061 current->fs->in_exec = 0;
45062@@ -1514,6 +1581,14 @@ int compat_do_execve(char * filename,
45063 put_files_struct(displaced);
45064 return retval;
45065
45066+out_fail:
45067+#ifdef CONFIG_GRKERNSEC
45068+ current->acl = old_acl;
45069+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
45070+ fput(current->exec_file);
45071+ current->exec_file = old_exec_file;
45072+#endif
45073+
45074 out:
45075 if (bprm->mm) {
45076 acct_arg_size(bprm, 0);
45077@@ -1681,6 +1756,8 @@ int compat_core_sys_select(int n, compat
45078 struct fdtable *fdt;
45079 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
45080
45081+ pax_track_stack();
45082+
45083 if (n < 0)
45084 goto out_nofds;
45085
45086diff -urNp linux-2.6.39.1/fs/compat_ioctl.c linux-2.6.39.1/fs/compat_ioctl.c
45087--- linux-2.6.39.1/fs/compat_ioctl.c 2011-05-19 00:06:34.000000000 -0400
45088+++ linux-2.6.39.1/fs/compat_ioctl.c 2011-05-22 19:36:32.000000000 -0400
45089@@ -208,6 +208,8 @@ static int do_video_set_spu_palette(unsi
45090
45091 err = get_user(palp, &up->palette);
45092 err |= get_user(length, &up->length);
45093+ if (err)
45094+ return -EFAULT;
45095
45096 up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
45097 err = put_user(compat_ptr(palp), &up_native->palette);
45098@@ -1638,8 +1640,8 @@ asmlinkage long compat_sys_ioctl(unsigne
45099 static int __init init_sys32_ioctl_cmp(const void *p, const void *q)
45100 {
45101 unsigned int a, b;
45102- a = *(unsigned int *)p;
45103- b = *(unsigned int *)q;
45104+ a = *(const unsigned int *)p;
45105+ b = *(const unsigned int *)q;
45106 if (a > b)
45107 return 1;
45108 if (a < b)
45109diff -urNp linux-2.6.39.1/fs/configfs/dir.c linux-2.6.39.1/fs/configfs/dir.c
45110--- linux-2.6.39.1/fs/configfs/dir.c 2011-05-19 00:06:34.000000000 -0400
45111+++ linux-2.6.39.1/fs/configfs/dir.c 2011-05-22 19:36:32.000000000 -0400
45112@@ -1575,7 +1575,8 @@ static int configfs_readdir(struct file
45113 }
45114 for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
45115 struct configfs_dirent *next;
45116- const char * name;
45117+ const unsigned char * name;
45118+ char d_name[sizeof(next->s_dentry->d_iname)];
45119 int len;
45120 struct inode *inode = NULL;
45121
45122@@ -1585,7 +1586,12 @@ static int configfs_readdir(struct file
45123 continue;
45124
45125 name = configfs_get_name(next);
45126- len = strlen(name);
45127+ if (next->s_dentry && name == next->s_dentry->d_iname) {
45128+ len = next->s_dentry->d_name.len;
45129+ memcpy(d_name, name, len);
45130+ name = d_name;
45131+ } else
45132+ len = strlen(name);
45133
45134 /*
45135 * We'll have a dentry and an inode for
45136diff -urNp linux-2.6.39.1/fs/configfs/file.c linux-2.6.39.1/fs/configfs/file.c
45137--- linux-2.6.39.1/fs/configfs/file.c 2011-05-19 00:06:34.000000000 -0400
45138+++ linux-2.6.39.1/fs/configfs/file.c 2011-05-22 19:36:32.000000000 -0400
45139@@ -215,7 +215,7 @@ static int check_perm(struct inode * ino
45140 struct config_item *item = configfs_get_config_item(file->f_path.dentry->d_parent);
45141 struct configfs_attribute * attr = to_attr(file->f_path.dentry);
45142 struct configfs_buffer * buffer;
45143- struct configfs_item_operations * ops = NULL;
45144+ struct configfs_item_operations *ops = NULL;
45145 int error = 0;
45146
45147 if (!item || !attr)
45148diff -urNp linux-2.6.39.1/fs/configfs/item.c linux-2.6.39.1/fs/configfs/item.c
45149--- linux-2.6.39.1/fs/configfs/item.c 2011-05-19 00:06:34.000000000 -0400
45150+++ linux-2.6.39.1/fs/configfs/item.c 2011-05-22 19:36:32.000000000 -0400
45151@@ -123,7 +123,7 @@ void config_item_init_type_name(struct c
45152 EXPORT_SYMBOL(config_item_init_type_name);
45153
45154 void config_group_init_type_name(struct config_group *group, const char *name,
45155- struct config_item_type *type)
45156+ struct config_item_type *type)
45157 {
45158 config_item_set_name(&group->cg_item, name);
45159 group->cg_item.ci_type = type;
45160diff -urNp linux-2.6.39.1/fs/dcache.c linux-2.6.39.1/fs/dcache.c
45161--- linux-2.6.39.1/fs/dcache.c 2011-05-19 00:06:34.000000000 -0400
45162+++ linux-2.6.39.1/fs/dcache.c 2011-05-22 19:36:32.000000000 -0400
45163@@ -3069,7 +3069,7 @@ void __init vfs_caches_init(unsigned lon
45164 mempages -= reserve;
45165
45166 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
45167- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
45168+ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
45169
45170 dcache_init();
45171 inode_init();
45172diff -urNp linux-2.6.39.1/fs/dlm/lockspace.c linux-2.6.39.1/fs/dlm/lockspace.c
45173--- linux-2.6.39.1/fs/dlm/lockspace.c 2011-05-19 00:06:34.000000000 -0400
45174+++ linux-2.6.39.1/fs/dlm/lockspace.c 2011-05-22 19:36:32.000000000 -0400
45175@@ -200,7 +200,7 @@ static int dlm_uevent(struct kset *kset,
45176 return 0;
45177 }
45178
45179-static struct kset_uevent_ops dlm_uevent_ops = {
45180+static const struct kset_uevent_ops dlm_uevent_ops = {
45181 .uevent = dlm_uevent,
45182 };
45183
45184diff -urNp linux-2.6.39.1/fs/ecryptfs/inode.c linux-2.6.39.1/fs/ecryptfs/inode.c
45185--- linux-2.6.39.1/fs/ecryptfs/inode.c 2011-06-03 00:04:14.000000000 -0400
45186+++ linux-2.6.39.1/fs/ecryptfs/inode.c 2011-06-03 00:32:07.000000000 -0400
45187@@ -623,7 +623,7 @@ static int ecryptfs_readlink_lower(struc
45188 old_fs = get_fs();
45189 set_fs(get_ds());
45190 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
45191- (char __user *)lower_buf,
45192+ (__force char __user *)lower_buf,
45193 lower_bufsiz);
45194 set_fs(old_fs);
45195 if (rc < 0)
45196@@ -669,7 +669,7 @@ static void *ecryptfs_follow_link(struct
45197 }
45198 old_fs = get_fs();
45199 set_fs(get_ds());
45200- rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
45201+ rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
45202 set_fs(old_fs);
45203 if (rc < 0) {
45204 kfree(buf);
45205@@ -684,7 +684,7 @@ out:
45206 static void
45207 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
45208 {
45209- char *buf = nd_get_link(nd);
45210+ const char *buf = nd_get_link(nd);
45211 if (!IS_ERR(buf)) {
45212 /* Free the char* */
45213 kfree(buf);
45214diff -urNp linux-2.6.39.1/fs/ecryptfs/miscdev.c linux-2.6.39.1/fs/ecryptfs/miscdev.c
45215--- linux-2.6.39.1/fs/ecryptfs/miscdev.c 2011-05-19 00:06:34.000000000 -0400
45216+++ linux-2.6.39.1/fs/ecryptfs/miscdev.c 2011-05-22 19:36:32.000000000 -0400
45217@@ -328,7 +328,7 @@ check_list:
45218 goto out_unlock_msg_ctx;
45219 i = 5;
45220 if (msg_ctx->msg) {
45221- if (copy_to_user(&buf[i], packet_length, packet_length_size))
45222+ if (packet_length_size > sizeof(packet_length) || copy_to_user(&buf[i], packet_length, packet_length_size))
45223 goto out_unlock_msg_ctx;
45224 i += packet_length_size;
45225 if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
45226diff -urNp linux-2.6.39.1/fs/exec.c linux-2.6.39.1/fs/exec.c
45227--- linux-2.6.39.1/fs/exec.c 2011-05-19 00:06:34.000000000 -0400
45228+++ linux-2.6.39.1/fs/exec.c 2011-06-03 23:33:13.000000000 -0400
45229@@ -55,12 +55,24 @@
45230 #include <linux/fs_struct.h>
45231 #include <linux/pipe_fs_i.h>
45232 #include <linux/oom.h>
45233+#include <linux/random.h>
45234+#include <linux/seq_file.h>
45235+
45236+#ifdef CONFIG_PAX_REFCOUNT
45237+#include <linux/kallsyms.h>
45238+#include <linux/kdebug.h>
45239+#endif
45240
45241 #include <asm/uaccess.h>
45242 #include <asm/mmu_context.h>
45243 #include <asm/tlb.h>
45244 #include "internal.h"
45245
45246+#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
45247+void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
45248+EXPORT_SYMBOL(pax_set_initial_flags_func);
45249+#endif
45250+
45251 int core_uses_pid;
45252 char core_pattern[CORENAME_MAX_SIZE] = "core";
45253 unsigned int core_pipe_limit;
45254@@ -70,7 +82,7 @@ struct core_name {
45255 char *corename;
45256 int used, size;
45257 };
45258-static atomic_t call_count = ATOMIC_INIT(1);
45259+static atomic_unchecked_t call_count = ATOMIC_INIT(1);
45260
45261 /* The maximal length of core_pattern is also specified in sysctl.c */
45262
45263@@ -116,7 +128,7 @@ SYSCALL_DEFINE1(uselib, const char __use
45264 char *tmp = getname(library);
45265 int error = PTR_ERR(tmp);
45266 static const struct open_flags uselib_flags = {
45267- .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
45268+ .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC | FMODE_GREXEC,
45269 .acc_mode = MAY_READ | MAY_EXEC | MAY_OPEN,
45270 .intent = LOOKUP_OPEN
45271 };
45272@@ -190,18 +202,10 @@ struct page *get_arg_page(struct linux_b
45273 int write)
45274 {
45275 struct page *page;
45276- int ret;
45277
45278-#ifdef CONFIG_STACK_GROWSUP
45279- if (write) {
45280- ret = expand_stack_downwards(bprm->vma, pos);
45281- if (ret < 0)
45282- return NULL;
45283- }
45284-#endif
45285- ret = get_user_pages(current, bprm->mm, pos,
45286- 1, write, 1, &page, NULL);
45287- if (ret <= 0)
45288+ if (0 > expand_stack_downwards(bprm->vma, pos))
45289+ return NULL;
45290+ if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
45291 return NULL;
45292
45293 if (write) {
45294@@ -276,6 +280,11 @@ static int __bprm_mm_init(struct linux_b
45295 vma->vm_end = STACK_TOP_MAX;
45296 vma->vm_start = vma->vm_end - PAGE_SIZE;
45297 vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
45298+
45299+#ifdef CONFIG_PAX_SEGMEXEC
45300+ vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
45301+#endif
45302+
45303 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
45304 INIT_LIST_HEAD(&vma->anon_vma_chain);
45305
45306@@ -290,6 +299,12 @@ static int __bprm_mm_init(struct linux_b
45307 mm->stack_vm = mm->total_vm = 1;
45308 up_write(&mm->mmap_sem);
45309 bprm->p = vma->vm_end - sizeof(void *);
45310+
45311+#ifdef CONFIG_PAX_RANDUSTACK
45312+ if (randomize_va_space)
45313+ bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
45314+#endif
45315+
45316 return 0;
45317 err:
45318 up_write(&mm->mmap_sem);
45319@@ -525,7 +540,7 @@ int copy_strings_kernel(int argc, const
45320 int r;
45321 mm_segment_t oldfs = get_fs();
45322 set_fs(KERNEL_DS);
45323- r = copy_strings(argc, (const char __user *const __user *)argv, bprm);
45324+ r = copy_strings(argc, (__force const char __user *const __user *)argv, bprm);
45325 set_fs(oldfs);
45326 return r;
45327 }
45328@@ -555,7 +570,8 @@ static int shift_arg_pages(struct vm_are
45329 unsigned long new_end = old_end - shift;
45330 struct mmu_gather *tlb;
45331
45332- BUG_ON(new_start > new_end);
45333+ if (new_start >= new_end || new_start < mmap_min_addr)
45334+ return -ENOMEM;
45335
45336 /*
45337 * ensure there are no vmas between where we want to go
45338@@ -564,6 +580,10 @@ static int shift_arg_pages(struct vm_are
45339 if (vma != find_vma(mm, new_start))
45340 return -EFAULT;
45341
45342+#ifdef CONFIG_PAX_SEGMEXEC
45343+ BUG_ON(pax_find_mirror_vma(vma));
45344+#endif
45345+
45346 /*
45347 * cover the whole range: [new_start, old_end)
45348 */
45349@@ -644,10 +664,6 @@ int setup_arg_pages(struct linux_binprm
45350 stack_top = arch_align_stack(stack_top);
45351 stack_top = PAGE_ALIGN(stack_top);
45352
45353- if (unlikely(stack_top < mmap_min_addr) ||
45354- unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
45355- return -ENOMEM;
45356-
45357 stack_shift = vma->vm_end - stack_top;
45358
45359 bprm->p -= stack_shift;
45360@@ -659,8 +675,28 @@ int setup_arg_pages(struct linux_binprm
45361 bprm->exec -= stack_shift;
45362
45363 down_write(&mm->mmap_sem);
45364+
45365+ /* Move stack pages down in memory. */
45366+ if (stack_shift) {
45367+ ret = shift_arg_pages(vma, stack_shift);
45368+ if (ret)
45369+ goto out_unlock;
45370+ }
45371+
45372 vm_flags = VM_STACK_FLAGS;
45373
45374+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
45375+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
45376+ vm_flags &= ~VM_EXEC;
45377+
45378+#ifdef CONFIG_PAX_MPROTECT
45379+ if (mm->pax_flags & MF_PAX_MPROTECT)
45380+ vm_flags &= ~VM_MAYEXEC;
45381+#endif
45382+
45383+ }
45384+#endif
45385+
45386 /*
45387 * Adjust stack execute permissions; explicitly enable for
45388 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
45389@@ -679,13 +715,6 @@ int setup_arg_pages(struct linux_binprm
45390 goto out_unlock;
45391 BUG_ON(prev != vma);
45392
45393- /* Move stack pages down in memory. */
45394- if (stack_shift) {
45395- ret = shift_arg_pages(vma, stack_shift);
45396- if (ret)
45397- goto out_unlock;
45398- }
45399-
45400 /* mprotect_fixup is overkill to remove the temporary stack flags */
45401 vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
45402
45403@@ -725,7 +754,7 @@ struct file *open_exec(const char *name)
45404 struct file *file;
45405 int err;
45406 static const struct open_flags open_exec_flags = {
45407- .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
45408+ .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC | FMODE_GREXEC,
45409 .acc_mode = MAY_EXEC | MAY_OPEN,
45410 .intent = LOOKUP_OPEN
45411 };
45412@@ -766,7 +795,7 @@ int kernel_read(struct file *file, loff_
45413 old_fs = get_fs();
45414 set_fs(get_ds());
45415 /* The cast to a user pointer is valid due to the set_fs() */
45416- result = vfs_read(file, (void __user *)addr, count, &pos);
45417+ result = vfs_read(file, (__force void __user *)addr, count, &pos);
45418 set_fs(old_fs);
45419 return result;
45420 }
45421@@ -1188,7 +1217,7 @@ int check_unsafe_exec(struct linux_binpr
45422 }
45423 rcu_read_unlock();
45424
45425- if (p->fs->users > n_fs) {
45426+ if (atomic_read(&p->fs->users) > n_fs) {
45427 bprm->unsafe |= LSM_UNSAFE_SHARE;
45428 } else {
45429 res = -EAGAIN;
45430@@ -1384,6 +1413,11 @@ int do_execve(const char * filename,
45431 const char __user *const __user *envp,
45432 struct pt_regs * regs)
45433 {
45434+#ifdef CONFIG_GRKERNSEC
45435+ struct file *old_exec_file;
45436+ struct acl_subject_label *old_acl;
45437+ struct rlimit old_rlim[RLIM_NLIMITS];
45438+#endif
45439 struct linux_binprm *bprm;
45440 struct file *file;
45441 struct files_struct *displaced;
45442@@ -1420,6 +1454,23 @@ int do_execve(const char * filename,
45443 bprm->filename = filename;
45444 bprm->interp = filename;
45445
45446+ if (gr_process_user_ban()) {
45447+ retval = -EPERM;
45448+ goto out_file;
45449+ }
45450+
45451+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
45452+
45453+ if (gr_handle_nproc()) {
45454+ retval = -EAGAIN;
45455+ goto out_file;
45456+ }
45457+
45458+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
45459+ retval = -EACCES;
45460+ goto out_file;
45461+ }
45462+
45463 retval = bprm_mm_init(bprm);
45464 if (retval)
45465 goto out_file;
45466@@ -1449,9 +1500,40 @@ int do_execve(const char * filename,
45467 if (retval < 0)
45468 goto out;
45469
45470+ if (!gr_tpe_allow(file)) {
45471+ retval = -EACCES;
45472+ goto out;
45473+ }
45474+
45475+ if (gr_check_crash_exec(file)) {
45476+ retval = -EACCES;
45477+ goto out;
45478+ }
45479+
45480+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
45481+
45482+ gr_handle_exec_args(bprm, argv);
45483+
45484+#ifdef CONFIG_GRKERNSEC
45485+ old_acl = current->acl;
45486+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
45487+ old_exec_file = current->exec_file;
45488+ get_file(file);
45489+ current->exec_file = file;
45490+#endif
45491+
45492+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
45493+ bprm->unsafe & LSM_UNSAFE_SHARE);
45494+ if (retval < 0)
45495+ goto out_fail;
45496+
45497 retval = search_binary_handler(bprm,regs);
45498 if (retval < 0)
45499- goto out;
45500+ goto out_fail;
45501+#ifdef CONFIG_GRKERNSEC
45502+ if (old_exec_file)
45503+ fput(old_exec_file);
45504+#endif
45505
45506 /* execve succeeded */
45507 current->fs->in_exec = 0;
45508@@ -1462,6 +1544,14 @@ int do_execve(const char * filename,
45509 put_files_struct(displaced);
45510 return retval;
45511
45512+out_fail:
45513+#ifdef CONFIG_GRKERNSEC
45514+ current->acl = old_acl;
45515+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
45516+ fput(current->exec_file);
45517+ current->exec_file = old_exec_file;
45518+#endif
45519+
45520 out:
45521 if (bprm->mm) {
45522 acct_arg_size(bprm, 0);
45523@@ -1507,7 +1597,7 @@ static int expand_corename(struct core_n
45524 {
45525 char *old_corename = cn->corename;
45526
45527- cn->size = CORENAME_MAX_SIZE * atomic_inc_return(&call_count);
45528+ cn->size = CORENAME_MAX_SIZE * atomic_inc_return_unchecked(&call_count);
45529 cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
45530
45531 if (!cn->corename) {
45532@@ -1560,7 +1650,7 @@ static int format_corename(struct core_n
45533 int pid_in_pattern = 0;
45534 int err = 0;
45535
45536- cn->size = CORENAME_MAX_SIZE * atomic_read(&call_count);
45537+ cn->size = CORENAME_MAX_SIZE * atomic_read_unchecked(&call_count);
45538 cn->corename = kmalloc(cn->size, GFP_KERNEL);
45539 cn->used = 0;
45540
45541@@ -1648,6 +1738,219 @@ out:
45542 return ispipe;
45543 }
45544
45545+int pax_check_flags(unsigned long *flags)
45546+{
45547+ int retval = 0;
45548+
45549+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
45550+ if (*flags & MF_PAX_SEGMEXEC)
45551+ {
45552+ *flags &= ~MF_PAX_SEGMEXEC;
45553+ retval = -EINVAL;
45554+ }
45555+#endif
45556+
45557+ if ((*flags & MF_PAX_PAGEEXEC)
45558+
45559+#ifdef CONFIG_PAX_PAGEEXEC
45560+ && (*flags & MF_PAX_SEGMEXEC)
45561+#endif
45562+
45563+ )
45564+ {
45565+ *flags &= ~MF_PAX_PAGEEXEC;
45566+ retval = -EINVAL;
45567+ }
45568+
45569+ if ((*flags & MF_PAX_MPROTECT)
45570+
45571+#ifdef CONFIG_PAX_MPROTECT
45572+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
45573+#endif
45574+
45575+ )
45576+ {
45577+ *flags &= ~MF_PAX_MPROTECT;
45578+ retval = -EINVAL;
45579+ }
45580+
45581+ if ((*flags & MF_PAX_EMUTRAMP)
45582+
45583+#ifdef CONFIG_PAX_EMUTRAMP
45584+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
45585+#endif
45586+
45587+ )
45588+ {
45589+ *flags &= ~MF_PAX_EMUTRAMP;
45590+ retval = -EINVAL;
45591+ }
45592+
45593+ return retval;
45594+}
45595+
45596+EXPORT_SYMBOL(pax_check_flags);
45597+
45598+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
45599+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
45600+{
45601+ struct task_struct *tsk = current;
45602+ struct mm_struct *mm = current->mm;
45603+ char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
45604+ char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
45605+ char *path_exec = NULL;
45606+ char *path_fault = NULL;
45607+ unsigned long start = 0UL, end = 0UL, offset = 0UL;
45608+
45609+ if (buffer_exec && buffer_fault) {
45610+ struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
45611+
45612+ down_read(&mm->mmap_sem);
45613+ vma = mm->mmap;
45614+ while (vma && (!vma_exec || !vma_fault)) {
45615+ if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
45616+ vma_exec = vma;
45617+ if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
45618+ vma_fault = vma;
45619+ vma = vma->vm_next;
45620+ }
45621+ if (vma_exec) {
45622+ path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
45623+ if (IS_ERR(path_exec))
45624+ path_exec = "<path too long>";
45625+ else {
45626+ path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
45627+ if (path_exec) {
45628+ *path_exec = 0;
45629+ path_exec = buffer_exec;
45630+ } else
45631+ path_exec = "<path too long>";
45632+ }
45633+ }
45634+ if (vma_fault) {
45635+ start = vma_fault->vm_start;
45636+ end = vma_fault->vm_end;
45637+ offset = vma_fault->vm_pgoff << PAGE_SHIFT;
45638+ if (vma_fault->vm_file) {
45639+ path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
45640+ if (IS_ERR(path_fault))
45641+ path_fault = "<path too long>";
45642+ else {
45643+ path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
45644+ if (path_fault) {
45645+ *path_fault = 0;
45646+ path_fault = buffer_fault;
45647+ } else
45648+ path_fault = "<path too long>";
45649+ }
45650+ } else
45651+ path_fault = "<anonymous mapping>";
45652+ }
45653+ up_read(&mm->mmap_sem);
45654+ }
45655+ if (tsk->signal->curr_ip)
45656+ printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
45657+ else
45658+ printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
45659+ printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
45660+ "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
45661+ task_uid(tsk), task_euid(tsk), pc, sp);
45662+ free_page((unsigned long)buffer_exec);
45663+ free_page((unsigned long)buffer_fault);
45664+ pax_report_insns(pc, sp);
45665+ do_coredump(SIGKILL, SIGKILL, regs);
45666+}
45667+#endif
45668+
45669+#ifdef CONFIG_PAX_REFCOUNT
45670+void pax_report_refcount_overflow(struct pt_regs *regs)
45671+{
45672+ if (current->signal->curr_ip)
45673+ printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
45674+ &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
45675+ else
45676+ printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
45677+ current->comm, task_pid_nr(current), current_uid(), current_euid());
45678+ print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
45679+ show_regs(regs);
45680+ force_sig_info(SIGKILL, SEND_SIG_FORCED, current);
45681+}
45682+#endif
45683+
45684+#ifdef CONFIG_PAX_USERCOPY
45685+/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
45686+int object_is_on_stack(const void *obj, unsigned long len)
45687+{
45688+ const void * const stack = task_stack_page(current);
45689+ const void * const stackend = stack + THREAD_SIZE;
45690+
45691+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
45692+ const void *frame = NULL;
45693+ const void *oldframe;
45694+#endif
45695+
45696+ if (obj + len < obj)
45697+ return -1;
45698+
45699+ if (obj + len <= stack || stackend <= obj)
45700+ return 0;
45701+
45702+ if (obj < stack || stackend < obj + len)
45703+ return -1;
45704+
45705+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
45706+ oldframe = __builtin_frame_address(1);
45707+ if (oldframe)
45708+ frame = __builtin_frame_address(2);
45709+ /*
45710+ low ----------------------------------------------> high
45711+ [saved bp][saved ip][args][local vars][saved bp][saved ip]
45712+ ^----------------^
45713+ allow copies only within here
45714+ */
45715+ while (stack <= frame && frame < stackend) {
45716+ /* if obj + len extends past the last frame, this
45717+ check won't pass and the next frame will be 0,
45718+ causing us to bail out and correctly report
45719+ the copy as invalid
45720+ */
45721+ if (obj + len <= frame)
45722+ return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
45723+ oldframe = frame;
45724+ frame = *(const void * const *)frame;
45725+ }
45726+ return -1;
45727+#else
45728+ return 1;
45729+#endif
45730+}
45731+
45732+
45733+void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
45734+{
45735+ if (current->signal->curr_ip)
45736+ printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
45737+ &current->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
45738+ else
45739+ printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
45740+ to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
45741+ dump_stack();
45742+ gr_handle_kernel_exploit();
45743+ do_group_exit(SIGKILL);
45744+}
45745+#endif
45746+
45747+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
45748+void pax_track_stack(void)
45749+{
45750+ unsigned long sp = (unsigned long)&sp;
45751+ if (sp < current_thread_info()->lowest_stack &&
45752+ sp > (unsigned long)task_stack_page(current))
45753+ current_thread_info()->lowest_stack = sp;
45754+}
45755+EXPORT_SYMBOL(pax_track_stack);
45756+#endif
45757+
45758 static int zap_process(struct task_struct *start, int exit_code)
45759 {
45760 struct task_struct *t;
45761@@ -1858,17 +2161,17 @@ static void wait_for_dump_helpers(struct
45762 pipe = file->f_path.dentry->d_inode->i_pipe;
45763
45764 pipe_lock(pipe);
45765- pipe->readers++;
45766- pipe->writers--;
45767+ atomic_inc(&pipe->readers);
45768+ atomic_dec(&pipe->writers);
45769
45770- while ((pipe->readers > 1) && (!signal_pending(current))) {
45771+ while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
45772 wake_up_interruptible_sync(&pipe->wait);
45773 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
45774 pipe_wait(pipe);
45775 }
45776
45777- pipe->readers--;
45778- pipe->writers++;
45779+ atomic_dec(&pipe->readers);
45780+ atomic_inc(&pipe->writers);
45781 pipe_unlock(pipe);
45782
45783 }
45784@@ -1929,7 +2232,7 @@ void do_coredump(long signr, int exit_co
45785 int retval = 0;
45786 int flag = 0;
45787 int ispipe;
45788- static atomic_t core_dump_count = ATOMIC_INIT(0);
45789+ static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
45790 struct coredump_params cprm = {
45791 .signr = signr,
45792 .regs = regs,
45793@@ -1944,6 +2247,9 @@ void do_coredump(long signr, int exit_co
45794
45795 audit_core_dumps(signr);
45796
45797+ if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
45798+ gr_handle_brute_attach(current, cprm.mm_flags);
45799+
45800 binfmt = mm->binfmt;
45801 if (!binfmt || !binfmt->core_dump)
45802 goto fail;
45803@@ -1984,6 +2290,8 @@ void do_coredump(long signr, int exit_co
45804 goto fail_corename;
45805 }
45806
45807+ gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
45808+
45809 if (ispipe) {
45810 int dump_count;
45811 char **helper_argv;
45812@@ -2011,7 +2319,7 @@ void do_coredump(long signr, int exit_co
45813 }
45814 cprm.limit = RLIM_INFINITY;
45815
45816- dump_count = atomic_inc_return(&core_dump_count);
45817+ dump_count = atomic_inc_return_unchecked(&core_dump_count);
45818 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
45819 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
45820 task_tgid_vnr(current), current->comm);
45821@@ -2081,7 +2389,7 @@ close_fail:
45822 filp_close(cprm.file, NULL);
45823 fail_dropcount:
45824 if (ispipe)
45825- atomic_dec(&core_dump_count);
45826+ atomic_dec_unchecked(&core_dump_count);
45827 fail_unlock:
45828 kfree(cn.corename);
45829 fail_corename:
45830diff -urNp linux-2.6.39.1/fs/ext2/balloc.c linux-2.6.39.1/fs/ext2/balloc.c
45831--- linux-2.6.39.1/fs/ext2/balloc.c 2011-05-19 00:06:34.000000000 -0400
45832+++ linux-2.6.39.1/fs/ext2/balloc.c 2011-05-22 19:41:37.000000000 -0400
45833@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
45834
45835 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
45836 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
45837- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
45838+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
45839 sbi->s_resuid != current_fsuid() &&
45840 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
45841 return 0;
45842diff -urNp linux-2.6.39.1/fs/ext3/balloc.c linux-2.6.39.1/fs/ext3/balloc.c
45843--- linux-2.6.39.1/fs/ext3/balloc.c 2011-05-19 00:06:34.000000000 -0400
45844+++ linux-2.6.39.1/fs/ext3/balloc.c 2011-05-22 19:41:37.000000000 -0400
45845@@ -1441,7 +1441,7 @@ static int ext3_has_free_blocks(struct e
45846
45847 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
45848 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
45849- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
45850+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
45851 sbi->s_resuid != current_fsuid() &&
45852 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
45853 return 0;
45854diff -urNp linux-2.6.39.1/fs/ext4/balloc.c linux-2.6.39.1/fs/ext4/balloc.c
45855--- linux-2.6.39.1/fs/ext4/balloc.c 2011-05-19 00:06:34.000000000 -0400
45856+++ linux-2.6.39.1/fs/ext4/balloc.c 2011-05-22 19:41:37.000000000 -0400
45857@@ -522,7 +522,7 @@ static int ext4_has_free_blocks(struct e
45858 /* Hm, nope. Are (enough) root reserved blocks available? */
45859 if (sbi->s_resuid == current_fsuid() ||
45860 ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
45861- capable(CAP_SYS_RESOURCE)) {
45862+ capable_nolog(CAP_SYS_RESOURCE)) {
45863 if (free_blocks >= (nblocks + dirty_blocks))
45864 return 1;
45865 }
45866diff -urNp linux-2.6.39.1/fs/ext4/ext4.h linux-2.6.39.1/fs/ext4/ext4.h
45867--- linux-2.6.39.1/fs/ext4/ext4.h 2011-06-03 00:04:14.000000000 -0400
45868+++ linux-2.6.39.1/fs/ext4/ext4.h 2011-06-03 00:32:07.000000000 -0400
45869@@ -1166,19 +1166,19 @@ struct ext4_sb_info {
45870 unsigned long s_mb_last_start;
45871
45872 /* stats for buddy allocator */
45873- atomic_t s_bal_reqs; /* number of reqs with len > 1 */
45874- atomic_t s_bal_success; /* we found long enough chunks */
45875- atomic_t s_bal_allocated; /* in blocks */
45876- atomic_t s_bal_ex_scanned; /* total extents scanned */
45877- atomic_t s_bal_goals; /* goal hits */
45878- atomic_t s_bal_breaks; /* too long searches */
45879- atomic_t s_bal_2orders; /* 2^order hits */
45880+ atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
45881+ atomic_unchecked_t s_bal_success; /* we found long enough chunks */
45882+ atomic_unchecked_t s_bal_allocated; /* in blocks */
45883+ atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
45884+ atomic_unchecked_t s_bal_goals; /* goal hits */
45885+ atomic_unchecked_t s_bal_breaks; /* too long searches */
45886+ atomic_unchecked_t s_bal_2orders; /* 2^order hits */
45887 spinlock_t s_bal_lock;
45888 unsigned long s_mb_buddies_generated;
45889 unsigned long long s_mb_generation_time;
45890- atomic_t s_mb_lost_chunks;
45891- atomic_t s_mb_preallocated;
45892- atomic_t s_mb_discarded;
45893+ atomic_unchecked_t s_mb_lost_chunks;
45894+ atomic_unchecked_t s_mb_preallocated;
45895+ atomic_unchecked_t s_mb_discarded;
45896 atomic_t s_lock_busy;
45897
45898 /* locality groups */
45899diff -urNp linux-2.6.39.1/fs/ext4/mballoc.c linux-2.6.39.1/fs/ext4/mballoc.c
45900--- linux-2.6.39.1/fs/ext4/mballoc.c 2011-06-03 00:04:14.000000000 -0400
45901+++ linux-2.6.39.1/fs/ext4/mballoc.c 2011-06-03 00:32:07.000000000 -0400
45902@@ -1853,7 +1853,7 @@ void ext4_mb_simple_scan_group(struct ex
45903 BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
45904
45905 if (EXT4_SB(sb)->s_mb_stats)
45906- atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
45907+ atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
45908
45909 break;
45910 }
45911@@ -2147,7 +2147,7 @@ repeat:
45912 ac->ac_status = AC_STATUS_CONTINUE;
45913 ac->ac_flags |= EXT4_MB_HINT_FIRST;
45914 cr = 3;
45915- atomic_inc(&sbi->s_mb_lost_chunks);
45916+ atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
45917 goto repeat;
45918 }
45919 }
45920@@ -2190,6 +2190,8 @@ static int ext4_mb_seq_groups_show(struc
45921 ext4_grpblk_t counters[16];
45922 } sg;
45923
45924+ pax_track_stack();
45925+
45926 group--;
45927 if (group == 0)
45928 seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
45929@@ -2613,25 +2615,25 @@ int ext4_mb_release(struct super_block *
45930 if (sbi->s_mb_stats) {
45931 printk(KERN_INFO
45932 "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n",
45933- atomic_read(&sbi->s_bal_allocated),
45934- atomic_read(&sbi->s_bal_reqs),
45935- atomic_read(&sbi->s_bal_success));
45936+ atomic_read_unchecked(&sbi->s_bal_allocated),
45937+ atomic_read_unchecked(&sbi->s_bal_reqs),
45938+ atomic_read_unchecked(&sbi->s_bal_success));
45939 printk(KERN_INFO
45940 "EXT4-fs: mballoc: %u extents scanned, %u goal hits, "
45941 "%u 2^N hits, %u breaks, %u lost\n",
45942- atomic_read(&sbi->s_bal_ex_scanned),
45943- atomic_read(&sbi->s_bal_goals),
45944- atomic_read(&sbi->s_bal_2orders),
45945- atomic_read(&sbi->s_bal_breaks),
45946- atomic_read(&sbi->s_mb_lost_chunks));
45947+ atomic_read_unchecked(&sbi->s_bal_ex_scanned),
45948+ atomic_read_unchecked(&sbi->s_bal_goals),
45949+ atomic_read_unchecked(&sbi->s_bal_2orders),
45950+ atomic_read_unchecked(&sbi->s_bal_breaks),
45951+ atomic_read_unchecked(&sbi->s_mb_lost_chunks));
45952 printk(KERN_INFO
45953 "EXT4-fs: mballoc: %lu generated and it took %Lu\n",
45954 sbi->s_mb_buddies_generated++,
45955 sbi->s_mb_generation_time);
45956 printk(KERN_INFO
45957 "EXT4-fs: mballoc: %u preallocated, %u discarded\n",
45958- atomic_read(&sbi->s_mb_preallocated),
45959- atomic_read(&sbi->s_mb_discarded));
45960+ atomic_read_unchecked(&sbi->s_mb_preallocated),
45961+ atomic_read_unchecked(&sbi->s_mb_discarded));
45962 }
45963
45964 free_percpu(sbi->s_locality_groups);
45965@@ -3107,16 +3109,16 @@ static void ext4_mb_collect_stats(struct
45966 struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
45967
45968 if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
45969- atomic_inc(&sbi->s_bal_reqs);
45970- atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
45971+ atomic_inc_unchecked(&sbi->s_bal_reqs);
45972+ atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
45973 if (ac->ac_b_ex.fe_len >= ac->ac_o_ex.fe_len)
45974- atomic_inc(&sbi->s_bal_success);
45975- atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
45976+ atomic_inc_unchecked(&sbi->s_bal_success);
45977+ atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
45978 if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
45979 ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
45980- atomic_inc(&sbi->s_bal_goals);
45981+ atomic_inc_unchecked(&sbi->s_bal_goals);
45982 if (ac->ac_found > sbi->s_mb_max_to_scan)
45983- atomic_inc(&sbi->s_bal_breaks);
45984+ atomic_inc_unchecked(&sbi->s_bal_breaks);
45985 }
45986
45987 if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
45988@@ -3514,7 +3516,7 @@ ext4_mb_new_inode_pa(struct ext4_allocat
45989 trace_ext4_mb_new_inode_pa(ac, pa);
45990
45991 ext4_mb_use_inode_pa(ac, pa);
45992- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
45993+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
45994
45995 ei = EXT4_I(ac->ac_inode);
45996 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
45997@@ -3574,7 +3576,7 @@ ext4_mb_new_group_pa(struct ext4_allocat
45998 trace_ext4_mb_new_group_pa(ac, pa);
45999
46000 ext4_mb_use_group_pa(ac, pa);
46001- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
46002+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
46003
46004 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
46005 lg = ac->ac_lg;
46006@@ -3661,7 +3663,7 @@ ext4_mb_release_inode_pa(struct ext4_bud
46007 * from the bitmap and continue.
46008 */
46009 }
46010- atomic_add(free, &sbi->s_mb_discarded);
46011+ atomic_add_unchecked(free, &sbi->s_mb_discarded);
46012
46013 return err;
46014 }
46015@@ -3679,7 +3681,7 @@ ext4_mb_release_group_pa(struct ext4_bud
46016 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
46017 BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
46018 mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
46019- atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
46020+ atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
46021 trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
46022
46023 return 0;
46024diff -urNp linux-2.6.39.1/fs/fcntl.c linux-2.6.39.1/fs/fcntl.c
46025--- linux-2.6.39.1/fs/fcntl.c 2011-05-19 00:06:34.000000000 -0400
46026+++ linux-2.6.39.1/fs/fcntl.c 2011-05-22 20:45:50.000000000 -0400
46027@@ -224,6 +224,11 @@ int __f_setown(struct file *filp, struct
46028 if (err)
46029 return err;
46030
46031+ if (gr_handle_chroot_fowner(pid, type))
46032+ return -ENOENT;
46033+ if (gr_check_protected_task_fowner(pid, type))
46034+ return -EACCES;
46035+
46036 f_modown(filp, pid, type, force);
46037 return 0;
46038 }
46039@@ -348,6 +353,7 @@ static long do_fcntl(int fd, unsigned in
46040 switch (cmd) {
46041 case F_DUPFD:
46042 case F_DUPFD_CLOEXEC:
46043+ gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
46044 if (arg >= rlimit(RLIMIT_NOFILE))
46045 break;
46046 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
46047@@ -835,14 +841,14 @@ static int __init fcntl_init(void)
46048 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
46049 * is defined as O_NONBLOCK on some platforms and not on others.
46050 */
46051- BUILD_BUG_ON(19 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
46052+ BUILD_BUG_ON(20 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
46053 O_RDONLY | O_WRONLY | O_RDWR |
46054 O_CREAT | O_EXCL | O_NOCTTY |
46055 O_TRUNC | O_APPEND | /* O_NONBLOCK | */
46056 __O_SYNC | O_DSYNC | FASYNC |
46057 O_DIRECT | O_LARGEFILE | O_DIRECTORY |
46058 O_NOFOLLOW | O_NOATIME | O_CLOEXEC |
46059- __FMODE_EXEC | O_PATH
46060+ __FMODE_EXEC | O_PATH | FMODE_GREXEC
46061 ));
46062
46063 fasync_cache = kmem_cache_create("fasync_cache",
46064diff -urNp linux-2.6.39.1/fs/fifo.c linux-2.6.39.1/fs/fifo.c
46065--- linux-2.6.39.1/fs/fifo.c 2011-05-19 00:06:34.000000000 -0400
46066+++ linux-2.6.39.1/fs/fifo.c 2011-05-22 19:36:32.000000000 -0400
46067@@ -58,10 +58,10 @@ static int fifo_open(struct inode *inode
46068 */
46069 filp->f_op = &read_pipefifo_fops;
46070 pipe->r_counter++;
46071- if (pipe->readers++ == 0)
46072+ if (atomic_inc_return(&pipe->readers) == 1)
46073 wake_up_partner(inode);
46074
46075- if (!pipe->writers) {
46076+ if (!atomic_read(&pipe->writers)) {
46077 if ((filp->f_flags & O_NONBLOCK)) {
46078 /* suppress POLLHUP until we have
46079 * seen a writer */
46080@@ -81,15 +81,15 @@ static int fifo_open(struct inode *inode
46081 * errno=ENXIO when there is no process reading the FIFO.
46082 */
46083 ret = -ENXIO;
46084- if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
46085+ if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
46086 goto err;
46087
46088 filp->f_op = &write_pipefifo_fops;
46089 pipe->w_counter++;
46090- if (!pipe->writers++)
46091+ if (atomic_inc_return(&pipe->writers) == 1)
46092 wake_up_partner(inode);
46093
46094- if (!pipe->readers) {
46095+ if (!atomic_read(&pipe->readers)) {
46096 wait_for_partner(inode, &pipe->r_counter);
46097 if (signal_pending(current))
46098 goto err_wr;
46099@@ -105,11 +105,11 @@ static int fifo_open(struct inode *inode
46100 */
46101 filp->f_op = &rdwr_pipefifo_fops;
46102
46103- pipe->readers++;
46104- pipe->writers++;
46105+ atomic_inc(&pipe->readers);
46106+ atomic_inc(&pipe->writers);
46107 pipe->r_counter++;
46108 pipe->w_counter++;
46109- if (pipe->readers == 1 || pipe->writers == 1)
46110+ if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
46111 wake_up_partner(inode);
46112 break;
46113
46114@@ -123,19 +123,19 @@ static int fifo_open(struct inode *inode
46115 return 0;
46116
46117 err_rd:
46118- if (!--pipe->readers)
46119+ if (atomic_dec_and_test(&pipe->readers))
46120 wake_up_interruptible(&pipe->wait);
46121 ret = -ERESTARTSYS;
46122 goto err;
46123
46124 err_wr:
46125- if (!--pipe->writers)
46126+ if (atomic_dec_and_test(&pipe->writers))
46127 wake_up_interruptible(&pipe->wait);
46128 ret = -ERESTARTSYS;
46129 goto err;
46130
46131 err:
46132- if (!pipe->readers && !pipe->writers)
46133+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
46134 free_pipe_info(inode);
46135
46136 err_nocleanup:
46137diff -urNp linux-2.6.39.1/fs/file.c linux-2.6.39.1/fs/file.c
46138--- linux-2.6.39.1/fs/file.c 2011-05-19 00:06:34.000000000 -0400
46139+++ linux-2.6.39.1/fs/file.c 2011-05-22 19:41:37.000000000 -0400
46140@@ -15,6 +15,7 @@
46141 #include <linux/slab.h>
46142 #include <linux/vmalloc.h>
46143 #include <linux/file.h>
46144+#include <linux/security.h>
46145 #include <linux/fdtable.h>
46146 #include <linux/bitops.h>
46147 #include <linux/interrupt.h>
46148@@ -254,6 +255,7 @@ int expand_files(struct files_struct *fi
46149 * N.B. For clone tasks sharing a files structure, this test
46150 * will limit the total number of files that can be opened.
46151 */
46152+ gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
46153 if (nr >= rlimit(RLIMIT_NOFILE))
46154 return -EMFILE;
46155
46156diff -urNp linux-2.6.39.1/fs/filesystems.c linux-2.6.39.1/fs/filesystems.c
46157--- linux-2.6.39.1/fs/filesystems.c 2011-05-19 00:06:34.000000000 -0400
46158+++ linux-2.6.39.1/fs/filesystems.c 2011-05-22 19:41:37.000000000 -0400
46159@@ -274,7 +274,12 @@ struct file_system_type *get_fs_type(con
46160 int len = dot ? dot - name : strlen(name);
46161
46162 fs = __get_fs_type(name, len);
46163+
46164+#ifdef CONFIG_GRKERNSEC_MODHARDEN
46165+ if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
46166+#else
46167 if (!fs && (request_module("%.*s", len, name) == 0))
46168+#endif
46169 fs = __get_fs_type(name, len);
46170
46171 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
46172diff -urNp linux-2.6.39.1/fs/fscache/cookie.c linux-2.6.39.1/fs/fscache/cookie.c
46173--- linux-2.6.39.1/fs/fscache/cookie.c 2011-05-19 00:06:34.000000000 -0400
46174+++ linux-2.6.39.1/fs/fscache/cookie.c 2011-05-22 19:36:32.000000000 -0400
46175@@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire
46176 parent ? (char *) parent->def->name : "<no-parent>",
46177 def->name, netfs_data);
46178
46179- fscache_stat(&fscache_n_acquires);
46180+ fscache_stat_unchecked(&fscache_n_acquires);
46181
46182 /* if there's no parent cookie, then we don't create one here either */
46183 if (!parent) {
46184- fscache_stat(&fscache_n_acquires_null);
46185+ fscache_stat_unchecked(&fscache_n_acquires_null);
46186 _leave(" [no parent]");
46187 return NULL;
46188 }
46189@@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire
46190 /* allocate and initialise a cookie */
46191 cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
46192 if (!cookie) {
46193- fscache_stat(&fscache_n_acquires_oom);
46194+ fscache_stat_unchecked(&fscache_n_acquires_oom);
46195 _leave(" [ENOMEM]");
46196 return NULL;
46197 }
46198@@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire
46199
46200 switch (cookie->def->type) {
46201 case FSCACHE_COOKIE_TYPE_INDEX:
46202- fscache_stat(&fscache_n_cookie_index);
46203+ fscache_stat_unchecked(&fscache_n_cookie_index);
46204 break;
46205 case FSCACHE_COOKIE_TYPE_DATAFILE:
46206- fscache_stat(&fscache_n_cookie_data);
46207+ fscache_stat_unchecked(&fscache_n_cookie_data);
46208 break;
46209 default:
46210- fscache_stat(&fscache_n_cookie_special);
46211+ fscache_stat_unchecked(&fscache_n_cookie_special);
46212 break;
46213 }
46214
46215@@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire
46216 if (fscache_acquire_non_index_cookie(cookie) < 0) {
46217 atomic_dec(&parent->n_children);
46218 __fscache_cookie_put(cookie);
46219- fscache_stat(&fscache_n_acquires_nobufs);
46220+ fscache_stat_unchecked(&fscache_n_acquires_nobufs);
46221 _leave(" = NULL");
46222 return NULL;
46223 }
46224 }
46225
46226- fscache_stat(&fscache_n_acquires_ok);
46227+ fscache_stat_unchecked(&fscache_n_acquires_ok);
46228 _leave(" = %p", cookie);
46229 return cookie;
46230 }
46231@@ -168,7 +168,7 @@ static int fscache_acquire_non_index_coo
46232 cache = fscache_select_cache_for_object(cookie->parent);
46233 if (!cache) {
46234 up_read(&fscache_addremove_sem);
46235- fscache_stat(&fscache_n_acquires_no_cache);
46236+ fscache_stat_unchecked(&fscache_n_acquires_no_cache);
46237 _leave(" = -ENOMEDIUM [no cache]");
46238 return -ENOMEDIUM;
46239 }
46240@@ -256,12 +256,12 @@ static int fscache_alloc_object(struct f
46241 object = cache->ops->alloc_object(cache, cookie);
46242 fscache_stat_d(&fscache_n_cop_alloc_object);
46243 if (IS_ERR(object)) {
46244- fscache_stat(&fscache_n_object_no_alloc);
46245+ fscache_stat_unchecked(&fscache_n_object_no_alloc);
46246 ret = PTR_ERR(object);
46247 goto error;
46248 }
46249
46250- fscache_stat(&fscache_n_object_alloc);
46251+ fscache_stat_unchecked(&fscache_n_object_alloc);
46252
46253 object->debug_id = atomic_inc_return(&fscache_object_debug_id);
46254
46255@@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fsca
46256 struct fscache_object *object;
46257 struct hlist_node *_p;
46258
46259- fscache_stat(&fscache_n_updates);
46260+ fscache_stat_unchecked(&fscache_n_updates);
46261
46262 if (!cookie) {
46263- fscache_stat(&fscache_n_updates_null);
46264+ fscache_stat_unchecked(&fscache_n_updates_null);
46265 _leave(" [no cookie]");
46266 return;
46267 }
46268@@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct
46269 struct fscache_object *object;
46270 unsigned long event;
46271
46272- fscache_stat(&fscache_n_relinquishes);
46273+ fscache_stat_unchecked(&fscache_n_relinquishes);
46274 if (retire)
46275- fscache_stat(&fscache_n_relinquishes_retire);
46276+ fscache_stat_unchecked(&fscache_n_relinquishes_retire);
46277
46278 if (!cookie) {
46279- fscache_stat(&fscache_n_relinquishes_null);
46280+ fscache_stat_unchecked(&fscache_n_relinquishes_null);
46281 _leave(" [no cookie]");
46282 return;
46283 }
46284@@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct
46285
46286 /* wait for the cookie to finish being instantiated (or to fail) */
46287 if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
46288- fscache_stat(&fscache_n_relinquishes_waitcrt);
46289+ fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
46290 wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
46291 fscache_wait_bit, TASK_UNINTERRUPTIBLE);
46292 }
46293diff -urNp linux-2.6.39.1/fs/fscache/internal.h linux-2.6.39.1/fs/fscache/internal.h
46294--- linux-2.6.39.1/fs/fscache/internal.h 2011-05-19 00:06:34.000000000 -0400
46295+++ linux-2.6.39.1/fs/fscache/internal.h 2011-05-22 19:36:32.000000000 -0400
46296@@ -144,94 +144,94 @@ extern void fscache_proc_cleanup(void);
46297 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
46298 extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
46299
46300-extern atomic_t fscache_n_op_pend;
46301-extern atomic_t fscache_n_op_run;
46302-extern atomic_t fscache_n_op_enqueue;
46303-extern atomic_t fscache_n_op_deferred_release;
46304-extern atomic_t fscache_n_op_release;
46305-extern atomic_t fscache_n_op_gc;
46306-extern atomic_t fscache_n_op_cancelled;
46307-extern atomic_t fscache_n_op_rejected;
46308-
46309-extern atomic_t fscache_n_attr_changed;
46310-extern atomic_t fscache_n_attr_changed_ok;
46311-extern atomic_t fscache_n_attr_changed_nobufs;
46312-extern atomic_t fscache_n_attr_changed_nomem;
46313-extern atomic_t fscache_n_attr_changed_calls;
46314-
46315-extern atomic_t fscache_n_allocs;
46316-extern atomic_t fscache_n_allocs_ok;
46317-extern atomic_t fscache_n_allocs_wait;
46318-extern atomic_t fscache_n_allocs_nobufs;
46319-extern atomic_t fscache_n_allocs_intr;
46320-extern atomic_t fscache_n_allocs_object_dead;
46321-extern atomic_t fscache_n_alloc_ops;
46322-extern atomic_t fscache_n_alloc_op_waits;
46323-
46324-extern atomic_t fscache_n_retrievals;
46325-extern atomic_t fscache_n_retrievals_ok;
46326-extern atomic_t fscache_n_retrievals_wait;
46327-extern atomic_t fscache_n_retrievals_nodata;
46328-extern atomic_t fscache_n_retrievals_nobufs;
46329-extern atomic_t fscache_n_retrievals_intr;
46330-extern atomic_t fscache_n_retrievals_nomem;
46331-extern atomic_t fscache_n_retrievals_object_dead;
46332-extern atomic_t fscache_n_retrieval_ops;
46333-extern atomic_t fscache_n_retrieval_op_waits;
46334-
46335-extern atomic_t fscache_n_stores;
46336-extern atomic_t fscache_n_stores_ok;
46337-extern atomic_t fscache_n_stores_again;
46338-extern atomic_t fscache_n_stores_nobufs;
46339-extern atomic_t fscache_n_stores_oom;
46340-extern atomic_t fscache_n_store_ops;
46341-extern atomic_t fscache_n_store_calls;
46342-extern atomic_t fscache_n_store_pages;
46343-extern atomic_t fscache_n_store_radix_deletes;
46344-extern atomic_t fscache_n_store_pages_over_limit;
46345-
46346-extern atomic_t fscache_n_store_vmscan_not_storing;
46347-extern atomic_t fscache_n_store_vmscan_gone;
46348-extern atomic_t fscache_n_store_vmscan_busy;
46349-extern atomic_t fscache_n_store_vmscan_cancelled;
46350-
46351-extern atomic_t fscache_n_marks;
46352-extern atomic_t fscache_n_uncaches;
46353-
46354-extern atomic_t fscache_n_acquires;
46355-extern atomic_t fscache_n_acquires_null;
46356-extern atomic_t fscache_n_acquires_no_cache;
46357-extern atomic_t fscache_n_acquires_ok;
46358-extern atomic_t fscache_n_acquires_nobufs;
46359-extern atomic_t fscache_n_acquires_oom;
46360-
46361-extern atomic_t fscache_n_updates;
46362-extern atomic_t fscache_n_updates_null;
46363-extern atomic_t fscache_n_updates_run;
46364-
46365-extern atomic_t fscache_n_relinquishes;
46366-extern atomic_t fscache_n_relinquishes_null;
46367-extern atomic_t fscache_n_relinquishes_waitcrt;
46368-extern atomic_t fscache_n_relinquishes_retire;
46369-
46370-extern atomic_t fscache_n_cookie_index;
46371-extern atomic_t fscache_n_cookie_data;
46372-extern atomic_t fscache_n_cookie_special;
46373-
46374-extern atomic_t fscache_n_object_alloc;
46375-extern atomic_t fscache_n_object_no_alloc;
46376-extern atomic_t fscache_n_object_lookups;
46377-extern atomic_t fscache_n_object_lookups_negative;
46378-extern atomic_t fscache_n_object_lookups_positive;
46379-extern atomic_t fscache_n_object_lookups_timed_out;
46380-extern atomic_t fscache_n_object_created;
46381-extern atomic_t fscache_n_object_avail;
46382-extern atomic_t fscache_n_object_dead;
46383-
46384-extern atomic_t fscache_n_checkaux_none;
46385-extern atomic_t fscache_n_checkaux_okay;
46386-extern atomic_t fscache_n_checkaux_update;
46387-extern atomic_t fscache_n_checkaux_obsolete;
46388+extern atomic_unchecked_t fscache_n_op_pend;
46389+extern atomic_unchecked_t fscache_n_op_run;
46390+extern atomic_unchecked_t fscache_n_op_enqueue;
46391+extern atomic_unchecked_t fscache_n_op_deferred_release;
46392+extern atomic_unchecked_t fscache_n_op_release;
46393+extern atomic_unchecked_t fscache_n_op_gc;
46394+extern atomic_unchecked_t fscache_n_op_cancelled;
46395+extern atomic_unchecked_t fscache_n_op_rejected;
46396+
46397+extern atomic_unchecked_t fscache_n_attr_changed;
46398+extern atomic_unchecked_t fscache_n_attr_changed_ok;
46399+extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
46400+extern atomic_unchecked_t fscache_n_attr_changed_nomem;
46401+extern atomic_unchecked_t fscache_n_attr_changed_calls;
46402+
46403+extern atomic_unchecked_t fscache_n_allocs;
46404+extern atomic_unchecked_t fscache_n_allocs_ok;
46405+extern atomic_unchecked_t fscache_n_allocs_wait;
46406+extern atomic_unchecked_t fscache_n_allocs_nobufs;
46407+extern atomic_unchecked_t fscache_n_allocs_intr;
46408+extern atomic_unchecked_t fscache_n_allocs_object_dead;
46409+extern atomic_unchecked_t fscache_n_alloc_ops;
46410+extern atomic_unchecked_t fscache_n_alloc_op_waits;
46411+
46412+extern atomic_unchecked_t fscache_n_retrievals;
46413+extern atomic_unchecked_t fscache_n_retrievals_ok;
46414+extern atomic_unchecked_t fscache_n_retrievals_wait;
46415+extern atomic_unchecked_t fscache_n_retrievals_nodata;
46416+extern atomic_unchecked_t fscache_n_retrievals_nobufs;
46417+extern atomic_unchecked_t fscache_n_retrievals_intr;
46418+extern atomic_unchecked_t fscache_n_retrievals_nomem;
46419+extern atomic_unchecked_t fscache_n_retrievals_object_dead;
46420+extern atomic_unchecked_t fscache_n_retrieval_ops;
46421+extern atomic_unchecked_t fscache_n_retrieval_op_waits;
46422+
46423+extern atomic_unchecked_t fscache_n_stores;
46424+extern atomic_unchecked_t fscache_n_stores_ok;
46425+extern atomic_unchecked_t fscache_n_stores_again;
46426+extern atomic_unchecked_t fscache_n_stores_nobufs;
46427+extern atomic_unchecked_t fscache_n_stores_oom;
46428+extern atomic_unchecked_t fscache_n_store_ops;
46429+extern atomic_unchecked_t fscache_n_store_calls;
46430+extern atomic_unchecked_t fscache_n_store_pages;
46431+extern atomic_unchecked_t fscache_n_store_radix_deletes;
46432+extern atomic_unchecked_t fscache_n_store_pages_over_limit;
46433+
46434+extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
46435+extern atomic_unchecked_t fscache_n_store_vmscan_gone;
46436+extern atomic_unchecked_t fscache_n_store_vmscan_busy;
46437+extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
46438+
46439+extern atomic_unchecked_t fscache_n_marks;
46440+extern atomic_unchecked_t fscache_n_uncaches;
46441+
46442+extern atomic_unchecked_t fscache_n_acquires;
46443+extern atomic_unchecked_t fscache_n_acquires_null;
46444+extern atomic_unchecked_t fscache_n_acquires_no_cache;
46445+extern atomic_unchecked_t fscache_n_acquires_ok;
46446+extern atomic_unchecked_t fscache_n_acquires_nobufs;
46447+extern atomic_unchecked_t fscache_n_acquires_oom;
46448+
46449+extern atomic_unchecked_t fscache_n_updates;
46450+extern atomic_unchecked_t fscache_n_updates_null;
46451+extern atomic_unchecked_t fscache_n_updates_run;
46452+
46453+extern atomic_unchecked_t fscache_n_relinquishes;
46454+extern atomic_unchecked_t fscache_n_relinquishes_null;
46455+extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
46456+extern atomic_unchecked_t fscache_n_relinquishes_retire;
46457+
46458+extern atomic_unchecked_t fscache_n_cookie_index;
46459+extern atomic_unchecked_t fscache_n_cookie_data;
46460+extern atomic_unchecked_t fscache_n_cookie_special;
46461+
46462+extern atomic_unchecked_t fscache_n_object_alloc;
46463+extern atomic_unchecked_t fscache_n_object_no_alloc;
46464+extern atomic_unchecked_t fscache_n_object_lookups;
46465+extern atomic_unchecked_t fscache_n_object_lookups_negative;
46466+extern atomic_unchecked_t fscache_n_object_lookups_positive;
46467+extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
46468+extern atomic_unchecked_t fscache_n_object_created;
46469+extern atomic_unchecked_t fscache_n_object_avail;
46470+extern atomic_unchecked_t fscache_n_object_dead;
46471+
46472+extern atomic_unchecked_t fscache_n_checkaux_none;
46473+extern atomic_unchecked_t fscache_n_checkaux_okay;
46474+extern atomic_unchecked_t fscache_n_checkaux_update;
46475+extern atomic_unchecked_t fscache_n_checkaux_obsolete;
46476
46477 extern atomic_t fscache_n_cop_alloc_object;
46478 extern atomic_t fscache_n_cop_lookup_object;
46479@@ -255,6 +255,11 @@ static inline void fscache_stat(atomic_t
46480 atomic_inc(stat);
46481 }
46482
46483+static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
46484+{
46485+ atomic_inc_unchecked(stat);
46486+}
46487+
46488 static inline void fscache_stat_d(atomic_t *stat)
46489 {
46490 atomic_dec(stat);
46491@@ -267,6 +272,7 @@ extern const struct file_operations fsca
46492
46493 #define __fscache_stat(stat) (NULL)
46494 #define fscache_stat(stat) do {} while (0)
46495+#define fscache_stat_unchecked(stat) do {} while (0)
46496 #define fscache_stat_d(stat) do {} while (0)
46497 #endif
46498
46499diff -urNp linux-2.6.39.1/fs/fscache/object.c linux-2.6.39.1/fs/fscache/object.c
46500--- linux-2.6.39.1/fs/fscache/object.c 2011-05-19 00:06:34.000000000 -0400
46501+++ linux-2.6.39.1/fs/fscache/object.c 2011-05-22 19:36:32.000000000 -0400
46502@@ -128,7 +128,7 @@ static void fscache_object_state_machine
46503 /* update the object metadata on disk */
46504 case FSCACHE_OBJECT_UPDATING:
46505 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
46506- fscache_stat(&fscache_n_updates_run);
46507+ fscache_stat_unchecked(&fscache_n_updates_run);
46508 fscache_stat(&fscache_n_cop_update_object);
46509 object->cache->ops->update_object(object);
46510 fscache_stat_d(&fscache_n_cop_update_object);
46511@@ -217,7 +217,7 @@ static void fscache_object_state_machine
46512 spin_lock(&object->lock);
46513 object->state = FSCACHE_OBJECT_DEAD;
46514 spin_unlock(&object->lock);
46515- fscache_stat(&fscache_n_object_dead);
46516+ fscache_stat_unchecked(&fscache_n_object_dead);
46517 goto terminal_transit;
46518
46519 /* handle the parent cache of this object being withdrawn from
46520@@ -232,7 +232,7 @@ static void fscache_object_state_machine
46521 spin_lock(&object->lock);
46522 object->state = FSCACHE_OBJECT_DEAD;
46523 spin_unlock(&object->lock);
46524- fscache_stat(&fscache_n_object_dead);
46525+ fscache_stat_unchecked(&fscache_n_object_dead);
46526 goto terminal_transit;
46527
46528 /* complain about the object being woken up once it is
46529@@ -461,7 +461,7 @@ static void fscache_lookup_object(struct
46530 parent->cookie->def->name, cookie->def->name,
46531 object->cache->tag->name);
46532
46533- fscache_stat(&fscache_n_object_lookups);
46534+ fscache_stat_unchecked(&fscache_n_object_lookups);
46535 fscache_stat(&fscache_n_cop_lookup_object);
46536 ret = object->cache->ops->lookup_object(object);
46537 fscache_stat_d(&fscache_n_cop_lookup_object);
46538@@ -472,7 +472,7 @@ static void fscache_lookup_object(struct
46539 if (ret == -ETIMEDOUT) {
46540 /* probably stuck behind another object, so move this one to
46541 * the back of the queue */
46542- fscache_stat(&fscache_n_object_lookups_timed_out);
46543+ fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
46544 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
46545 }
46546
46547@@ -495,7 +495,7 @@ void fscache_object_lookup_negative(stru
46548
46549 spin_lock(&object->lock);
46550 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
46551- fscache_stat(&fscache_n_object_lookups_negative);
46552+ fscache_stat_unchecked(&fscache_n_object_lookups_negative);
46553
46554 /* transit here to allow write requests to begin stacking up
46555 * and read requests to begin returning ENODATA */
46556@@ -541,7 +541,7 @@ void fscache_obtained_object(struct fsca
46557 * result, in which case there may be data available */
46558 spin_lock(&object->lock);
46559 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
46560- fscache_stat(&fscache_n_object_lookups_positive);
46561+ fscache_stat_unchecked(&fscache_n_object_lookups_positive);
46562
46563 clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
46564
46565@@ -555,7 +555,7 @@ void fscache_obtained_object(struct fsca
46566 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
46567 } else {
46568 ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
46569- fscache_stat(&fscache_n_object_created);
46570+ fscache_stat_unchecked(&fscache_n_object_created);
46571
46572 object->state = FSCACHE_OBJECT_AVAILABLE;
46573 spin_unlock(&object->lock);
46574@@ -602,7 +602,7 @@ static void fscache_object_available(str
46575 fscache_enqueue_dependents(object);
46576
46577 fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
46578- fscache_stat(&fscache_n_object_avail);
46579+ fscache_stat_unchecked(&fscache_n_object_avail);
46580
46581 _leave("");
46582 }
46583@@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(
46584 enum fscache_checkaux result;
46585
46586 if (!object->cookie->def->check_aux) {
46587- fscache_stat(&fscache_n_checkaux_none);
46588+ fscache_stat_unchecked(&fscache_n_checkaux_none);
46589 return FSCACHE_CHECKAUX_OKAY;
46590 }
46591
46592@@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(
46593 switch (result) {
46594 /* entry okay as is */
46595 case FSCACHE_CHECKAUX_OKAY:
46596- fscache_stat(&fscache_n_checkaux_okay);
46597+ fscache_stat_unchecked(&fscache_n_checkaux_okay);
46598 break;
46599
46600 /* entry requires update */
46601 case FSCACHE_CHECKAUX_NEEDS_UPDATE:
46602- fscache_stat(&fscache_n_checkaux_update);
46603+ fscache_stat_unchecked(&fscache_n_checkaux_update);
46604 break;
46605
46606 /* entry requires deletion */
46607 case FSCACHE_CHECKAUX_OBSOLETE:
46608- fscache_stat(&fscache_n_checkaux_obsolete);
46609+ fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
46610 break;
46611
46612 default:
46613diff -urNp linux-2.6.39.1/fs/fscache/operation.c linux-2.6.39.1/fs/fscache/operation.c
46614--- linux-2.6.39.1/fs/fscache/operation.c 2011-05-19 00:06:34.000000000 -0400
46615+++ linux-2.6.39.1/fs/fscache/operation.c 2011-05-22 19:36:32.000000000 -0400
46616@@ -17,7 +17,7 @@
46617 #include <linux/slab.h>
46618 #include "internal.h"
46619
46620-atomic_t fscache_op_debug_id;
46621+atomic_unchecked_t fscache_op_debug_id;
46622 EXPORT_SYMBOL(fscache_op_debug_id);
46623
46624 /**
46625@@ -40,7 +40,7 @@ void fscache_enqueue_operation(struct fs
46626 ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
46627 ASSERTCMP(atomic_read(&op->usage), >, 0);
46628
46629- fscache_stat(&fscache_n_op_enqueue);
46630+ fscache_stat_unchecked(&fscache_n_op_enqueue);
46631 switch (op->flags & FSCACHE_OP_TYPE) {
46632 case FSCACHE_OP_ASYNC:
46633 _debug("queue async");
46634@@ -73,7 +73,7 @@ static void fscache_run_op(struct fscach
46635 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
46636 if (op->processor)
46637 fscache_enqueue_operation(op);
46638- fscache_stat(&fscache_n_op_run);
46639+ fscache_stat_unchecked(&fscache_n_op_run);
46640 }
46641
46642 /*
46643@@ -104,11 +104,11 @@ int fscache_submit_exclusive_op(struct f
46644 if (object->n_ops > 1) {
46645 atomic_inc(&op->usage);
46646 list_add_tail(&op->pend_link, &object->pending_ops);
46647- fscache_stat(&fscache_n_op_pend);
46648+ fscache_stat_unchecked(&fscache_n_op_pend);
46649 } else if (!list_empty(&object->pending_ops)) {
46650 atomic_inc(&op->usage);
46651 list_add_tail(&op->pend_link, &object->pending_ops);
46652- fscache_stat(&fscache_n_op_pend);
46653+ fscache_stat_unchecked(&fscache_n_op_pend);
46654 fscache_start_operations(object);
46655 } else {
46656 ASSERTCMP(object->n_in_progress, ==, 0);
46657@@ -124,7 +124,7 @@ int fscache_submit_exclusive_op(struct f
46658 object->n_exclusive++; /* reads and writes must wait */
46659 atomic_inc(&op->usage);
46660 list_add_tail(&op->pend_link, &object->pending_ops);
46661- fscache_stat(&fscache_n_op_pend);
46662+ fscache_stat_unchecked(&fscache_n_op_pend);
46663 ret = 0;
46664 } else {
46665 /* not allowed to submit ops in any other state */
46666@@ -211,11 +211,11 @@ int fscache_submit_op(struct fscache_obj
46667 if (object->n_exclusive > 0) {
46668 atomic_inc(&op->usage);
46669 list_add_tail(&op->pend_link, &object->pending_ops);
46670- fscache_stat(&fscache_n_op_pend);
46671+ fscache_stat_unchecked(&fscache_n_op_pend);
46672 } else if (!list_empty(&object->pending_ops)) {
46673 atomic_inc(&op->usage);
46674 list_add_tail(&op->pend_link, &object->pending_ops);
46675- fscache_stat(&fscache_n_op_pend);
46676+ fscache_stat_unchecked(&fscache_n_op_pend);
46677 fscache_start_operations(object);
46678 } else {
46679 ASSERTCMP(object->n_exclusive, ==, 0);
46680@@ -227,12 +227,12 @@ int fscache_submit_op(struct fscache_obj
46681 object->n_ops++;
46682 atomic_inc(&op->usage);
46683 list_add_tail(&op->pend_link, &object->pending_ops);
46684- fscache_stat(&fscache_n_op_pend);
46685+ fscache_stat_unchecked(&fscache_n_op_pend);
46686 ret = 0;
46687 } else if (object->state == FSCACHE_OBJECT_DYING ||
46688 object->state == FSCACHE_OBJECT_LC_DYING ||
46689 object->state == FSCACHE_OBJECT_WITHDRAWING) {
46690- fscache_stat(&fscache_n_op_rejected);
46691+ fscache_stat_unchecked(&fscache_n_op_rejected);
46692 ret = -ENOBUFS;
46693 } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
46694 fscache_report_unexpected_submission(object, op, ostate);
46695@@ -302,7 +302,7 @@ int fscache_cancel_op(struct fscache_ope
46696
46697 ret = -EBUSY;
46698 if (!list_empty(&op->pend_link)) {
46699- fscache_stat(&fscache_n_op_cancelled);
46700+ fscache_stat_unchecked(&fscache_n_op_cancelled);
46701 list_del_init(&op->pend_link);
46702 object->n_ops--;
46703 if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
46704@@ -341,7 +341,7 @@ void fscache_put_operation(struct fscach
46705 if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
46706 BUG();
46707
46708- fscache_stat(&fscache_n_op_release);
46709+ fscache_stat_unchecked(&fscache_n_op_release);
46710
46711 if (op->release) {
46712 op->release(op);
46713@@ -358,7 +358,7 @@ void fscache_put_operation(struct fscach
46714 * lock, and defer it otherwise */
46715 if (!spin_trylock(&object->lock)) {
46716 _debug("defer put");
46717- fscache_stat(&fscache_n_op_deferred_release);
46718+ fscache_stat_unchecked(&fscache_n_op_deferred_release);
46719
46720 cache = object->cache;
46721 spin_lock(&cache->op_gc_list_lock);
46722@@ -420,7 +420,7 @@ void fscache_operation_gc(struct work_st
46723
46724 _debug("GC DEFERRED REL OBJ%x OP%x",
46725 object->debug_id, op->debug_id);
46726- fscache_stat(&fscache_n_op_gc);
46727+ fscache_stat_unchecked(&fscache_n_op_gc);
46728
46729 ASSERTCMP(atomic_read(&op->usage), ==, 0);
46730
46731diff -urNp linux-2.6.39.1/fs/fscache/page.c linux-2.6.39.1/fs/fscache/page.c
46732--- linux-2.6.39.1/fs/fscache/page.c 2011-05-19 00:06:34.000000000 -0400
46733+++ linux-2.6.39.1/fs/fscache/page.c 2011-05-22 19:36:32.000000000 -0400
46734@@ -60,7 +60,7 @@ bool __fscache_maybe_release_page(struct
46735 val = radix_tree_lookup(&cookie->stores, page->index);
46736 if (!val) {
46737 rcu_read_unlock();
46738- fscache_stat(&fscache_n_store_vmscan_not_storing);
46739+ fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
46740 __fscache_uncache_page(cookie, page);
46741 return true;
46742 }
46743@@ -90,11 +90,11 @@ bool __fscache_maybe_release_page(struct
46744 spin_unlock(&cookie->stores_lock);
46745
46746 if (xpage) {
46747- fscache_stat(&fscache_n_store_vmscan_cancelled);
46748- fscache_stat(&fscache_n_store_radix_deletes);
46749+ fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
46750+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
46751 ASSERTCMP(xpage, ==, page);
46752 } else {
46753- fscache_stat(&fscache_n_store_vmscan_gone);
46754+ fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
46755 }
46756
46757 wake_up_bit(&cookie->flags, 0);
46758@@ -107,7 +107,7 @@ page_busy:
46759 /* we might want to wait here, but that could deadlock the allocator as
46760 * the work threads writing to the cache may all end up sleeping
46761 * on memory allocation */
46762- fscache_stat(&fscache_n_store_vmscan_busy);
46763+ fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
46764 return false;
46765 }
46766 EXPORT_SYMBOL(__fscache_maybe_release_page);
46767@@ -131,7 +131,7 @@ static void fscache_end_page_write(struc
46768 FSCACHE_COOKIE_STORING_TAG);
46769 if (!radix_tree_tag_get(&cookie->stores, page->index,
46770 FSCACHE_COOKIE_PENDING_TAG)) {
46771- fscache_stat(&fscache_n_store_radix_deletes);
46772+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
46773 xpage = radix_tree_delete(&cookie->stores, page->index);
46774 }
46775 spin_unlock(&cookie->stores_lock);
46776@@ -152,7 +152,7 @@ static void fscache_attr_changed_op(stru
46777
46778 _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
46779
46780- fscache_stat(&fscache_n_attr_changed_calls);
46781+ fscache_stat_unchecked(&fscache_n_attr_changed_calls);
46782
46783 if (fscache_object_is_active(object)) {
46784 fscache_set_op_state(op, "CallFS");
46785@@ -179,11 +179,11 @@ int __fscache_attr_changed(struct fscach
46786
46787 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
46788
46789- fscache_stat(&fscache_n_attr_changed);
46790+ fscache_stat_unchecked(&fscache_n_attr_changed);
46791
46792 op = kzalloc(sizeof(*op), GFP_KERNEL);
46793 if (!op) {
46794- fscache_stat(&fscache_n_attr_changed_nomem);
46795+ fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
46796 _leave(" = -ENOMEM");
46797 return -ENOMEM;
46798 }
46799@@ -202,7 +202,7 @@ int __fscache_attr_changed(struct fscach
46800 if (fscache_submit_exclusive_op(object, op) < 0)
46801 goto nobufs;
46802 spin_unlock(&cookie->lock);
46803- fscache_stat(&fscache_n_attr_changed_ok);
46804+ fscache_stat_unchecked(&fscache_n_attr_changed_ok);
46805 fscache_put_operation(op);
46806 _leave(" = 0");
46807 return 0;
46808@@ -210,7 +210,7 @@ int __fscache_attr_changed(struct fscach
46809 nobufs:
46810 spin_unlock(&cookie->lock);
46811 kfree(op);
46812- fscache_stat(&fscache_n_attr_changed_nobufs);
46813+ fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
46814 _leave(" = %d", -ENOBUFS);
46815 return -ENOBUFS;
46816 }
46817@@ -246,7 +246,7 @@ static struct fscache_retrieval *fscache
46818 /* allocate a retrieval operation and attempt to submit it */
46819 op = kzalloc(sizeof(*op), GFP_NOIO);
46820 if (!op) {
46821- fscache_stat(&fscache_n_retrievals_nomem);
46822+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46823 return NULL;
46824 }
46825
46826@@ -275,13 +275,13 @@ static int fscache_wait_for_deferred_loo
46827 return 0;
46828 }
46829
46830- fscache_stat(&fscache_n_retrievals_wait);
46831+ fscache_stat_unchecked(&fscache_n_retrievals_wait);
46832
46833 jif = jiffies;
46834 if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
46835 fscache_wait_bit_interruptible,
46836 TASK_INTERRUPTIBLE) != 0) {
46837- fscache_stat(&fscache_n_retrievals_intr);
46838+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
46839 _leave(" = -ERESTARTSYS");
46840 return -ERESTARTSYS;
46841 }
46842@@ -299,8 +299,8 @@ static int fscache_wait_for_deferred_loo
46843 */
46844 static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
46845 struct fscache_retrieval *op,
46846- atomic_t *stat_op_waits,
46847- atomic_t *stat_object_dead)
46848+ atomic_unchecked_t *stat_op_waits,
46849+ atomic_unchecked_t *stat_object_dead)
46850 {
46851 int ret;
46852
46853@@ -308,7 +308,7 @@ static int fscache_wait_for_retrieval_ac
46854 goto check_if_dead;
46855
46856 _debug(">>> WT");
46857- fscache_stat(stat_op_waits);
46858+ fscache_stat_unchecked(stat_op_waits);
46859 if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
46860 fscache_wait_bit_interruptible,
46861 TASK_INTERRUPTIBLE) < 0) {
46862@@ -325,7 +325,7 @@ static int fscache_wait_for_retrieval_ac
46863
46864 check_if_dead:
46865 if (unlikely(fscache_object_is_dead(object))) {
46866- fscache_stat(stat_object_dead);
46867+ fscache_stat_unchecked(stat_object_dead);
46868 return -ENOBUFS;
46869 }
46870 return 0;
46871@@ -352,7 +352,7 @@ int __fscache_read_or_alloc_page(struct
46872
46873 _enter("%p,%p,,,", cookie, page);
46874
46875- fscache_stat(&fscache_n_retrievals);
46876+ fscache_stat_unchecked(&fscache_n_retrievals);
46877
46878 if (hlist_empty(&cookie->backing_objects))
46879 goto nobufs;
46880@@ -386,7 +386,7 @@ int __fscache_read_or_alloc_page(struct
46881 goto nobufs_unlock;
46882 spin_unlock(&cookie->lock);
46883
46884- fscache_stat(&fscache_n_retrieval_ops);
46885+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
46886
46887 /* pin the netfs read context in case we need to do the actual netfs
46888 * read because we've encountered a cache read failure */
46889@@ -416,15 +416,15 @@ int __fscache_read_or_alloc_page(struct
46890
46891 error:
46892 if (ret == -ENOMEM)
46893- fscache_stat(&fscache_n_retrievals_nomem);
46894+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46895 else if (ret == -ERESTARTSYS)
46896- fscache_stat(&fscache_n_retrievals_intr);
46897+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
46898 else if (ret == -ENODATA)
46899- fscache_stat(&fscache_n_retrievals_nodata);
46900+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
46901 else if (ret < 0)
46902- fscache_stat(&fscache_n_retrievals_nobufs);
46903+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46904 else
46905- fscache_stat(&fscache_n_retrievals_ok);
46906+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
46907
46908 fscache_put_retrieval(op);
46909 _leave(" = %d", ret);
46910@@ -434,7 +434,7 @@ nobufs_unlock:
46911 spin_unlock(&cookie->lock);
46912 kfree(op);
46913 nobufs:
46914- fscache_stat(&fscache_n_retrievals_nobufs);
46915+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46916 _leave(" = -ENOBUFS");
46917 return -ENOBUFS;
46918 }
46919@@ -472,7 +472,7 @@ int __fscache_read_or_alloc_pages(struct
46920
46921 _enter("%p,,%d,,,", cookie, *nr_pages);
46922
46923- fscache_stat(&fscache_n_retrievals);
46924+ fscache_stat_unchecked(&fscache_n_retrievals);
46925
46926 if (hlist_empty(&cookie->backing_objects))
46927 goto nobufs;
46928@@ -503,7 +503,7 @@ int __fscache_read_or_alloc_pages(struct
46929 goto nobufs_unlock;
46930 spin_unlock(&cookie->lock);
46931
46932- fscache_stat(&fscache_n_retrieval_ops);
46933+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
46934
46935 /* pin the netfs read context in case we need to do the actual netfs
46936 * read because we've encountered a cache read failure */
46937@@ -533,15 +533,15 @@ int __fscache_read_or_alloc_pages(struct
46938
46939 error:
46940 if (ret == -ENOMEM)
46941- fscache_stat(&fscache_n_retrievals_nomem);
46942+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46943 else if (ret == -ERESTARTSYS)
46944- fscache_stat(&fscache_n_retrievals_intr);
46945+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
46946 else if (ret == -ENODATA)
46947- fscache_stat(&fscache_n_retrievals_nodata);
46948+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
46949 else if (ret < 0)
46950- fscache_stat(&fscache_n_retrievals_nobufs);
46951+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46952 else
46953- fscache_stat(&fscache_n_retrievals_ok);
46954+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
46955
46956 fscache_put_retrieval(op);
46957 _leave(" = %d", ret);
46958@@ -551,7 +551,7 @@ nobufs_unlock:
46959 spin_unlock(&cookie->lock);
46960 kfree(op);
46961 nobufs:
46962- fscache_stat(&fscache_n_retrievals_nobufs);
46963+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46964 _leave(" = -ENOBUFS");
46965 return -ENOBUFS;
46966 }
46967@@ -575,7 +575,7 @@ int __fscache_alloc_page(struct fscache_
46968
46969 _enter("%p,%p,,,", cookie, page);
46970
46971- fscache_stat(&fscache_n_allocs);
46972+ fscache_stat_unchecked(&fscache_n_allocs);
46973
46974 if (hlist_empty(&cookie->backing_objects))
46975 goto nobufs;
46976@@ -602,7 +602,7 @@ int __fscache_alloc_page(struct fscache_
46977 goto nobufs_unlock;
46978 spin_unlock(&cookie->lock);
46979
46980- fscache_stat(&fscache_n_alloc_ops);
46981+ fscache_stat_unchecked(&fscache_n_alloc_ops);
46982
46983 ret = fscache_wait_for_retrieval_activation(
46984 object, op,
46985@@ -618,11 +618,11 @@ int __fscache_alloc_page(struct fscache_
46986
46987 error:
46988 if (ret == -ERESTARTSYS)
46989- fscache_stat(&fscache_n_allocs_intr);
46990+ fscache_stat_unchecked(&fscache_n_allocs_intr);
46991 else if (ret < 0)
46992- fscache_stat(&fscache_n_allocs_nobufs);
46993+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
46994 else
46995- fscache_stat(&fscache_n_allocs_ok);
46996+ fscache_stat_unchecked(&fscache_n_allocs_ok);
46997
46998 fscache_put_retrieval(op);
46999 _leave(" = %d", ret);
47000@@ -632,7 +632,7 @@ nobufs_unlock:
47001 spin_unlock(&cookie->lock);
47002 kfree(op);
47003 nobufs:
47004- fscache_stat(&fscache_n_allocs_nobufs);
47005+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
47006 _leave(" = -ENOBUFS");
47007 return -ENOBUFS;
47008 }
47009@@ -675,7 +675,7 @@ static void fscache_write_op(struct fsca
47010
47011 spin_lock(&cookie->stores_lock);
47012
47013- fscache_stat(&fscache_n_store_calls);
47014+ fscache_stat_unchecked(&fscache_n_store_calls);
47015
47016 /* find a page to store */
47017 page = NULL;
47018@@ -686,7 +686,7 @@ static void fscache_write_op(struct fsca
47019 page = results[0];
47020 _debug("gang %d [%lx]", n, page->index);
47021 if (page->index > op->store_limit) {
47022- fscache_stat(&fscache_n_store_pages_over_limit);
47023+ fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
47024 goto superseded;
47025 }
47026
47027@@ -699,7 +699,7 @@ static void fscache_write_op(struct fsca
47028 spin_unlock(&object->lock);
47029
47030 fscache_set_op_state(&op->op, "Store");
47031- fscache_stat(&fscache_n_store_pages);
47032+ fscache_stat_unchecked(&fscache_n_store_pages);
47033 fscache_stat(&fscache_n_cop_write_page);
47034 ret = object->cache->ops->write_page(op, page);
47035 fscache_stat_d(&fscache_n_cop_write_page);
47036@@ -769,7 +769,7 @@ int __fscache_write_page(struct fscache_
47037 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
47038 ASSERT(PageFsCache(page));
47039
47040- fscache_stat(&fscache_n_stores);
47041+ fscache_stat_unchecked(&fscache_n_stores);
47042
47043 op = kzalloc(sizeof(*op), GFP_NOIO);
47044 if (!op)
47045@@ -821,7 +821,7 @@ int __fscache_write_page(struct fscache_
47046 spin_unlock(&cookie->stores_lock);
47047 spin_unlock(&object->lock);
47048
47049- op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
47050+ op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
47051 op->store_limit = object->store_limit;
47052
47053 if (fscache_submit_op(object, &op->op) < 0)
47054@@ -829,8 +829,8 @@ int __fscache_write_page(struct fscache_
47055
47056 spin_unlock(&cookie->lock);
47057 radix_tree_preload_end();
47058- fscache_stat(&fscache_n_store_ops);
47059- fscache_stat(&fscache_n_stores_ok);
47060+ fscache_stat_unchecked(&fscache_n_store_ops);
47061+ fscache_stat_unchecked(&fscache_n_stores_ok);
47062
47063 /* the work queue now carries its own ref on the object */
47064 fscache_put_operation(&op->op);
47065@@ -838,14 +838,14 @@ int __fscache_write_page(struct fscache_
47066 return 0;
47067
47068 already_queued:
47069- fscache_stat(&fscache_n_stores_again);
47070+ fscache_stat_unchecked(&fscache_n_stores_again);
47071 already_pending:
47072 spin_unlock(&cookie->stores_lock);
47073 spin_unlock(&object->lock);
47074 spin_unlock(&cookie->lock);
47075 radix_tree_preload_end();
47076 kfree(op);
47077- fscache_stat(&fscache_n_stores_ok);
47078+ fscache_stat_unchecked(&fscache_n_stores_ok);
47079 _leave(" = 0");
47080 return 0;
47081
47082@@ -864,14 +864,14 @@ nobufs:
47083 spin_unlock(&cookie->lock);
47084 radix_tree_preload_end();
47085 kfree(op);
47086- fscache_stat(&fscache_n_stores_nobufs);
47087+ fscache_stat_unchecked(&fscache_n_stores_nobufs);
47088 _leave(" = -ENOBUFS");
47089 return -ENOBUFS;
47090
47091 nomem_free:
47092 kfree(op);
47093 nomem:
47094- fscache_stat(&fscache_n_stores_oom);
47095+ fscache_stat_unchecked(&fscache_n_stores_oom);
47096 _leave(" = -ENOMEM");
47097 return -ENOMEM;
47098 }
47099@@ -889,7 +889,7 @@ void __fscache_uncache_page(struct fscac
47100 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
47101 ASSERTCMP(page, !=, NULL);
47102
47103- fscache_stat(&fscache_n_uncaches);
47104+ fscache_stat_unchecked(&fscache_n_uncaches);
47105
47106 /* cache withdrawal may beat us to it */
47107 if (!PageFsCache(page))
47108@@ -942,7 +942,7 @@ void fscache_mark_pages_cached(struct fs
47109 unsigned long loop;
47110
47111 #ifdef CONFIG_FSCACHE_STATS
47112- atomic_add(pagevec->nr, &fscache_n_marks);
47113+ atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
47114 #endif
47115
47116 for (loop = 0; loop < pagevec->nr; loop++) {
47117diff -urNp linux-2.6.39.1/fs/fscache/stats.c linux-2.6.39.1/fs/fscache/stats.c
47118--- linux-2.6.39.1/fs/fscache/stats.c 2011-05-19 00:06:34.000000000 -0400
47119+++ linux-2.6.39.1/fs/fscache/stats.c 2011-05-22 19:36:32.000000000 -0400
47120@@ -18,95 +18,95 @@
47121 /*
47122 * operation counters
47123 */
47124-atomic_t fscache_n_op_pend;
47125-atomic_t fscache_n_op_run;
47126-atomic_t fscache_n_op_enqueue;
47127-atomic_t fscache_n_op_requeue;
47128-atomic_t fscache_n_op_deferred_release;
47129-atomic_t fscache_n_op_release;
47130-atomic_t fscache_n_op_gc;
47131-atomic_t fscache_n_op_cancelled;
47132-atomic_t fscache_n_op_rejected;
47133-
47134-atomic_t fscache_n_attr_changed;
47135-atomic_t fscache_n_attr_changed_ok;
47136-atomic_t fscache_n_attr_changed_nobufs;
47137-atomic_t fscache_n_attr_changed_nomem;
47138-atomic_t fscache_n_attr_changed_calls;
47139-
47140-atomic_t fscache_n_allocs;
47141-atomic_t fscache_n_allocs_ok;
47142-atomic_t fscache_n_allocs_wait;
47143-atomic_t fscache_n_allocs_nobufs;
47144-atomic_t fscache_n_allocs_intr;
47145-atomic_t fscache_n_allocs_object_dead;
47146-atomic_t fscache_n_alloc_ops;
47147-atomic_t fscache_n_alloc_op_waits;
47148-
47149-atomic_t fscache_n_retrievals;
47150-atomic_t fscache_n_retrievals_ok;
47151-atomic_t fscache_n_retrievals_wait;
47152-atomic_t fscache_n_retrievals_nodata;
47153-atomic_t fscache_n_retrievals_nobufs;
47154-atomic_t fscache_n_retrievals_intr;
47155-atomic_t fscache_n_retrievals_nomem;
47156-atomic_t fscache_n_retrievals_object_dead;
47157-atomic_t fscache_n_retrieval_ops;
47158-atomic_t fscache_n_retrieval_op_waits;
47159-
47160-atomic_t fscache_n_stores;
47161-atomic_t fscache_n_stores_ok;
47162-atomic_t fscache_n_stores_again;
47163-atomic_t fscache_n_stores_nobufs;
47164-atomic_t fscache_n_stores_oom;
47165-atomic_t fscache_n_store_ops;
47166-atomic_t fscache_n_store_calls;
47167-atomic_t fscache_n_store_pages;
47168-atomic_t fscache_n_store_radix_deletes;
47169-atomic_t fscache_n_store_pages_over_limit;
47170-
47171-atomic_t fscache_n_store_vmscan_not_storing;
47172-atomic_t fscache_n_store_vmscan_gone;
47173-atomic_t fscache_n_store_vmscan_busy;
47174-atomic_t fscache_n_store_vmscan_cancelled;
47175-
47176-atomic_t fscache_n_marks;
47177-atomic_t fscache_n_uncaches;
47178-
47179-atomic_t fscache_n_acquires;
47180-atomic_t fscache_n_acquires_null;
47181-atomic_t fscache_n_acquires_no_cache;
47182-atomic_t fscache_n_acquires_ok;
47183-atomic_t fscache_n_acquires_nobufs;
47184-atomic_t fscache_n_acquires_oom;
47185-
47186-atomic_t fscache_n_updates;
47187-atomic_t fscache_n_updates_null;
47188-atomic_t fscache_n_updates_run;
47189-
47190-atomic_t fscache_n_relinquishes;
47191-atomic_t fscache_n_relinquishes_null;
47192-atomic_t fscache_n_relinquishes_waitcrt;
47193-atomic_t fscache_n_relinquishes_retire;
47194-
47195-atomic_t fscache_n_cookie_index;
47196-atomic_t fscache_n_cookie_data;
47197-atomic_t fscache_n_cookie_special;
47198-
47199-atomic_t fscache_n_object_alloc;
47200-atomic_t fscache_n_object_no_alloc;
47201-atomic_t fscache_n_object_lookups;
47202-atomic_t fscache_n_object_lookups_negative;
47203-atomic_t fscache_n_object_lookups_positive;
47204-atomic_t fscache_n_object_lookups_timed_out;
47205-atomic_t fscache_n_object_created;
47206-atomic_t fscache_n_object_avail;
47207-atomic_t fscache_n_object_dead;
47208-
47209-atomic_t fscache_n_checkaux_none;
47210-atomic_t fscache_n_checkaux_okay;
47211-atomic_t fscache_n_checkaux_update;
47212-atomic_t fscache_n_checkaux_obsolete;
47213+atomic_unchecked_t fscache_n_op_pend;
47214+atomic_unchecked_t fscache_n_op_run;
47215+atomic_unchecked_t fscache_n_op_enqueue;
47216+atomic_unchecked_t fscache_n_op_requeue;
47217+atomic_unchecked_t fscache_n_op_deferred_release;
47218+atomic_unchecked_t fscache_n_op_release;
47219+atomic_unchecked_t fscache_n_op_gc;
47220+atomic_unchecked_t fscache_n_op_cancelled;
47221+atomic_unchecked_t fscache_n_op_rejected;
47222+
47223+atomic_unchecked_t fscache_n_attr_changed;
47224+atomic_unchecked_t fscache_n_attr_changed_ok;
47225+atomic_unchecked_t fscache_n_attr_changed_nobufs;
47226+atomic_unchecked_t fscache_n_attr_changed_nomem;
47227+atomic_unchecked_t fscache_n_attr_changed_calls;
47228+
47229+atomic_unchecked_t fscache_n_allocs;
47230+atomic_unchecked_t fscache_n_allocs_ok;
47231+atomic_unchecked_t fscache_n_allocs_wait;
47232+atomic_unchecked_t fscache_n_allocs_nobufs;
47233+atomic_unchecked_t fscache_n_allocs_intr;
47234+atomic_unchecked_t fscache_n_allocs_object_dead;
47235+atomic_unchecked_t fscache_n_alloc_ops;
47236+atomic_unchecked_t fscache_n_alloc_op_waits;
47237+
47238+atomic_unchecked_t fscache_n_retrievals;
47239+atomic_unchecked_t fscache_n_retrievals_ok;
47240+atomic_unchecked_t fscache_n_retrievals_wait;
47241+atomic_unchecked_t fscache_n_retrievals_nodata;
47242+atomic_unchecked_t fscache_n_retrievals_nobufs;
47243+atomic_unchecked_t fscache_n_retrievals_intr;
47244+atomic_unchecked_t fscache_n_retrievals_nomem;
47245+atomic_unchecked_t fscache_n_retrievals_object_dead;
47246+atomic_unchecked_t fscache_n_retrieval_ops;
47247+atomic_unchecked_t fscache_n_retrieval_op_waits;
47248+
47249+atomic_unchecked_t fscache_n_stores;
47250+atomic_unchecked_t fscache_n_stores_ok;
47251+atomic_unchecked_t fscache_n_stores_again;
47252+atomic_unchecked_t fscache_n_stores_nobufs;
47253+atomic_unchecked_t fscache_n_stores_oom;
47254+atomic_unchecked_t fscache_n_store_ops;
47255+atomic_unchecked_t fscache_n_store_calls;
47256+atomic_unchecked_t fscache_n_store_pages;
47257+atomic_unchecked_t fscache_n_store_radix_deletes;
47258+atomic_unchecked_t fscache_n_store_pages_over_limit;
47259+
47260+atomic_unchecked_t fscache_n_store_vmscan_not_storing;
47261+atomic_unchecked_t fscache_n_store_vmscan_gone;
47262+atomic_unchecked_t fscache_n_store_vmscan_busy;
47263+atomic_unchecked_t fscache_n_store_vmscan_cancelled;
47264+
47265+atomic_unchecked_t fscache_n_marks;
47266+atomic_unchecked_t fscache_n_uncaches;
47267+
47268+atomic_unchecked_t fscache_n_acquires;
47269+atomic_unchecked_t fscache_n_acquires_null;
47270+atomic_unchecked_t fscache_n_acquires_no_cache;
47271+atomic_unchecked_t fscache_n_acquires_ok;
47272+atomic_unchecked_t fscache_n_acquires_nobufs;
47273+atomic_unchecked_t fscache_n_acquires_oom;
47274+
47275+atomic_unchecked_t fscache_n_updates;
47276+atomic_unchecked_t fscache_n_updates_null;
47277+atomic_unchecked_t fscache_n_updates_run;
47278+
47279+atomic_unchecked_t fscache_n_relinquishes;
47280+atomic_unchecked_t fscache_n_relinquishes_null;
47281+atomic_unchecked_t fscache_n_relinquishes_waitcrt;
47282+atomic_unchecked_t fscache_n_relinquishes_retire;
47283+
47284+atomic_unchecked_t fscache_n_cookie_index;
47285+atomic_unchecked_t fscache_n_cookie_data;
47286+atomic_unchecked_t fscache_n_cookie_special;
47287+
47288+atomic_unchecked_t fscache_n_object_alloc;
47289+atomic_unchecked_t fscache_n_object_no_alloc;
47290+atomic_unchecked_t fscache_n_object_lookups;
47291+atomic_unchecked_t fscache_n_object_lookups_negative;
47292+atomic_unchecked_t fscache_n_object_lookups_positive;
47293+atomic_unchecked_t fscache_n_object_lookups_timed_out;
47294+atomic_unchecked_t fscache_n_object_created;
47295+atomic_unchecked_t fscache_n_object_avail;
47296+atomic_unchecked_t fscache_n_object_dead;
47297+
47298+atomic_unchecked_t fscache_n_checkaux_none;
47299+atomic_unchecked_t fscache_n_checkaux_okay;
47300+atomic_unchecked_t fscache_n_checkaux_update;
47301+atomic_unchecked_t fscache_n_checkaux_obsolete;
47302
47303 atomic_t fscache_n_cop_alloc_object;
47304 atomic_t fscache_n_cop_lookup_object;
47305@@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq
47306 seq_puts(m, "FS-Cache statistics\n");
47307
47308 seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
47309- atomic_read(&fscache_n_cookie_index),
47310- atomic_read(&fscache_n_cookie_data),
47311- atomic_read(&fscache_n_cookie_special));
47312+ atomic_read_unchecked(&fscache_n_cookie_index),
47313+ atomic_read_unchecked(&fscache_n_cookie_data),
47314+ atomic_read_unchecked(&fscache_n_cookie_special));
47315
47316 seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
47317- atomic_read(&fscache_n_object_alloc),
47318- atomic_read(&fscache_n_object_no_alloc),
47319- atomic_read(&fscache_n_object_avail),
47320- atomic_read(&fscache_n_object_dead));
47321+ atomic_read_unchecked(&fscache_n_object_alloc),
47322+ atomic_read_unchecked(&fscache_n_object_no_alloc),
47323+ atomic_read_unchecked(&fscache_n_object_avail),
47324+ atomic_read_unchecked(&fscache_n_object_dead));
47325 seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
47326- atomic_read(&fscache_n_checkaux_none),
47327- atomic_read(&fscache_n_checkaux_okay),
47328- atomic_read(&fscache_n_checkaux_update),
47329- atomic_read(&fscache_n_checkaux_obsolete));
47330+ atomic_read_unchecked(&fscache_n_checkaux_none),
47331+ atomic_read_unchecked(&fscache_n_checkaux_okay),
47332+ atomic_read_unchecked(&fscache_n_checkaux_update),
47333+ atomic_read_unchecked(&fscache_n_checkaux_obsolete));
47334
47335 seq_printf(m, "Pages : mrk=%u unc=%u\n",
47336- atomic_read(&fscache_n_marks),
47337- atomic_read(&fscache_n_uncaches));
47338+ atomic_read_unchecked(&fscache_n_marks),
47339+ atomic_read_unchecked(&fscache_n_uncaches));
47340
47341 seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
47342 " oom=%u\n",
47343- atomic_read(&fscache_n_acquires),
47344- atomic_read(&fscache_n_acquires_null),
47345- atomic_read(&fscache_n_acquires_no_cache),
47346- atomic_read(&fscache_n_acquires_ok),
47347- atomic_read(&fscache_n_acquires_nobufs),
47348- atomic_read(&fscache_n_acquires_oom));
47349+ atomic_read_unchecked(&fscache_n_acquires),
47350+ atomic_read_unchecked(&fscache_n_acquires_null),
47351+ atomic_read_unchecked(&fscache_n_acquires_no_cache),
47352+ atomic_read_unchecked(&fscache_n_acquires_ok),
47353+ atomic_read_unchecked(&fscache_n_acquires_nobufs),
47354+ atomic_read_unchecked(&fscache_n_acquires_oom));
47355
47356 seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
47357- atomic_read(&fscache_n_object_lookups),
47358- atomic_read(&fscache_n_object_lookups_negative),
47359- atomic_read(&fscache_n_object_lookups_positive),
47360- atomic_read(&fscache_n_object_created),
47361- atomic_read(&fscache_n_object_lookups_timed_out));
47362+ atomic_read_unchecked(&fscache_n_object_lookups),
47363+ atomic_read_unchecked(&fscache_n_object_lookups_negative),
47364+ atomic_read_unchecked(&fscache_n_object_lookups_positive),
47365+ atomic_read_unchecked(&fscache_n_object_created),
47366+ atomic_read_unchecked(&fscache_n_object_lookups_timed_out));
47367
47368 seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
47369- atomic_read(&fscache_n_updates),
47370- atomic_read(&fscache_n_updates_null),
47371- atomic_read(&fscache_n_updates_run));
47372+ atomic_read_unchecked(&fscache_n_updates),
47373+ atomic_read_unchecked(&fscache_n_updates_null),
47374+ atomic_read_unchecked(&fscache_n_updates_run));
47375
47376 seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
47377- atomic_read(&fscache_n_relinquishes),
47378- atomic_read(&fscache_n_relinquishes_null),
47379- atomic_read(&fscache_n_relinquishes_waitcrt),
47380- atomic_read(&fscache_n_relinquishes_retire));
47381+ atomic_read_unchecked(&fscache_n_relinquishes),
47382+ atomic_read_unchecked(&fscache_n_relinquishes_null),
47383+ atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
47384+ atomic_read_unchecked(&fscache_n_relinquishes_retire));
47385
47386 seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
47387- atomic_read(&fscache_n_attr_changed),
47388- atomic_read(&fscache_n_attr_changed_ok),
47389- atomic_read(&fscache_n_attr_changed_nobufs),
47390- atomic_read(&fscache_n_attr_changed_nomem),
47391- atomic_read(&fscache_n_attr_changed_calls));
47392+ atomic_read_unchecked(&fscache_n_attr_changed),
47393+ atomic_read_unchecked(&fscache_n_attr_changed_ok),
47394+ atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
47395+ atomic_read_unchecked(&fscache_n_attr_changed_nomem),
47396+ atomic_read_unchecked(&fscache_n_attr_changed_calls));
47397
47398 seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
47399- atomic_read(&fscache_n_allocs),
47400- atomic_read(&fscache_n_allocs_ok),
47401- atomic_read(&fscache_n_allocs_wait),
47402- atomic_read(&fscache_n_allocs_nobufs),
47403- atomic_read(&fscache_n_allocs_intr));
47404+ atomic_read_unchecked(&fscache_n_allocs),
47405+ atomic_read_unchecked(&fscache_n_allocs_ok),
47406+ atomic_read_unchecked(&fscache_n_allocs_wait),
47407+ atomic_read_unchecked(&fscache_n_allocs_nobufs),
47408+ atomic_read_unchecked(&fscache_n_allocs_intr));
47409 seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
47410- atomic_read(&fscache_n_alloc_ops),
47411- atomic_read(&fscache_n_alloc_op_waits),
47412- atomic_read(&fscache_n_allocs_object_dead));
47413+ atomic_read_unchecked(&fscache_n_alloc_ops),
47414+ atomic_read_unchecked(&fscache_n_alloc_op_waits),
47415+ atomic_read_unchecked(&fscache_n_allocs_object_dead));
47416
47417 seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
47418 " int=%u oom=%u\n",
47419- atomic_read(&fscache_n_retrievals),
47420- atomic_read(&fscache_n_retrievals_ok),
47421- atomic_read(&fscache_n_retrievals_wait),
47422- atomic_read(&fscache_n_retrievals_nodata),
47423- atomic_read(&fscache_n_retrievals_nobufs),
47424- atomic_read(&fscache_n_retrievals_intr),
47425- atomic_read(&fscache_n_retrievals_nomem));
47426+ atomic_read_unchecked(&fscache_n_retrievals),
47427+ atomic_read_unchecked(&fscache_n_retrievals_ok),
47428+ atomic_read_unchecked(&fscache_n_retrievals_wait),
47429+ atomic_read_unchecked(&fscache_n_retrievals_nodata),
47430+ atomic_read_unchecked(&fscache_n_retrievals_nobufs),
47431+ atomic_read_unchecked(&fscache_n_retrievals_intr),
47432+ atomic_read_unchecked(&fscache_n_retrievals_nomem));
47433 seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
47434- atomic_read(&fscache_n_retrieval_ops),
47435- atomic_read(&fscache_n_retrieval_op_waits),
47436- atomic_read(&fscache_n_retrievals_object_dead));
47437+ atomic_read_unchecked(&fscache_n_retrieval_ops),
47438+ atomic_read_unchecked(&fscache_n_retrieval_op_waits),
47439+ atomic_read_unchecked(&fscache_n_retrievals_object_dead));
47440
47441 seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
47442- atomic_read(&fscache_n_stores),
47443- atomic_read(&fscache_n_stores_ok),
47444- atomic_read(&fscache_n_stores_again),
47445- atomic_read(&fscache_n_stores_nobufs),
47446- atomic_read(&fscache_n_stores_oom));
47447+ atomic_read_unchecked(&fscache_n_stores),
47448+ atomic_read_unchecked(&fscache_n_stores_ok),
47449+ atomic_read_unchecked(&fscache_n_stores_again),
47450+ atomic_read_unchecked(&fscache_n_stores_nobufs),
47451+ atomic_read_unchecked(&fscache_n_stores_oom));
47452 seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
47453- atomic_read(&fscache_n_store_ops),
47454- atomic_read(&fscache_n_store_calls),
47455- atomic_read(&fscache_n_store_pages),
47456- atomic_read(&fscache_n_store_radix_deletes),
47457- atomic_read(&fscache_n_store_pages_over_limit));
47458+ atomic_read_unchecked(&fscache_n_store_ops),
47459+ atomic_read_unchecked(&fscache_n_store_calls),
47460+ atomic_read_unchecked(&fscache_n_store_pages),
47461+ atomic_read_unchecked(&fscache_n_store_radix_deletes),
47462+ atomic_read_unchecked(&fscache_n_store_pages_over_limit));
47463
47464 seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
47465- atomic_read(&fscache_n_store_vmscan_not_storing),
47466- atomic_read(&fscache_n_store_vmscan_gone),
47467- atomic_read(&fscache_n_store_vmscan_busy),
47468- atomic_read(&fscache_n_store_vmscan_cancelled));
47469+ atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
47470+ atomic_read_unchecked(&fscache_n_store_vmscan_gone),
47471+ atomic_read_unchecked(&fscache_n_store_vmscan_busy),
47472+ atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
47473
47474 seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
47475- atomic_read(&fscache_n_op_pend),
47476- atomic_read(&fscache_n_op_run),
47477- atomic_read(&fscache_n_op_enqueue),
47478- atomic_read(&fscache_n_op_cancelled),
47479- atomic_read(&fscache_n_op_rejected));
47480+ atomic_read_unchecked(&fscache_n_op_pend),
47481+ atomic_read_unchecked(&fscache_n_op_run),
47482+ atomic_read_unchecked(&fscache_n_op_enqueue),
47483+ atomic_read_unchecked(&fscache_n_op_cancelled),
47484+ atomic_read_unchecked(&fscache_n_op_rejected));
47485 seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
47486- atomic_read(&fscache_n_op_deferred_release),
47487- atomic_read(&fscache_n_op_release),
47488- atomic_read(&fscache_n_op_gc));
47489+ atomic_read_unchecked(&fscache_n_op_deferred_release),
47490+ atomic_read_unchecked(&fscache_n_op_release),
47491+ atomic_read_unchecked(&fscache_n_op_gc));
47492
47493 seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
47494 atomic_read(&fscache_n_cop_alloc_object),
47495diff -urNp linux-2.6.39.1/fs/fs_struct.c linux-2.6.39.1/fs/fs_struct.c
47496--- linux-2.6.39.1/fs/fs_struct.c 2011-05-19 00:06:34.000000000 -0400
47497+++ linux-2.6.39.1/fs/fs_struct.c 2011-05-22 19:41:37.000000000 -0400
47498@@ -4,6 +4,7 @@
47499 #include <linux/path.h>
47500 #include <linux/slab.h>
47501 #include <linux/fs_struct.h>
47502+#include <linux/grsecurity.h>
47503 #include "internal.h"
47504
47505 static inline void path_get_longterm(struct path *path)
47506@@ -31,6 +32,7 @@ void set_fs_root(struct fs_struct *fs, s
47507 old_root = fs->root;
47508 fs->root = *path;
47509 path_get_longterm(path);
47510+ gr_set_chroot_entries(current, path);
47511 write_seqcount_end(&fs->seq);
47512 spin_unlock(&fs->lock);
47513 if (old_root.dentry)
47514@@ -74,6 +76,7 @@ void chroot_fs_refs(struct path *old_roo
47515 && fs->root.mnt == old_root->mnt) {
47516 path_get_longterm(new_root);
47517 fs->root = *new_root;
47518+ gr_set_chroot_entries(p, new_root);
47519 count++;
47520 }
47521 if (fs->pwd.dentry == old_root->dentry
47522@@ -109,7 +112,8 @@ void exit_fs(struct task_struct *tsk)
47523 spin_lock(&fs->lock);
47524 write_seqcount_begin(&fs->seq);
47525 tsk->fs = NULL;
47526- kill = !--fs->users;
47527+ gr_clear_chroot_entries(tsk);
47528+ kill = !atomic_dec_return(&fs->users);
47529 write_seqcount_end(&fs->seq);
47530 spin_unlock(&fs->lock);
47531 task_unlock(tsk);
47532@@ -123,7 +127,7 @@ struct fs_struct *copy_fs_struct(struct
47533 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
47534 /* We don't need to lock fs - think why ;-) */
47535 if (fs) {
47536- fs->users = 1;
47537+ atomic_set(&fs->users, 1);
47538 fs->in_exec = 0;
47539 spin_lock_init(&fs->lock);
47540 seqcount_init(&fs->seq);
47541@@ -132,6 +136,9 @@ struct fs_struct *copy_fs_struct(struct
47542 spin_lock(&old->lock);
47543 fs->root = old->root;
47544 path_get_longterm(&fs->root);
47545+ /* instead of calling gr_set_chroot_entries here,
47546+ we call it from every caller of this function
47547+ */
47548 fs->pwd = old->pwd;
47549 path_get_longterm(&fs->pwd);
47550 spin_unlock(&old->lock);
47551@@ -150,8 +157,9 @@ int unshare_fs_struct(void)
47552
47553 task_lock(current);
47554 spin_lock(&fs->lock);
47555- kill = !--fs->users;
47556+ kill = !atomic_dec_return(&fs->users);
47557 current->fs = new_fs;
47558+ gr_set_chroot_entries(current, &new_fs->root);
47559 spin_unlock(&fs->lock);
47560 task_unlock(current);
47561
47562@@ -170,7 +178,7 @@ EXPORT_SYMBOL(current_umask);
47563
47564 /* to be mentioned only in INIT_TASK */
47565 struct fs_struct init_fs = {
47566- .users = 1,
47567+ .users = ATOMIC_INIT(1),
47568 .lock = __SPIN_LOCK_UNLOCKED(init_fs.lock),
47569 .seq = SEQCNT_ZERO,
47570 .umask = 0022,
47571@@ -186,12 +194,13 @@ void daemonize_fs_struct(void)
47572 task_lock(current);
47573
47574 spin_lock(&init_fs.lock);
47575- init_fs.users++;
47576+ atomic_inc(&init_fs.users);
47577 spin_unlock(&init_fs.lock);
47578
47579 spin_lock(&fs->lock);
47580 current->fs = &init_fs;
47581- kill = !--fs->users;
47582+ gr_set_chroot_entries(current, &current->fs->root);
47583+ kill = !atomic_dec_return(&fs->users);
47584 spin_unlock(&fs->lock);
47585
47586 task_unlock(current);
47587diff -urNp linux-2.6.39.1/fs/fuse/cuse.c linux-2.6.39.1/fs/fuse/cuse.c
47588--- linux-2.6.39.1/fs/fuse/cuse.c 2011-05-19 00:06:34.000000000 -0400
47589+++ linux-2.6.39.1/fs/fuse/cuse.c 2011-05-22 19:36:32.000000000 -0400
47590@@ -538,8 +538,18 @@ static int cuse_channel_release(struct i
47591 return rc;
47592 }
47593
47594-static struct file_operations cuse_channel_fops; /* initialized during init */
47595-
47596+static const struct file_operations cuse_channel_fops = { /* initialized during init */
47597+ .owner = THIS_MODULE,
47598+ .llseek = no_llseek,
47599+ .read = do_sync_read,
47600+ .aio_read = fuse_dev_read,
47601+ .write = do_sync_write,
47602+ .aio_write = fuse_dev_write,
47603+ .poll = fuse_dev_poll,
47604+ .open = cuse_channel_open,
47605+ .release = cuse_channel_release,
47606+ .fasync = fuse_dev_fasync,
47607+};
47608
47609 /**************************************************************************
47610 * Misc stuff and module initializatiion
47611@@ -585,12 +595,6 @@ static int __init cuse_init(void)
47612 for (i = 0; i < CUSE_CONNTBL_LEN; i++)
47613 INIT_LIST_HEAD(&cuse_conntbl[i]);
47614
47615- /* inherit and extend fuse_dev_operations */
47616- cuse_channel_fops = fuse_dev_operations;
47617- cuse_channel_fops.owner = THIS_MODULE;
47618- cuse_channel_fops.open = cuse_channel_open;
47619- cuse_channel_fops.release = cuse_channel_release;
47620-
47621 cuse_class = class_create(THIS_MODULE, "cuse");
47622 if (IS_ERR(cuse_class))
47623 return PTR_ERR(cuse_class);
47624diff -urNp linux-2.6.39.1/fs/fuse/dev.c linux-2.6.39.1/fs/fuse/dev.c
47625--- linux-2.6.39.1/fs/fuse/dev.c 2011-05-19 00:06:34.000000000 -0400
47626+++ linux-2.6.39.1/fs/fuse/dev.c 2011-05-22 19:36:32.000000000 -0400
47627@@ -1181,7 +1181,7 @@ static ssize_t fuse_dev_do_read(struct f
47628 return err;
47629 }
47630
47631-static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
47632+ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
47633 unsigned long nr_segs, loff_t pos)
47634 {
47635 struct fuse_copy_state cs;
47636@@ -1195,6 +1195,8 @@ static ssize_t fuse_dev_read(struct kioc
47637 return fuse_dev_do_read(fc, file, &cs, iov_length(iov, nr_segs));
47638 }
47639
47640+EXPORT_SYMBOL_GPL(fuse_dev_read);
47641+
47642 static int fuse_dev_pipe_buf_steal(struct pipe_inode_info *pipe,
47643 struct pipe_buffer *buf)
47644 {
47645@@ -1238,7 +1240,7 @@ static ssize_t fuse_dev_splice_read(stru
47646 ret = 0;
47647 pipe_lock(pipe);
47648
47649- if (!pipe->readers) {
47650+ if (!atomic_read(&pipe->readers)) {
47651 send_sig(SIGPIPE, current, 0);
47652 if (!ret)
47653 ret = -EPIPE;
47654@@ -1731,7 +1733,7 @@ static ssize_t fuse_dev_do_write(struct
47655 return err;
47656 }
47657
47658-static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
47659+ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
47660 unsigned long nr_segs, loff_t pos)
47661 {
47662 struct fuse_copy_state cs;
47663@@ -1744,6 +1746,8 @@ static ssize_t fuse_dev_write(struct kio
47664 return fuse_dev_do_write(fc, &cs, iov_length(iov, nr_segs));
47665 }
47666
47667+EXPORT_SYMBOL_GPL(fuse_dev_write);
47668+
47669 static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
47670 struct file *out, loff_t *ppos,
47671 size_t len, unsigned int flags)
47672@@ -1822,7 +1826,7 @@ out:
47673 return ret;
47674 }
47675
47676-static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
47677+unsigned fuse_dev_poll(struct file *file, poll_table *wait)
47678 {
47679 unsigned mask = POLLOUT | POLLWRNORM;
47680 struct fuse_conn *fc = fuse_get_conn(file);
47681@@ -1841,6 +1845,8 @@ static unsigned fuse_dev_poll(struct fil
47682 return mask;
47683 }
47684
47685+EXPORT_SYMBOL_GPL(fuse_dev_poll);
47686+
47687 /*
47688 * Abort all requests on the given list (pending or processing)
47689 *
47690@@ -1977,7 +1983,7 @@ int fuse_dev_release(struct inode *inode
47691 }
47692 EXPORT_SYMBOL_GPL(fuse_dev_release);
47693
47694-static int fuse_dev_fasync(int fd, struct file *file, int on)
47695+int fuse_dev_fasync(int fd, struct file *file, int on)
47696 {
47697 struct fuse_conn *fc = fuse_get_conn(file);
47698 if (!fc)
47699@@ -1987,6 +1993,8 @@ static int fuse_dev_fasync(int fd, struc
47700 return fasync_helper(fd, file, on, &fc->fasync);
47701 }
47702
47703+EXPORT_SYMBOL_GPL(fuse_dev_fasync);
47704+
47705 const struct file_operations fuse_dev_operations = {
47706 .owner = THIS_MODULE,
47707 .llseek = no_llseek,
47708diff -urNp linux-2.6.39.1/fs/fuse/dir.c linux-2.6.39.1/fs/fuse/dir.c
47709--- linux-2.6.39.1/fs/fuse/dir.c 2011-05-19 00:06:34.000000000 -0400
47710+++ linux-2.6.39.1/fs/fuse/dir.c 2011-05-22 19:36:32.000000000 -0400
47711@@ -1147,7 +1147,7 @@ static char *read_link(struct dentry *de
47712 return link;
47713 }
47714
47715-static void free_link(char *link)
47716+static void free_link(const char *link)
47717 {
47718 if (!IS_ERR(link))
47719 free_page((unsigned long) link);
47720diff -urNp linux-2.6.39.1/fs/fuse/fuse_i.h linux-2.6.39.1/fs/fuse/fuse_i.h
47721--- linux-2.6.39.1/fs/fuse/fuse_i.h 2011-05-19 00:06:34.000000000 -0400
47722+++ linux-2.6.39.1/fs/fuse/fuse_i.h 2011-05-22 19:36:32.000000000 -0400
47723@@ -540,6 +540,16 @@ extern const struct file_operations fuse
47724
47725 extern const struct dentry_operations fuse_dentry_operations;
47726
47727+extern ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
47728+ unsigned long nr_segs, loff_t pos);
47729+
47730+extern ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
47731+ unsigned long nr_segs, loff_t pos);
47732+
47733+extern unsigned fuse_dev_poll(struct file *file, poll_table *wait);
47734+
47735+extern int fuse_dev_fasync(int fd, struct file *file, int on);
47736+
47737 /**
47738 * Inode to nodeid comparison.
47739 */
47740diff -urNp linux-2.6.39.1/fs/gfs2/ops_inode.c linux-2.6.39.1/fs/gfs2/ops_inode.c
47741--- linux-2.6.39.1/fs/gfs2/ops_inode.c 2011-05-19 00:06:34.000000000 -0400
47742+++ linux-2.6.39.1/fs/gfs2/ops_inode.c 2011-05-22 19:36:32.000000000 -0400
47743@@ -740,6 +740,8 @@ static int gfs2_rename(struct inode *odi
47744 unsigned int x;
47745 int error;
47746
47747+ pax_track_stack();
47748+
47749 if (ndentry->d_inode) {
47750 nip = GFS2_I(ndentry->d_inode);
47751 if (ip == nip)
47752@@ -1019,7 +1021,7 @@ out:
47753
47754 static void gfs2_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
47755 {
47756- char *s = nd_get_link(nd);
47757+ const char *s = nd_get_link(nd);
47758 if (!IS_ERR(s))
47759 kfree(s);
47760 }
47761diff -urNp linux-2.6.39.1/fs/hfsplus/catalog.c linux-2.6.39.1/fs/hfsplus/catalog.c
47762--- linux-2.6.39.1/fs/hfsplus/catalog.c 2011-05-19 00:06:34.000000000 -0400
47763+++ linux-2.6.39.1/fs/hfsplus/catalog.c 2011-05-22 19:36:32.000000000 -0400
47764@@ -179,6 +179,8 @@ int hfsplus_find_cat(struct super_block
47765 int err;
47766 u16 type;
47767
47768+ pax_track_stack();
47769+
47770 hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
47771 err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
47772 if (err)
47773@@ -210,6 +212,8 @@ int hfsplus_create_cat(u32 cnid, struct
47774 int entry_size;
47775 int err;
47776
47777+ pax_track_stack();
47778+
47779 dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n",
47780 str->name, cnid, inode->i_nlink);
47781 hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd);
47782@@ -349,6 +353,8 @@ int hfsplus_rename_cat(u32 cnid,
47783 int entry_size, type;
47784 int err = 0;
47785
47786+ pax_track_stack();
47787+
47788 dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n",
47789 cnid, src_dir->i_ino, src_name->name,
47790 dst_dir->i_ino, dst_name->name);
47791diff -urNp linux-2.6.39.1/fs/hfsplus/dir.c linux-2.6.39.1/fs/hfsplus/dir.c
47792--- linux-2.6.39.1/fs/hfsplus/dir.c 2011-05-19 00:06:34.000000000 -0400
47793+++ linux-2.6.39.1/fs/hfsplus/dir.c 2011-05-22 19:36:32.000000000 -0400
47794@@ -129,6 +129,8 @@ static int hfsplus_readdir(struct file *
47795 struct hfsplus_readdir_data *rd;
47796 u16 type;
47797
47798+ pax_track_stack();
47799+
47800 if (filp->f_pos >= inode->i_size)
47801 return 0;
47802
47803diff -urNp linux-2.6.39.1/fs/hfsplus/inode.c linux-2.6.39.1/fs/hfsplus/inode.c
47804--- linux-2.6.39.1/fs/hfsplus/inode.c 2011-05-19 00:06:34.000000000 -0400
47805+++ linux-2.6.39.1/fs/hfsplus/inode.c 2011-05-22 19:36:32.000000000 -0400
47806@@ -489,6 +489,8 @@ int hfsplus_cat_read_inode(struct inode
47807 int res = 0;
47808 u16 type;
47809
47810+ pax_track_stack();
47811+
47812 type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
47813
47814 HFSPLUS_I(inode)->linkid = 0;
47815@@ -552,6 +554,8 @@ int hfsplus_cat_write_inode(struct inode
47816 struct hfs_find_data fd;
47817 hfsplus_cat_entry entry;
47818
47819+ pax_track_stack();
47820+
47821 if (HFSPLUS_IS_RSRC(inode))
47822 main_inode = HFSPLUS_I(inode)->rsrc_inode;
47823
47824diff -urNp linux-2.6.39.1/fs/hfsplus/ioctl.c linux-2.6.39.1/fs/hfsplus/ioctl.c
47825--- linux-2.6.39.1/fs/hfsplus/ioctl.c 2011-05-19 00:06:34.000000000 -0400
47826+++ linux-2.6.39.1/fs/hfsplus/ioctl.c 2011-05-22 19:36:32.000000000 -0400
47827@@ -122,6 +122,8 @@ int hfsplus_setxattr(struct dentry *dent
47828 struct hfsplus_cat_file *file;
47829 int res;
47830
47831+ pax_track_stack();
47832+
47833 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
47834 return -EOPNOTSUPP;
47835
47836@@ -166,6 +168,8 @@ ssize_t hfsplus_getxattr(struct dentry *
47837 struct hfsplus_cat_file *file;
47838 ssize_t res = 0;
47839
47840+ pax_track_stack();
47841+
47842 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
47843 return -EOPNOTSUPP;
47844
47845diff -urNp linux-2.6.39.1/fs/hfsplus/super.c linux-2.6.39.1/fs/hfsplus/super.c
47846--- linux-2.6.39.1/fs/hfsplus/super.c 2011-05-19 00:06:34.000000000 -0400
47847+++ linux-2.6.39.1/fs/hfsplus/super.c 2011-05-22 19:36:32.000000000 -0400
47848@@ -340,6 +340,8 @@ static int hfsplus_fill_super(struct sup
47849 struct nls_table *nls = NULL;
47850 int err;
47851
47852+ pax_track_stack();
47853+
47854 err = -EINVAL;
47855 sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
47856 if (!sbi)
47857diff -urNp linux-2.6.39.1/fs/hugetlbfs/inode.c linux-2.6.39.1/fs/hugetlbfs/inode.c
47858--- linux-2.6.39.1/fs/hugetlbfs/inode.c 2011-05-19 00:06:34.000000000 -0400
47859+++ linux-2.6.39.1/fs/hugetlbfs/inode.c 2011-05-22 19:41:37.000000000 -0400
47860@@ -914,7 +914,7 @@ static struct file_system_type hugetlbfs
47861 .kill_sb = kill_litter_super,
47862 };
47863
47864-static struct vfsmount *hugetlbfs_vfsmount;
47865+struct vfsmount *hugetlbfs_vfsmount;
47866
47867 static int can_do_hugetlb_shm(void)
47868 {
47869diff -urNp linux-2.6.39.1/fs/inode.c linux-2.6.39.1/fs/inode.c
47870--- linux-2.6.39.1/fs/inode.c 2011-05-19 00:06:34.000000000 -0400
47871+++ linux-2.6.39.1/fs/inode.c 2011-05-22 19:36:32.000000000 -0400
47872@@ -862,8 +862,8 @@ unsigned int get_next_ino(void)
47873
47874 #ifdef CONFIG_SMP
47875 if (unlikely((res & (LAST_INO_BATCH-1)) == 0)) {
47876- static atomic_t shared_last_ino;
47877- int next = atomic_add_return(LAST_INO_BATCH, &shared_last_ino);
47878+ static atomic_unchecked_t shared_last_ino;
47879+ int next = atomic_add_return_unchecked(LAST_INO_BATCH, &shared_last_ino);
47880
47881 res = next - LAST_INO_BATCH;
47882 }
47883diff -urNp linux-2.6.39.1/fs/jbd/checkpoint.c linux-2.6.39.1/fs/jbd/checkpoint.c
47884--- linux-2.6.39.1/fs/jbd/checkpoint.c 2011-05-19 00:06:34.000000000 -0400
47885+++ linux-2.6.39.1/fs/jbd/checkpoint.c 2011-05-22 19:36:32.000000000 -0400
47886@@ -350,6 +350,8 @@ int log_do_checkpoint(journal_t *journal
47887 tid_t this_tid;
47888 int result;
47889
47890+ pax_track_stack();
47891+
47892 jbd_debug(1, "Start checkpoint\n");
47893
47894 /*
47895diff -urNp linux-2.6.39.1/fs/jffs2/compr_rtime.c linux-2.6.39.1/fs/jffs2/compr_rtime.c
47896--- linux-2.6.39.1/fs/jffs2/compr_rtime.c 2011-05-19 00:06:34.000000000 -0400
47897+++ linux-2.6.39.1/fs/jffs2/compr_rtime.c 2011-05-22 19:36:32.000000000 -0400
47898@@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned
47899 int outpos = 0;
47900 int pos=0;
47901
47902+ pax_track_stack();
47903+
47904 memset(positions,0,sizeof(positions));
47905
47906 while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
47907@@ -78,6 +80,8 @@ static int jffs2_rtime_decompress(unsign
47908 int outpos = 0;
47909 int pos=0;
47910
47911+ pax_track_stack();
47912+
47913 memset(positions,0,sizeof(positions));
47914
47915 while (outpos<destlen) {
47916diff -urNp linux-2.6.39.1/fs/jffs2/compr_rubin.c linux-2.6.39.1/fs/jffs2/compr_rubin.c
47917--- linux-2.6.39.1/fs/jffs2/compr_rubin.c 2011-05-19 00:06:34.000000000 -0400
47918+++ linux-2.6.39.1/fs/jffs2/compr_rubin.c 2011-05-22 19:36:32.000000000 -0400
47919@@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsig
47920 int ret;
47921 uint32_t mysrclen, mydstlen;
47922
47923+ pax_track_stack();
47924+
47925 mysrclen = *sourcelen;
47926 mydstlen = *dstlen - 8;
47927
47928diff -urNp linux-2.6.39.1/fs/jffs2/erase.c linux-2.6.39.1/fs/jffs2/erase.c
47929--- linux-2.6.39.1/fs/jffs2/erase.c 2011-05-19 00:06:34.000000000 -0400
47930+++ linux-2.6.39.1/fs/jffs2/erase.c 2011-05-22 19:36:32.000000000 -0400
47931@@ -439,7 +439,8 @@ static void jffs2_mark_erased_block(stru
47932 struct jffs2_unknown_node marker = {
47933 .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
47934 .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
47935- .totlen = cpu_to_je32(c->cleanmarker_size)
47936+ .totlen = cpu_to_je32(c->cleanmarker_size),
47937+ .hdr_crc = cpu_to_je32(0)
47938 };
47939
47940 jffs2_prealloc_raw_node_refs(c, jeb, 1);
47941diff -urNp linux-2.6.39.1/fs/jffs2/wbuf.c linux-2.6.39.1/fs/jffs2/wbuf.c
47942--- linux-2.6.39.1/fs/jffs2/wbuf.c 2011-05-19 00:06:34.000000000 -0400
47943+++ linux-2.6.39.1/fs/jffs2/wbuf.c 2011-05-22 19:36:32.000000000 -0400
47944@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
47945 {
47946 .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
47947 .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
47948- .totlen = constant_cpu_to_je32(8)
47949+ .totlen = constant_cpu_to_je32(8),
47950+ .hdr_crc = constant_cpu_to_je32(0)
47951 };
47952
47953 /*
47954diff -urNp linux-2.6.39.1/fs/jffs2/xattr.c linux-2.6.39.1/fs/jffs2/xattr.c
47955--- linux-2.6.39.1/fs/jffs2/xattr.c 2011-05-19 00:06:34.000000000 -0400
47956+++ linux-2.6.39.1/fs/jffs2/xattr.c 2011-05-22 19:36:32.000000000 -0400
47957@@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct
47958
47959 BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
47960
47961+ pax_track_stack();
47962+
47963 /* Phase.1 : Merge same xref */
47964 for (i=0; i < XREF_TMPHASH_SIZE; i++)
47965 xref_tmphash[i] = NULL;
47966diff -urNp linux-2.6.39.1/fs/Kconfig.binfmt linux-2.6.39.1/fs/Kconfig.binfmt
47967--- linux-2.6.39.1/fs/Kconfig.binfmt 2011-05-19 00:06:34.000000000 -0400
47968+++ linux-2.6.39.1/fs/Kconfig.binfmt 2011-05-22 19:36:32.000000000 -0400
47969@@ -86,7 +86,7 @@ config HAVE_AOUT
47970
47971 config BINFMT_AOUT
47972 tristate "Kernel support for a.out and ECOFF binaries"
47973- depends on HAVE_AOUT
47974+ depends on HAVE_AOUT && BROKEN
47975 ---help---
47976 A.out (Assembler.OUTput) is a set of formats for libraries and
47977 executables used in the earliest versions of UNIX. Linux used
47978diff -urNp linux-2.6.39.1/fs/libfs.c linux-2.6.39.1/fs/libfs.c
47979--- linux-2.6.39.1/fs/libfs.c 2011-05-19 00:06:34.000000000 -0400
47980+++ linux-2.6.39.1/fs/libfs.c 2011-05-22 19:36:32.000000000 -0400
47981@@ -163,6 +163,9 @@ int dcache_readdir(struct file * filp, v
47982
47983 for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
47984 struct dentry *next;
47985+ char d_name[sizeof(next->d_iname)];
47986+ const unsigned char *name;
47987+
47988 next = list_entry(p, struct dentry, d_u.d_child);
47989 spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
47990 if (!simple_positive(next)) {
47991@@ -172,7 +175,12 @@ int dcache_readdir(struct file * filp, v
47992
47993 spin_unlock(&next->d_lock);
47994 spin_unlock(&dentry->d_lock);
47995- if (filldir(dirent, next->d_name.name,
47996+ name = next->d_name.name;
47997+ if (name == next->d_iname) {
47998+ memcpy(d_name, name, next->d_name.len);
47999+ name = d_name;
48000+ }
48001+ if (filldir(dirent, name,
48002 next->d_name.len, filp->f_pos,
48003 next->d_inode->i_ino,
48004 dt_type(next->d_inode)) < 0)
48005diff -urNp linux-2.6.39.1/fs/lockd/clntproc.c linux-2.6.39.1/fs/lockd/clntproc.c
48006--- linux-2.6.39.1/fs/lockd/clntproc.c 2011-05-19 00:06:34.000000000 -0400
48007+++ linux-2.6.39.1/fs/lockd/clntproc.c 2011-05-22 19:36:32.000000000 -0400
48008@@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt
48009 /*
48010 * Cookie counter for NLM requests
48011 */
48012-static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
48013+static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
48014
48015 void nlmclnt_next_cookie(struct nlm_cookie *c)
48016 {
48017- u32 cookie = atomic_inc_return(&nlm_cookie);
48018+ u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
48019
48020 memcpy(c->data, &cookie, 4);
48021 c->len=4;
48022@@ -620,6 +620,8 @@ nlmclnt_reclaim(struct nlm_host *host, s
48023 struct nlm_rqst reqst, *req;
48024 int status;
48025
48026+ pax_track_stack();
48027+
48028 req = &reqst;
48029 memset(req, 0, sizeof(*req));
48030 locks_init_lock(&req->a_args.lock.fl);
48031diff -urNp linux-2.6.39.1/fs/lockd/svc.c linux-2.6.39.1/fs/lockd/svc.c
48032--- linux-2.6.39.1/fs/lockd/svc.c 2011-05-19 00:06:34.000000000 -0400
48033+++ linux-2.6.39.1/fs/lockd/svc.c 2011-05-22 19:36:32.000000000 -0400
48034@@ -41,7 +41,7 @@
48035
48036 static struct svc_program nlmsvc_program;
48037
48038-struct nlmsvc_binding * nlmsvc_ops;
48039+const struct nlmsvc_binding * nlmsvc_ops;
48040 EXPORT_SYMBOL_GPL(nlmsvc_ops);
48041
48042 static DEFINE_MUTEX(nlmsvc_mutex);
48043diff -urNp linux-2.6.39.1/fs/locks.c linux-2.6.39.1/fs/locks.c
48044--- linux-2.6.39.1/fs/locks.c 2011-05-19 00:06:34.000000000 -0400
48045+++ linux-2.6.39.1/fs/locks.c 2011-05-22 19:36:32.000000000 -0400
48046@@ -2033,16 +2033,16 @@ void locks_remove_flock(struct file *fil
48047 return;
48048
48049 if (filp->f_op && filp->f_op->flock) {
48050- struct file_lock fl = {
48051+ struct file_lock flock = {
48052 .fl_pid = current->tgid,
48053 .fl_file = filp,
48054 .fl_flags = FL_FLOCK,
48055 .fl_type = F_UNLCK,
48056 .fl_end = OFFSET_MAX,
48057 };
48058- filp->f_op->flock(filp, F_SETLKW, &fl);
48059- if (fl.fl_ops && fl.fl_ops->fl_release_private)
48060- fl.fl_ops->fl_release_private(&fl);
48061+ filp->f_op->flock(filp, F_SETLKW, &flock);
48062+ if (flock.fl_ops && flock.fl_ops->fl_release_private)
48063+ flock.fl_ops->fl_release_private(&flock);
48064 }
48065
48066 lock_flocks();
48067diff -urNp linux-2.6.39.1/fs/logfs/super.c linux-2.6.39.1/fs/logfs/super.c
48068--- linux-2.6.39.1/fs/logfs/super.c 2011-05-19 00:06:34.000000000 -0400
48069+++ linux-2.6.39.1/fs/logfs/super.c 2011-05-22 19:36:32.000000000 -0400
48070@@ -266,6 +266,8 @@ static int logfs_recover_sb(struct super
48071 struct logfs_disk_super _ds1, *ds1 = &_ds1;
48072 int err, valid0, valid1;
48073
48074+ pax_track_stack();
48075+
48076 /* read first superblock */
48077 err = wbuf_read(sb, super->s_sb_ofs[0], sizeof(*ds0), ds0);
48078 if (err)
48079diff -urNp linux-2.6.39.1/fs/namei.c linux-2.6.39.1/fs/namei.c
48080--- linux-2.6.39.1/fs/namei.c 2011-06-03 00:04:14.000000000 -0400
48081+++ linux-2.6.39.1/fs/namei.c 2011-06-03 00:32:07.000000000 -0400
48082@@ -237,20 +237,30 @@ int generic_permission(struct inode *ino
48083 return ret;
48084
48085 /*
48086- * Read/write DACs are always overridable.
48087- * Executable DACs are overridable if at least one exec bit is set.
48088+ * Searching includes executable on directories, else just read.
48089 */
48090- if (!(mask & MAY_EXEC) || execute_ok(inode))
48091- if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
48092+ mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
48093+ if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE))) {
48094+#ifdef CONFIG_GRKERNSEC
48095+ if (flags & IPERM_FLAG_RCU)
48096+ return -ECHILD;
48097+#endif
48098+ if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
48099 return 0;
48100+ }
48101
48102 /*
48103- * Searching includes executable on directories, else just read.
48104+ * Read/write DACs are always overridable.
48105+ * Executable DACs are overridable if at least one exec bit is set.
48106 */
48107- mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
48108- if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
48109- if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
48110+ if (!(mask & MAY_EXEC) || execute_ok(inode)) {
48111+#ifdef CONFIG_GRKERNSEC
48112+ if (flags & IPERM_FLAG_RCU)
48113+ return -ECHILD;
48114+#endif
48115+ if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
48116 return 0;
48117+ }
48118
48119 return -EACCES;
48120 }
48121@@ -626,6 +636,9 @@ static inline int handle_reval_path(stru
48122 struct dentry *dentry = nd->path.dentry;
48123 int status;
48124
48125+ if (!(nd->flags & LOOKUP_PARENT) && !gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
48126+ return -ENOENT;
48127+
48128 if (likely(!(nd->flags & LOOKUP_JUMPED)))
48129 return 0;
48130
48131@@ -671,9 +684,16 @@ static inline int exec_permission(struct
48132 if (ret == -ECHILD)
48133 return ret;
48134
48135- if (ns_capable(ns, CAP_DAC_OVERRIDE) ||
48136- ns_capable(ns, CAP_DAC_READ_SEARCH))
48137+ if (ns_capable_nolog(ns, CAP_DAC_OVERRIDE))
48138 goto ok;
48139+ else {
48140+#ifdef CONFIG_GRKERNSEC
48141+ if (flags & IPERM_FLAG_RCU)
48142+ return -ECHILD;
48143+#endif
48144+ if (ns_capable(ns, CAP_DAC_READ_SEARCH) || ns_capable(ns, CAP_DAC_OVERRIDE))
48145+ goto ok;
48146+ }
48147
48148 return ret;
48149 ok:
48150@@ -781,11 +801,19 @@ follow_link(struct path *link, struct na
48151 return error;
48152 }
48153
48154+ if (gr_handle_follow_link(dentry->d_parent->d_inode,
48155+ dentry->d_inode, dentry, nd->path.mnt)) {
48156+ error = -EACCES;
48157+ *p = ERR_PTR(error); /* no ->put_link(), please */
48158+ path_put(&nd->path);
48159+ return error;
48160+ }
48161+
48162 nd->last_type = LAST_BIND;
48163 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
48164 error = PTR_ERR(*p);
48165 if (!IS_ERR(*p)) {
48166- char *s = nd_get_link(nd);
48167+ const char *s = nd_get_link(nd);
48168 error = 0;
48169 if (s)
48170 error = __vfs_follow_link(nd, s);
48171@@ -1697,6 +1725,9 @@ static int do_path_lookup(int dfd, const
48172 retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);
48173
48174 if (likely(!retval)) {
48175+ if (*name != '/' && nd->path.dentry && nd->inode && !gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
48176+ return -ENOENT;
48177+
48178 if (unlikely(!audit_dummy_context())) {
48179 if (nd->path.dentry && nd->inode)
48180 audit_inode(name, nd->path.dentry);
48181@@ -2007,6 +2038,30 @@ int vfs_create(struct inode *dir, struct
48182 return error;
48183 }
48184
48185+/*
48186+ * Note that while the flag value (low two bits) for sys_open means:
48187+ * 00 - read-only
48188+ * 01 - write-only
48189+ * 10 - read-write
48190+ * 11 - special
48191+ * it is changed into
48192+ * 00 - no permissions needed
48193+ * 01 - read-permission
48194+ * 10 - write-permission
48195+ * 11 - read-write
48196+ * for the internal routines (ie open_namei()/follow_link() etc)
48197+ * This is more logical, and also allows the 00 "no perm needed"
48198+ * to be used for symlinks (where the permissions are checked
48199+ * later).
48200+ *
48201+*/
48202+static inline int open_to_namei_flags(int flag)
48203+{
48204+ if ((flag+1) & O_ACCMODE)
48205+ flag++;
48206+ return flag;
48207+}
48208+
48209 static int may_open(struct path *path, int acc_mode, int flag)
48210 {
48211 struct dentry *dentry = path->dentry;
48212@@ -2059,7 +2114,27 @@ static int may_open(struct path *path, i
48213 /*
48214 * Ensure there are no outstanding leases on the file.
48215 */
48216- return break_lease(inode, flag);
48217+ error = break_lease(inode, flag);
48218+
48219+ if (error)
48220+ return error;
48221+
48222+ if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
48223+ error = -EPERM;
48224+ goto exit;
48225+ }
48226+
48227+ if (gr_handle_rawio(inode)) {
48228+ error = -EPERM;
48229+ goto exit;
48230+ }
48231+
48232+ if (!gr_acl_handle_open(dentry, path->mnt, open_to_namei_flags(flag))) {
48233+ error = -EACCES;
48234+ goto exit;
48235+ }
48236+exit:
48237+ return error;
48238 }
48239
48240 static int handle_truncate(struct file *filp)
48241@@ -2085,30 +2160,6 @@ static int handle_truncate(struct file *
48242 }
48243
48244 /*
48245- * Note that while the flag value (low two bits) for sys_open means:
48246- * 00 - read-only
48247- * 01 - write-only
48248- * 10 - read-write
48249- * 11 - special
48250- * it is changed into
48251- * 00 - no permissions needed
48252- * 01 - read-permission
48253- * 10 - write-permission
48254- * 11 - read-write
48255- * for the internal routines (ie open_namei()/follow_link() etc)
48256- * This is more logical, and also allows the 00 "no perm needed"
48257- * to be used for symlinks (where the permissions are checked
48258- * later).
48259- *
48260-*/
48261-static inline int open_to_namei_flags(int flag)
48262-{
48263- if ((flag+1) & O_ACCMODE)
48264- flag++;
48265- return flag;
48266-}
48267-
48268-/*
48269 * Handle the last step of open()
48270 */
48271 static struct file *do_last(struct nameidata *nd, struct path *path,
48272@@ -2117,6 +2168,7 @@ static struct file *do_last(struct namei
48273 struct dentry *dir = nd->path.dentry;
48274 struct dentry *dentry;
48275 int open_flag = op->open_flag;
48276+ int flag = open_to_namei_flags(open_flag);
48277 int will_truncate = open_flag & O_TRUNC;
48278 int want_write = 0;
48279 int acc_mode = op->acc_mode;
48280@@ -2212,6 +2264,12 @@ static struct file *do_last(struct namei
48281 /* Negative dentry, just create the file */
48282 if (!dentry->d_inode) {
48283 int mode = op->mode;
48284+
48285+ if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, path->mnt, flag, mode)) {
48286+ error = -EACCES;
48287+ goto exit_mutex_unlock;
48288+ }
48289+
48290 if (!IS_POSIXACL(dir->d_inode))
48291 mode &= ~current_umask();
48292 /*
48293@@ -2235,6 +2293,8 @@ static struct file *do_last(struct namei
48294 error = vfs_create(dir->d_inode, dentry, mode, nd);
48295 if (error)
48296 goto exit_mutex_unlock;
48297+ else
48298+ gr_handle_create(path->dentry, path->mnt);
48299 mutex_unlock(&dir->d_inode->i_mutex);
48300 dput(nd->path.dentry);
48301 nd->path.dentry = dentry;
48302@@ -2244,6 +2304,14 @@ static struct file *do_last(struct namei
48303 /*
48304 * It already exists.
48305 */
48306+
48307+ /* only check if O_CREAT is specified, all other checks need to go
48308+ into may_open */
48309+ if (gr_handle_fifo(path->dentry, path->mnt, dir, flag, acc_mode)) {
48310+ error = -EACCES;
48311+ goto exit_mutex_unlock;
48312+ }
48313+
48314 mutex_unlock(&dir->d_inode->i_mutex);
48315 audit_inode(pathname, path->dentry);
48316
48317@@ -2530,6 +2598,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
48318 error = may_mknod(mode);
48319 if (error)
48320 goto out_dput;
48321+
48322+ if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
48323+ error = -EPERM;
48324+ goto out_dput;
48325+ }
48326+
48327+ if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
48328+ error = -EACCES;
48329+ goto out_dput;
48330+ }
48331+
48332 error = mnt_want_write(nd.path.mnt);
48333 if (error)
48334 goto out_dput;
48335@@ -2550,6 +2629,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
48336 }
48337 out_drop_write:
48338 mnt_drop_write(nd.path.mnt);
48339+
48340+ if (!error)
48341+ gr_handle_create(dentry, nd.path.mnt);
48342 out_dput:
48343 dput(dentry);
48344 out_unlock:
48345@@ -2602,6 +2684,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
48346 if (IS_ERR(dentry))
48347 goto out_unlock;
48348
48349+ if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
48350+ error = -EACCES;
48351+ goto out_dput;
48352+ }
48353+
48354 if (!IS_POSIXACL(nd.path.dentry->d_inode))
48355 mode &= ~current_umask();
48356 error = mnt_want_write(nd.path.mnt);
48357@@ -2613,6 +2700,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
48358 error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
48359 out_drop_write:
48360 mnt_drop_write(nd.path.mnt);
48361+
48362+ if (!error)
48363+ gr_handle_create(dentry, nd.path.mnt);
48364+
48365 out_dput:
48366 dput(dentry);
48367 out_unlock:
48368@@ -2692,6 +2783,8 @@ static long do_rmdir(int dfd, const char
48369 char * name;
48370 struct dentry *dentry;
48371 struct nameidata nd;
48372+ ino_t saved_ino = 0;
48373+ dev_t saved_dev = 0;
48374
48375 error = user_path_parent(dfd, pathname, &nd, &name);
48376 if (error)
48377@@ -2716,6 +2809,19 @@ static long do_rmdir(int dfd, const char
48378 error = PTR_ERR(dentry);
48379 if (IS_ERR(dentry))
48380 goto exit2;
48381+
48382+ if (dentry->d_inode != NULL) {
48383+ if (dentry->d_inode->i_nlink <= 1) {
48384+ saved_ino = dentry->d_inode->i_ino;
48385+ saved_dev = gr_get_dev_from_dentry(dentry);
48386+ }
48387+
48388+ if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
48389+ error = -EACCES;
48390+ goto exit3;
48391+ }
48392+ }
48393+
48394 error = mnt_want_write(nd.path.mnt);
48395 if (error)
48396 goto exit3;
48397@@ -2723,6 +2829,8 @@ static long do_rmdir(int dfd, const char
48398 if (error)
48399 goto exit4;
48400 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
48401+ if (!error && (saved_dev || saved_ino))
48402+ gr_handle_delete(saved_ino, saved_dev);
48403 exit4:
48404 mnt_drop_write(nd.path.mnt);
48405 exit3:
48406@@ -2785,6 +2893,8 @@ static long do_unlinkat(int dfd, const c
48407 struct dentry *dentry;
48408 struct nameidata nd;
48409 struct inode *inode = NULL;
48410+ ino_t saved_ino = 0;
48411+ dev_t saved_dev = 0;
48412
48413 error = user_path_parent(dfd, pathname, &nd, &name);
48414 if (error)
48415@@ -2804,8 +2914,17 @@ static long do_unlinkat(int dfd, const c
48416 if (nd.last.name[nd.last.len])
48417 goto slashes;
48418 inode = dentry->d_inode;
48419- if (inode)
48420+ if (inode) {
48421 ihold(inode);
48422+ if (inode->i_nlink <= 1) {
48423+ saved_ino = inode->i_ino;
48424+ saved_dev = gr_get_dev_from_dentry(dentry);
48425+ }
48426+ if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
48427+ error = -EACCES;
48428+ goto exit2;
48429+ }
48430+ }
48431 error = mnt_want_write(nd.path.mnt);
48432 if (error)
48433 goto exit2;
48434@@ -2813,6 +2932,8 @@ static long do_unlinkat(int dfd, const c
48435 if (error)
48436 goto exit3;
48437 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
48438+ if (!error && (saved_ino || saved_dev))
48439+ gr_handle_delete(saved_ino, saved_dev);
48440 exit3:
48441 mnt_drop_write(nd.path.mnt);
48442 exit2:
48443@@ -2890,6 +3011,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
48444 if (IS_ERR(dentry))
48445 goto out_unlock;
48446
48447+ if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
48448+ error = -EACCES;
48449+ goto out_dput;
48450+ }
48451+
48452 error = mnt_want_write(nd.path.mnt);
48453 if (error)
48454 goto out_dput;
48455@@ -2897,6 +3023,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
48456 if (error)
48457 goto out_drop_write;
48458 error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
48459+ if (!error)
48460+ gr_handle_create(dentry, nd.path.mnt);
48461 out_drop_write:
48462 mnt_drop_write(nd.path.mnt);
48463 out_dput:
48464@@ -3005,6 +3133,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
48465 error = PTR_ERR(new_dentry);
48466 if (IS_ERR(new_dentry))
48467 goto out_unlock;
48468+
48469+ if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
48470+ old_path.dentry->d_inode,
48471+ old_path.dentry->d_inode->i_mode, to)) {
48472+ error = -EACCES;
48473+ goto out_dput;
48474+ }
48475+
48476+ if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
48477+ old_path.dentry, old_path.mnt, to)) {
48478+ error = -EACCES;
48479+ goto out_dput;
48480+ }
48481+
48482 error = mnt_want_write(nd.path.mnt);
48483 if (error)
48484 goto out_dput;
48485@@ -3012,6 +3154,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
48486 if (error)
48487 goto out_drop_write;
48488 error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
48489+ if (!error)
48490+ gr_handle_create(new_dentry, nd.path.mnt);
48491 out_drop_write:
48492 mnt_drop_write(nd.path.mnt);
48493 out_dput:
48494@@ -3189,6 +3333,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
48495 char *to;
48496 int error;
48497
48498+ pax_track_stack();
48499+
48500 error = user_path_parent(olddfd, oldname, &oldnd, &from);
48501 if (error)
48502 goto exit;
48503@@ -3245,6 +3391,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
48504 if (new_dentry == trap)
48505 goto exit5;
48506
48507+ error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
48508+ old_dentry, old_dir->d_inode, oldnd.path.mnt,
48509+ to);
48510+ if (error)
48511+ goto exit5;
48512+
48513 error = mnt_want_write(oldnd.path.mnt);
48514 if (error)
48515 goto exit5;
48516@@ -3254,6 +3406,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
48517 goto exit6;
48518 error = vfs_rename(old_dir->d_inode, old_dentry,
48519 new_dir->d_inode, new_dentry);
48520+ if (!error)
48521+ gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
48522+ new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
48523 exit6:
48524 mnt_drop_write(oldnd.path.mnt);
48525 exit5:
48526@@ -3279,6 +3434,8 @@ SYSCALL_DEFINE2(rename, const char __use
48527
48528 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
48529 {
48530+ char tmpbuf[64];
48531+ const char *newlink;
48532 int len;
48533
48534 len = PTR_ERR(link);
48535@@ -3288,7 +3445,14 @@ int vfs_readlink(struct dentry *dentry,
48536 len = strlen(link);
48537 if (len > (unsigned) buflen)
48538 len = buflen;
48539- if (copy_to_user(buffer, link, len))
48540+
48541+ if (len < sizeof(tmpbuf)) {
48542+ memcpy(tmpbuf, link, len);
48543+ newlink = tmpbuf;
48544+ } else
48545+ newlink = link;
48546+
48547+ if (copy_to_user(buffer, newlink, len))
48548 len = -EFAULT;
48549 out:
48550 return len;
48551diff -urNp linux-2.6.39.1/fs/namespace.c linux-2.6.39.1/fs/namespace.c
48552--- linux-2.6.39.1/fs/namespace.c 2011-05-19 00:06:34.000000000 -0400
48553+++ linux-2.6.39.1/fs/namespace.c 2011-05-22 20:43:58.000000000 -0400
48554@@ -1328,6 +1328,9 @@ static int do_umount(struct vfsmount *mn
48555 if (!(sb->s_flags & MS_RDONLY))
48556 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
48557 up_write(&sb->s_umount);
48558+
48559+ gr_log_remount(mnt->mnt_devname, retval);
48560+
48561 return retval;
48562 }
48563
48564@@ -1347,6 +1350,9 @@ static int do_umount(struct vfsmount *mn
48565 br_write_unlock(vfsmount_lock);
48566 up_write(&namespace_sem);
48567 release_mounts(&umount_list);
48568+
48569+ gr_log_unmount(mnt->mnt_devname, retval);
48570+
48571 return retval;
48572 }
48573
48574@@ -2338,6 +2344,16 @@ long do_mount(char *dev_name, char *dir_
48575 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
48576 MS_STRICTATIME);
48577
48578+ if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
48579+ retval = -EPERM;
48580+ goto dput_out;
48581+ }
48582+
48583+ if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
48584+ retval = -EPERM;
48585+ goto dput_out;
48586+ }
48587+
48588 if (flags & MS_REMOUNT)
48589 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
48590 data_page);
48591@@ -2352,6 +2368,9 @@ long do_mount(char *dev_name, char *dir_
48592 dev_name, data_page);
48593 dput_out:
48594 path_put(&path);
48595+
48596+ gr_log_mount(dev_name, dir_name, retval);
48597+
48598 return retval;
48599 }
48600
48601@@ -2575,6 +2594,11 @@ SYSCALL_DEFINE2(pivot_root, const char _
48602 if (error)
48603 goto out2;
48604
48605+ if (gr_handle_chroot_pivot()) {
48606+ error = -EPERM;
48607+ goto out2;
48608+ }
48609+
48610 get_fs_root(current->fs, &root);
48611 error = lock_mount(&old);
48612 if (error)
48613diff -urNp linux-2.6.39.1/fs/ncpfs/dir.c linux-2.6.39.1/fs/ncpfs/dir.c
48614--- linux-2.6.39.1/fs/ncpfs/dir.c 2011-05-19 00:06:34.000000000 -0400
48615+++ linux-2.6.39.1/fs/ncpfs/dir.c 2011-05-22 19:36:32.000000000 -0400
48616@@ -299,6 +299,8 @@ ncp_lookup_validate(struct dentry *dentr
48617 int res, val = 0, len;
48618 __u8 __name[NCP_MAXPATHLEN + 1];
48619
48620+ pax_track_stack();
48621+
48622 if (dentry == dentry->d_sb->s_root)
48623 return 1;
48624
48625@@ -844,6 +846,8 @@ static struct dentry *ncp_lookup(struct
48626 int error, res, len;
48627 __u8 __name[NCP_MAXPATHLEN + 1];
48628
48629+ pax_track_stack();
48630+
48631 error = -EIO;
48632 if (!ncp_conn_valid(server))
48633 goto finished;
48634@@ -931,6 +935,8 @@ int ncp_create_new(struct inode *dir, st
48635 PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
48636 dentry->d_parent->d_name.name, dentry->d_name.name, mode);
48637
48638+ pax_track_stack();
48639+
48640 ncp_age_dentry(server, dentry);
48641 len = sizeof(__name);
48642 error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
48643@@ -992,6 +998,8 @@ static int ncp_mkdir(struct inode *dir,
48644 int error, len;
48645 __u8 __name[NCP_MAXPATHLEN + 1];
48646
48647+ pax_track_stack();
48648+
48649 DPRINTK("ncp_mkdir: making %s/%s\n",
48650 dentry->d_parent->d_name.name, dentry->d_name.name);
48651
48652@@ -1135,6 +1143,8 @@ static int ncp_rename(struct inode *old_
48653 int old_len, new_len;
48654 __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
48655
48656+ pax_track_stack();
48657+
48658 DPRINTK("ncp_rename: %s/%s to %s/%s\n",
48659 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
48660 new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
48661diff -urNp linux-2.6.39.1/fs/ncpfs/inode.c linux-2.6.39.1/fs/ncpfs/inode.c
48662--- linux-2.6.39.1/fs/ncpfs/inode.c 2011-05-19 00:06:34.000000000 -0400
48663+++ linux-2.6.39.1/fs/ncpfs/inode.c 2011-05-22 19:36:32.000000000 -0400
48664@@ -461,6 +461,8 @@ static int ncp_fill_super(struct super_b
48665 #endif
48666 struct ncp_entry_info finfo;
48667
48668+ pax_track_stack();
48669+
48670 data.wdog_pid = NULL;
48671 server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
48672 if (!server)
48673diff -urNp linux-2.6.39.1/fs/nfs/inode.c linux-2.6.39.1/fs/nfs/inode.c
48674--- linux-2.6.39.1/fs/nfs/inode.c 2011-05-19 00:06:34.000000000 -0400
48675+++ linux-2.6.39.1/fs/nfs/inode.c 2011-05-22 19:36:32.000000000 -0400
48676@@ -999,16 +999,16 @@ static int nfs_size_need_update(const st
48677 return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
48678 }
48679
48680-static atomic_long_t nfs_attr_generation_counter;
48681+static atomic_long_unchecked_t nfs_attr_generation_counter;
48682
48683 static unsigned long nfs_read_attr_generation_counter(void)
48684 {
48685- return atomic_long_read(&nfs_attr_generation_counter);
48686+ return atomic_long_read_unchecked(&nfs_attr_generation_counter);
48687 }
48688
48689 unsigned long nfs_inc_attr_generation_counter(void)
48690 {
48691- return atomic_long_inc_return(&nfs_attr_generation_counter);
48692+ return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
48693 }
48694
48695 void nfs_fattr_init(struct nfs_fattr *fattr)
48696diff -urNp linux-2.6.39.1/fs/nfs/nfs4proc.c linux-2.6.39.1/fs/nfs/nfs4proc.c
48697--- linux-2.6.39.1/fs/nfs/nfs4proc.c 2011-06-03 00:04:14.000000000 -0400
48698+++ linux-2.6.39.1/fs/nfs/nfs4proc.c 2011-06-03 00:32:07.000000000 -0400
48699@@ -5845,14 +5845,14 @@ struct nfs4_state_recovery_ops nfs41_nog
48700 };
48701 #endif /* CONFIG_NFS_V4_1 */
48702
48703-struct nfs4_state_maintenance_ops nfs40_state_renewal_ops = {
48704+const struct nfs4_state_maintenance_ops nfs40_state_renewal_ops = {
48705 .sched_state_renewal = nfs4_proc_async_renew,
48706 .get_state_renewal_cred_locked = nfs4_get_renew_cred_locked,
48707 .renew_lease = nfs4_proc_renew,
48708 };
48709
48710 #if defined(CONFIG_NFS_V4_1)
48711-struct nfs4_state_maintenance_ops nfs41_state_renewal_ops = {
48712+const struct nfs4_state_maintenance_ops nfs41_state_renewal_ops = {
48713 .sched_state_renewal = nfs41_proc_async_sequence,
48714 .get_state_renewal_cred_locked = nfs4_get_machine_cred_locked,
48715 .renew_lease = nfs4_proc_sequence,
48716diff -urNp linux-2.6.39.1/fs/nfsd/lockd.c linux-2.6.39.1/fs/nfsd/lockd.c
48717--- linux-2.6.39.1/fs/nfsd/lockd.c 2011-05-19 00:06:34.000000000 -0400
48718+++ linux-2.6.39.1/fs/nfsd/lockd.c 2011-05-22 19:36:32.000000000 -0400
48719@@ -60,7 +60,7 @@ nlm_fclose(struct file *filp)
48720 fput(filp);
48721 }
48722
48723-static struct nlmsvc_binding nfsd_nlm_ops = {
48724+static const struct nlmsvc_binding nfsd_nlm_ops = {
48725 .fopen = nlm_fopen, /* open file for locking */
48726 .fclose = nlm_fclose, /* close file */
48727 };
48728diff -urNp linux-2.6.39.1/fs/nfsd/nfs4state.c linux-2.6.39.1/fs/nfsd/nfs4state.c
48729--- linux-2.6.39.1/fs/nfsd/nfs4state.c 2011-05-19 00:06:34.000000000 -0400
48730+++ linux-2.6.39.1/fs/nfsd/nfs4state.c 2011-05-22 19:36:32.000000000 -0400
48731@@ -3784,6 +3784,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
48732 unsigned int strhashval;
48733 int err;
48734
48735+ pax_track_stack();
48736+
48737 dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
48738 (long long) lock->lk_offset,
48739 (long long) lock->lk_length);
48740diff -urNp linux-2.6.39.1/fs/nfsd/nfs4xdr.c linux-2.6.39.1/fs/nfsd/nfs4xdr.c
48741--- linux-2.6.39.1/fs/nfsd/nfs4xdr.c 2011-05-19 00:06:34.000000000 -0400
48742+++ linux-2.6.39.1/fs/nfsd/nfs4xdr.c 2011-05-22 19:36:32.000000000 -0400
48743@@ -1793,6 +1793,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, s
48744 .dentry = dentry,
48745 };
48746
48747+ pax_track_stack();
48748+
48749 BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
48750 BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
48751 BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
48752diff -urNp linux-2.6.39.1/fs/nfsd/nfsctl.c linux-2.6.39.1/fs/nfsd/nfsctl.c
48753--- linux-2.6.39.1/fs/nfsd/nfsctl.c 2011-05-19 00:06:34.000000000 -0400
48754+++ linux-2.6.39.1/fs/nfsd/nfsctl.c 2011-05-22 19:36:32.000000000 -0400
48755@@ -182,7 +182,7 @@ static int export_features_open(struct i
48756 return single_open(file, export_features_show, NULL);
48757 }
48758
48759-static struct file_operations export_features_operations = {
48760+static const struct file_operations export_features_operations = {
48761 .open = export_features_open,
48762 .read = seq_read,
48763 .llseek = seq_lseek,
48764diff -urNp linux-2.6.39.1/fs/nfsd/vfs.c linux-2.6.39.1/fs/nfsd/vfs.c
48765--- linux-2.6.39.1/fs/nfsd/vfs.c 2011-05-19 00:06:34.000000000 -0400
48766+++ linux-2.6.39.1/fs/nfsd/vfs.c 2011-05-22 19:36:32.000000000 -0400
48767@@ -898,7 +898,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
48768 } else {
48769 oldfs = get_fs();
48770 set_fs(KERNEL_DS);
48771- host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
48772+ host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset);
48773 set_fs(oldfs);
48774 }
48775
48776@@ -1002,7 +1002,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
48777
48778 /* Write the data. */
48779 oldfs = get_fs(); set_fs(KERNEL_DS);
48780- host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
48781+ host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset);
48782 set_fs(oldfs);
48783 if (host_err < 0)
48784 goto out_nfserr;
48785@@ -1525,7 +1525,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
48786 */
48787
48788 oldfs = get_fs(); set_fs(KERNEL_DS);
48789- host_err = inode->i_op->readlink(dentry, buf, *lenp);
48790+ host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp);
48791 set_fs(oldfs);
48792
48793 if (host_err < 0)
48794diff -urNp linux-2.6.39.1/fs/nilfs2/segment.c linux-2.6.39.1/fs/nilfs2/segment.c
48795--- linux-2.6.39.1/fs/nilfs2/segment.c 2011-05-19 00:06:34.000000000 -0400
48796+++ linux-2.6.39.1/fs/nilfs2/segment.c 2011-05-22 19:36:32.000000000 -0400
48797@@ -555,7 +555,7 @@ static void nilfs_write_file_node_binfo(
48798 *vblocknr = binfo->bi_v.bi_vblocknr;
48799 }
48800
48801-static struct nilfs_sc_operations nilfs_sc_file_ops = {
48802+static const struct nilfs_sc_operations nilfs_sc_file_ops = {
48803 .collect_data = nilfs_collect_file_data,
48804 .collect_node = nilfs_collect_file_node,
48805 .collect_bmap = nilfs_collect_file_bmap,
48806@@ -604,7 +604,7 @@ static void nilfs_write_dat_node_binfo(s
48807 *binfo_dat = binfo->bi_dat;
48808 }
48809
48810-static struct nilfs_sc_operations nilfs_sc_dat_ops = {
48811+static const struct nilfs_sc_operations nilfs_sc_dat_ops = {
48812 .collect_data = nilfs_collect_dat_data,
48813 .collect_node = nilfs_collect_file_node,
48814 .collect_bmap = nilfs_collect_dat_bmap,
48815@@ -612,7 +612,7 @@ static struct nilfs_sc_operations nilfs_
48816 .write_node_binfo = nilfs_write_dat_node_binfo,
48817 };
48818
48819-static struct nilfs_sc_operations nilfs_sc_dsync_ops = {
48820+static const struct nilfs_sc_operations nilfs_sc_dsync_ops = {
48821 .collect_data = nilfs_collect_file_data,
48822 .collect_node = NULL,
48823 .collect_bmap = NULL,
48824@@ -971,7 +971,7 @@ static size_t nilfs_segctor_buffer_rest(
48825
48826 static int nilfs_segctor_scan_file(struct nilfs_sc_info *sci,
48827 struct inode *inode,
48828- struct nilfs_sc_operations *sc_ops)
48829+ const struct nilfs_sc_operations *sc_ops)
48830 {
48831 LIST_HEAD(data_buffers);
48832 LIST_HEAD(node_buffers);
48833@@ -1475,7 +1475,7 @@ nilfs_segctor_update_payload_blocknr(str
48834 sector_t blocknr;
48835 unsigned long nfinfo = segbuf->sb_sum.nfinfo;
48836 unsigned long nblocks = 0, ndatablk = 0;
48837- struct nilfs_sc_operations *sc_op = NULL;
48838+ const struct nilfs_sc_operations *sc_op = NULL;
48839 struct nilfs_segsum_pointer ssp;
48840 struct nilfs_finfo *finfo = NULL;
48841 union nilfs_binfo binfo;
48842diff -urNp linux-2.6.39.1/fs/notify/dnotify/dnotify.c linux-2.6.39.1/fs/notify/dnotify/dnotify.c
48843--- linux-2.6.39.1/fs/notify/dnotify/dnotify.c 2011-05-19 00:06:34.000000000 -0400
48844+++ linux-2.6.39.1/fs/notify/dnotify/dnotify.c 2011-05-22 19:36:32.000000000 -0400
48845@@ -151,7 +151,7 @@ static void dnotify_free_mark(struct fsn
48846 kmem_cache_free(dnotify_mark_cache, dn_mark);
48847 }
48848
48849-static struct fsnotify_ops dnotify_fsnotify_ops = {
48850+static const struct fsnotify_ops dnotify_fsnotify_ops = {
48851 .handle_event = dnotify_handle_event,
48852 .should_send_event = dnotify_should_send_event,
48853 .free_group_priv = NULL,
48854diff -urNp linux-2.6.39.1/fs/notify/notification.c linux-2.6.39.1/fs/notify/notification.c
48855--- linux-2.6.39.1/fs/notify/notification.c 2011-05-19 00:06:34.000000000 -0400
48856+++ linux-2.6.39.1/fs/notify/notification.c 2011-05-22 19:36:32.000000000 -0400
48857@@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event
48858 * get set to 0 so it will never get 'freed'
48859 */
48860 static struct fsnotify_event *q_overflow_event;
48861-static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
48862+static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
48863
48864 /**
48865 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
48866@@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = A
48867 */
48868 u32 fsnotify_get_cookie(void)
48869 {
48870- return atomic_inc_return(&fsnotify_sync_cookie);
48871+ return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
48872 }
48873 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
48874
48875diff -urNp linux-2.6.39.1/fs/ntfs/dir.c linux-2.6.39.1/fs/ntfs/dir.c
48876--- linux-2.6.39.1/fs/ntfs/dir.c 2011-05-19 00:06:34.000000000 -0400
48877+++ linux-2.6.39.1/fs/ntfs/dir.c 2011-05-22 19:36:32.000000000 -0400
48878@@ -1329,7 +1329,7 @@ find_next_index_buffer:
48879 ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
48880 ~(s64)(ndir->itype.index.block_size - 1)));
48881 /* Bounds checks. */
48882- if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
48883+ if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
48884 ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
48885 "inode 0x%lx or driver bug.", vdir->i_ino);
48886 goto err_out;
48887diff -urNp linux-2.6.39.1/fs/ntfs/file.c linux-2.6.39.1/fs/ntfs/file.c
48888--- linux-2.6.39.1/fs/ntfs/file.c 2011-05-19 00:06:34.000000000 -0400
48889+++ linux-2.6.39.1/fs/ntfs/file.c 2011-05-22 19:36:32.000000000 -0400
48890@@ -2222,6 +2222,6 @@ const struct inode_operations ntfs_file_
48891 #endif /* NTFS_RW */
48892 };
48893
48894-const struct file_operations ntfs_empty_file_ops = {};
48895+const struct file_operations ntfs_empty_file_ops __read_only;
48896
48897-const struct inode_operations ntfs_empty_inode_ops = {};
48898+const struct inode_operations ntfs_empty_inode_ops __read_only;
48899diff -urNp linux-2.6.39.1/fs/ocfs2/cluster/heartbeat.c linux-2.6.39.1/fs/ocfs2/cluster/heartbeat.c
48900--- linux-2.6.39.1/fs/ocfs2/cluster/heartbeat.c 2011-05-19 00:06:34.000000000 -0400
48901+++ linux-2.6.39.1/fs/ocfs2/cluster/heartbeat.c 2011-05-22 19:36:32.000000000 -0400
48902@@ -2261,7 +2261,7 @@ static struct configfs_item_operations o
48903 .store_attribute = o2hb_heartbeat_group_store,
48904 };
48905
48906-static struct configfs_group_operations o2hb_heartbeat_group_group_ops = {
48907+static const struct configfs_group_operations o2hb_heartbeat_group_group_ops = {
48908 .make_item = o2hb_heartbeat_group_make_item,
48909 .drop_item = o2hb_heartbeat_group_drop_item,
48910 };
48911diff -urNp linux-2.6.39.1/fs/ocfs2/cluster/nodemanager.c linux-2.6.39.1/fs/ocfs2/cluster/nodemanager.c
48912--- linux-2.6.39.1/fs/ocfs2/cluster/nodemanager.c 2011-05-19 00:06:34.000000000 -0400
48913+++ linux-2.6.39.1/fs/ocfs2/cluster/nodemanager.c 2011-05-22 19:36:32.000000000 -0400
48914@@ -752,7 +752,7 @@ static void o2nm_node_group_drop_item(st
48915 config_item_put(item);
48916 }
48917
48918-static struct configfs_group_operations o2nm_node_group_group_ops = {
48919+static const struct configfs_group_operations o2nm_node_group_group_ops = {
48920 .make_item = o2nm_node_group_make_item,
48921 .drop_item = o2nm_node_group_drop_item,
48922 };
48923@@ -869,7 +869,7 @@ static void o2nm_cluster_group_drop_item
48924 config_item_put(item);
48925 }
48926
48927-static struct configfs_group_operations o2nm_cluster_group_group_ops = {
48928+static const struct configfs_group_operations o2nm_cluster_group_group_ops = {
48929 .make_group = o2nm_cluster_group_make_group,
48930 .drop_item = o2nm_cluster_group_drop_item,
48931 };
48932diff -urNp linux-2.6.39.1/fs/ocfs2/localalloc.c linux-2.6.39.1/fs/ocfs2/localalloc.c
48933--- linux-2.6.39.1/fs/ocfs2/localalloc.c 2011-05-19 00:06:34.000000000 -0400
48934+++ linux-2.6.39.1/fs/ocfs2/localalloc.c 2011-05-22 19:36:32.000000000 -0400
48935@@ -1283,7 +1283,7 @@ static int ocfs2_local_alloc_slide_windo
48936 goto bail;
48937 }
48938
48939- atomic_inc(&osb->alloc_stats.moves);
48940+ atomic_inc_unchecked(&osb->alloc_stats.moves);
48941
48942 bail:
48943 if (handle)
48944diff -urNp linux-2.6.39.1/fs/ocfs2/namei.c linux-2.6.39.1/fs/ocfs2/namei.c
48945--- linux-2.6.39.1/fs/ocfs2/namei.c 2011-05-19 00:06:34.000000000 -0400
48946+++ linux-2.6.39.1/fs/ocfs2/namei.c 2011-05-22 19:36:32.000000000 -0400
48947@@ -1063,6 +1063,8 @@ static int ocfs2_rename(struct inode *ol
48948 struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
48949 struct ocfs2_dir_lookup_result target_insert = { NULL, };
48950
48951+ pax_track_stack();
48952+
48953 /* At some point it might be nice to break this function up a
48954 * bit. */
48955
48956diff -urNp linux-2.6.39.1/fs/ocfs2/ocfs2.h linux-2.6.39.1/fs/ocfs2/ocfs2.h
48957--- linux-2.6.39.1/fs/ocfs2/ocfs2.h 2011-05-19 00:06:34.000000000 -0400
48958+++ linux-2.6.39.1/fs/ocfs2/ocfs2.h 2011-05-22 19:36:32.000000000 -0400
48959@@ -235,11 +235,11 @@ enum ocfs2_vol_state
48960
48961 struct ocfs2_alloc_stats
48962 {
48963- atomic_t moves;
48964- atomic_t local_data;
48965- atomic_t bitmap_data;
48966- atomic_t bg_allocs;
48967- atomic_t bg_extends;
48968+ atomic_unchecked_t moves;
48969+ atomic_unchecked_t local_data;
48970+ atomic_unchecked_t bitmap_data;
48971+ atomic_unchecked_t bg_allocs;
48972+ atomic_unchecked_t bg_extends;
48973 };
48974
48975 enum ocfs2_local_alloc_state
48976diff -urNp linux-2.6.39.1/fs/ocfs2/stackglue.h linux-2.6.39.1/fs/ocfs2/stackglue.h
48977--- linux-2.6.39.1/fs/ocfs2/stackglue.h 2011-05-19 00:06:34.000000000 -0400
48978+++ linux-2.6.39.1/fs/ocfs2/stackglue.h 2011-05-22 19:36:32.000000000 -0400
48979@@ -221,13 +221,13 @@ struct ocfs2_stack_operations {
48980 };
48981
48982 /*
48983- * Each stack plugin must describe itself by registering a
48984+ * Each stack plugin must describe itself by registerin const g a
48985 * ocfs2_stack_plugin structure. This is only seen by stackglue and the
48986 * stack driver.
48987 */
48988 struct ocfs2_stack_plugin {
48989 char *sp_name;
48990- struct ocfs2_stack_operations *sp_ops;
48991+ const struct ocfs2_stack_operations *sp_ops;
48992 struct module *sp_owner;
48993
48994 /* These are managed by the stackglue code. */
48995diff -urNp linux-2.6.39.1/fs/ocfs2/stack_o2cb.c linux-2.6.39.1/fs/ocfs2/stack_o2cb.c
48996--- linux-2.6.39.1/fs/ocfs2/stack_o2cb.c 2011-05-19 00:06:34.000000000 -0400
48997+++ linux-2.6.39.1/fs/ocfs2/stack_o2cb.c 2011-05-22 19:36:32.000000000 -0400
48998@@ -358,7 +358,7 @@ static int o2cb_cluster_this_node(unsign
48999 return 0;
49000 }
49001
49002-static struct ocfs2_stack_operations o2cb_stack_ops = {
49003+static const struct ocfs2_stack_operations o2cb_stack_ops = {
49004 .connect = o2cb_cluster_connect,
49005 .disconnect = o2cb_cluster_disconnect,
49006 .this_node = o2cb_cluster_this_node,
49007@@ -369,7 +369,6 @@ static struct ocfs2_stack_operations o2c
49008 .lock_lvb = o2cb_dlm_lvb,
49009 .dump_lksb = o2cb_dump_lksb,
49010 };
49011-
49012 static struct ocfs2_stack_plugin o2cb_stack = {
49013 .sp_name = "o2cb",
49014 .sp_ops = &o2cb_stack_ops,
49015diff -urNp linux-2.6.39.1/fs/ocfs2/stack_user.c linux-2.6.39.1/fs/ocfs2/stack_user.c
49016--- linux-2.6.39.1/fs/ocfs2/stack_user.c 2011-05-19 00:06:34.000000000 -0400
49017+++ linux-2.6.39.1/fs/ocfs2/stack_user.c 2011-05-22 19:36:32.000000000 -0400
49018@@ -399,7 +399,7 @@ static int ocfs2_control_do_setversion_m
49019 long major, minor;
49020 char *ptr = NULL;
49021 struct ocfs2_control_private *p = file->private_data;
49022- struct ocfs2_protocol_version *max =
49023+ const struct ocfs2_protocol_version *max =
49024 &ocfs2_user_plugin.sp_max_proto;
49025
49026 if (ocfs2_control_get_handshake_state(file) !=
49027@@ -861,7 +861,7 @@ static int user_cluster_this_node(unsign
49028 return 0;
49029 }
49030
49031-static struct ocfs2_stack_operations ocfs2_user_plugin_ops = {
49032+static const struct ocfs2_stack_operations ocfs2_user_plugin_ops = {
49033 .connect = user_cluster_connect,
49034 .disconnect = user_cluster_disconnect,
49035 .this_node = user_cluster_this_node,
49036diff -urNp linux-2.6.39.1/fs/ocfs2/suballoc.c linux-2.6.39.1/fs/ocfs2/suballoc.c
49037--- linux-2.6.39.1/fs/ocfs2/suballoc.c 2011-05-19 00:06:34.000000000 -0400
49038+++ linux-2.6.39.1/fs/ocfs2/suballoc.c 2011-05-22 19:36:32.000000000 -0400
49039@@ -872,7 +872,7 @@ static int ocfs2_reserve_suballoc_bits(s
49040 mlog_errno(status);
49041 goto bail;
49042 }
49043- atomic_inc(&osb->alloc_stats.bg_extends);
49044+ atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
49045
49046 /* You should never ask for this much metadata */
49047 BUG_ON(bits_wanted >
49048@@ -2008,7 +2008,7 @@ int ocfs2_claim_metadata(handle_t *handl
49049 mlog_errno(status);
49050 goto bail;
49051 }
49052- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49053+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49054
49055 *suballoc_loc = res.sr_bg_blkno;
49056 *suballoc_bit_start = res.sr_bit_offset;
49057@@ -2172,7 +2172,7 @@ int ocfs2_claim_new_inode_at_loc(handle_
49058 trace_ocfs2_claim_new_inode_at_loc((unsigned long long)di_blkno,
49059 res->sr_bits);
49060
49061- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49062+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49063
49064 BUG_ON(res->sr_bits != 1);
49065
49066@@ -2214,7 +2214,7 @@ int ocfs2_claim_new_inode(handle_t *hand
49067 mlog_errno(status);
49068 goto bail;
49069 }
49070- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49071+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
49072
49073 BUG_ON(res.sr_bits != 1);
49074
49075@@ -2318,7 +2318,7 @@ int __ocfs2_claim_clusters(handle_t *han
49076 cluster_start,
49077 num_clusters);
49078 if (!status)
49079- atomic_inc(&osb->alloc_stats.local_data);
49080+ atomic_inc_unchecked(&osb->alloc_stats.local_data);
49081 } else {
49082 if (min_clusters > (osb->bitmap_cpg - 1)) {
49083 /* The only paths asking for contiguousness
49084@@ -2344,7 +2344,7 @@ int __ocfs2_claim_clusters(handle_t *han
49085 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
49086 res.sr_bg_blkno,
49087 res.sr_bit_offset);
49088- atomic_inc(&osb->alloc_stats.bitmap_data);
49089+ atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
49090 *num_clusters = res.sr_bits;
49091 }
49092 }
49093diff -urNp linux-2.6.39.1/fs/ocfs2/super.c linux-2.6.39.1/fs/ocfs2/super.c
49094--- linux-2.6.39.1/fs/ocfs2/super.c 2011-05-19 00:06:34.000000000 -0400
49095+++ linux-2.6.39.1/fs/ocfs2/super.c 2011-05-22 19:36:32.000000000 -0400
49096@@ -299,11 +299,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
49097 "%10s => GlobalAllocs: %d LocalAllocs: %d "
49098 "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
49099 "Stats",
49100- atomic_read(&osb->alloc_stats.bitmap_data),
49101- atomic_read(&osb->alloc_stats.local_data),
49102- atomic_read(&osb->alloc_stats.bg_allocs),
49103- atomic_read(&osb->alloc_stats.moves),
49104- atomic_read(&osb->alloc_stats.bg_extends));
49105+ atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
49106+ atomic_read_unchecked(&osb->alloc_stats.local_data),
49107+ atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
49108+ atomic_read_unchecked(&osb->alloc_stats.moves),
49109+ atomic_read_unchecked(&osb->alloc_stats.bg_extends));
49110
49111 out += snprintf(buf + out, len - out,
49112 "%10s => State: %u Descriptor: %llu Size: %u bits "
49113@@ -2111,11 +2111,11 @@ static int ocfs2_initialize_super(struct
49114 spin_lock_init(&osb->osb_xattr_lock);
49115 ocfs2_init_steal_slots(osb);
49116
49117- atomic_set(&osb->alloc_stats.moves, 0);
49118- atomic_set(&osb->alloc_stats.local_data, 0);
49119- atomic_set(&osb->alloc_stats.bitmap_data, 0);
49120- atomic_set(&osb->alloc_stats.bg_allocs, 0);
49121- atomic_set(&osb->alloc_stats.bg_extends, 0);
49122+ atomic_set_unchecked(&osb->alloc_stats.moves, 0);
49123+ atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
49124+ atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
49125+ atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
49126+ atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
49127
49128 /* Copy the blockcheck stats from the superblock probe */
49129 osb->osb_ecc_stats = *stats;
49130diff -urNp linux-2.6.39.1/fs/ocfs2/symlink.c linux-2.6.39.1/fs/ocfs2/symlink.c
49131--- linux-2.6.39.1/fs/ocfs2/symlink.c 2011-05-19 00:06:34.000000000 -0400
49132+++ linux-2.6.39.1/fs/ocfs2/symlink.c 2011-05-22 19:36:32.000000000 -0400
49133@@ -142,7 +142,7 @@ bail:
49134
49135 static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
49136 {
49137- char *link = nd_get_link(nd);
49138+ const char *link = nd_get_link(nd);
49139 if (!IS_ERR(link))
49140 kfree(link);
49141 }
49142diff -urNp linux-2.6.39.1/fs/open.c linux-2.6.39.1/fs/open.c
49143--- linux-2.6.39.1/fs/open.c 2011-05-19 00:06:34.000000000 -0400
49144+++ linux-2.6.39.1/fs/open.c 2011-05-22 20:46:51.000000000 -0400
49145@@ -112,6 +112,10 @@ static long do_sys_truncate(const char _
49146 error = locks_verify_truncate(inode, NULL, length);
49147 if (!error)
49148 error = security_path_truncate(&path);
49149+
49150+ if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
49151+ error = -EACCES;
49152+
49153 if (!error)
49154 error = do_truncate(path.dentry, length, 0, NULL);
49155
49156@@ -358,6 +362,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
49157 if (__mnt_is_readonly(path.mnt))
49158 res = -EROFS;
49159
49160+ if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
49161+ res = -EACCES;
49162+
49163 out_path_release:
49164 path_put(&path);
49165 out:
49166@@ -384,6 +391,8 @@ SYSCALL_DEFINE1(chdir, const char __user
49167 if (error)
49168 goto dput_and_out;
49169
49170+ gr_log_chdir(path.dentry, path.mnt);
49171+
49172 set_fs_pwd(current->fs, &path);
49173
49174 dput_and_out:
49175@@ -410,6 +419,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
49176 goto out_putf;
49177
49178 error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
49179+
49180+ if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
49181+ error = -EPERM;
49182+
49183+ if (!error)
49184+ gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
49185+
49186 if (!error)
49187 set_fs_pwd(current->fs, &file->f_path);
49188 out_putf:
49189@@ -438,7 +454,18 @@ SYSCALL_DEFINE1(chroot, const char __use
49190 if (error)
49191 goto dput_and_out;
49192
49193+ if (gr_handle_chroot_chroot(path.dentry, path.mnt))
49194+ goto dput_and_out;
49195+
49196+ if (gr_handle_chroot_caps(&path)) {
49197+ error = -ENOMEM;
49198+ goto dput_and_out;
49199+ }
49200+
49201 set_fs_root(current->fs, &path);
49202+
49203+ gr_handle_chroot_chdir(&path);
49204+
49205 error = 0;
49206 dput_and_out:
49207 path_put(&path);
49208@@ -466,12 +493,25 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
49209 err = mnt_want_write_file(file);
49210 if (err)
49211 goto out_putf;
49212+
49213 mutex_lock(&inode->i_mutex);
49214+
49215+ if (!gr_acl_handle_fchmod(dentry, file->f_vfsmnt, mode)) {
49216+ err = -EACCES;
49217+ goto out_unlock;
49218+ }
49219+
49220 err = security_path_chmod(dentry, file->f_vfsmnt, mode);
49221 if (err)
49222 goto out_unlock;
49223 if (mode == (mode_t) -1)
49224 mode = inode->i_mode;
49225+
49226+ if (gr_handle_chroot_chmod(dentry, file->f_vfsmnt, mode)) {
49227+ err = -EACCES;
49228+ goto out_unlock;
49229+ }
49230+
49231 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
49232 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
49233 err = notify_change(dentry, &newattrs);
49234@@ -499,12 +539,25 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
49235 error = mnt_want_write(path.mnt);
49236 if (error)
49237 goto dput_and_out;
49238+
49239 mutex_lock(&inode->i_mutex);
49240+
49241+ if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
49242+ error = -EACCES;
49243+ goto out_unlock;
49244+ }
49245+
49246 error = security_path_chmod(path.dentry, path.mnt, mode);
49247 if (error)
49248 goto out_unlock;
49249 if (mode == (mode_t) -1)
49250 mode = inode->i_mode;
49251+
49252+ if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
49253+ error = -EACCES;
49254+ goto out_unlock;
49255+ }
49256+
49257 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
49258 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
49259 error = notify_change(path.dentry, &newattrs);
49260@@ -528,6 +581,9 @@ static int chown_common(struct path *pat
49261 int error;
49262 struct iattr newattrs;
49263
49264+ if (!gr_acl_handle_chown(path->dentry, path->mnt))
49265+ return -EACCES;
49266+
49267 newattrs.ia_valid = ATTR_CTIME;
49268 if (user != (uid_t) -1) {
49269 newattrs.ia_valid |= ATTR_UID;
49270@@ -998,7 +1054,10 @@ long do_sys_open(int dfd, const char __u
49271 if (!IS_ERR(tmp)) {
49272 fd = get_unused_fd_flags(flags);
49273 if (fd >= 0) {
49274- struct file *f = do_filp_open(dfd, tmp, &op, lookup);
49275+ struct file *f;
49276+ /* don't allow to be set by userland */
49277+ flags &= ~FMODE_GREXEC;
49278+ f = do_filp_open(dfd, tmp, &op, lookup);
49279 if (IS_ERR(f)) {
49280 put_unused_fd(fd);
49281 fd = PTR_ERR(f);
49282diff -urNp linux-2.6.39.1/fs/partitions/ldm.c linux-2.6.39.1/fs/partitions/ldm.c
49283--- linux-2.6.39.1/fs/partitions/ldm.c 2011-06-03 00:04:14.000000000 -0400
49284+++ linux-2.6.39.1/fs/partitions/ldm.c 2011-06-03 00:32:07.000000000 -0400
49285@@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data
49286 ldm_error ("A VBLK claims to have %d parts.", num);
49287 return false;
49288 }
49289+
49290 if (rec >= num) {
49291 ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
49292 return false;
49293@@ -1322,7 +1323,7 @@ static bool ldm_frag_add (const u8 *data
49294 goto found;
49295 }
49296
49297- f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
49298+ f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
49299 if (!f) {
49300 ldm_crit ("Out of memory.");
49301 return false;
49302diff -urNp linux-2.6.39.1/fs/pipe.c linux-2.6.39.1/fs/pipe.c
49303--- linux-2.6.39.1/fs/pipe.c 2011-05-19 00:06:34.000000000 -0400
49304+++ linux-2.6.39.1/fs/pipe.c 2011-05-22 19:41:37.000000000 -0400
49305@@ -420,9 +420,9 @@ redo:
49306 }
49307 if (bufs) /* More to do? */
49308 continue;
49309- if (!pipe->writers)
49310+ if (!atomic_read(&pipe->writers))
49311 break;
49312- if (!pipe->waiting_writers) {
49313+ if (!atomic_read(&pipe->waiting_writers)) {
49314 /* syscall merging: Usually we must not sleep
49315 * if O_NONBLOCK is set, or if we got some data.
49316 * But if a writer sleeps in kernel space, then
49317@@ -481,7 +481,7 @@ pipe_write(struct kiocb *iocb, const str
49318 mutex_lock(&inode->i_mutex);
49319 pipe = inode->i_pipe;
49320
49321- if (!pipe->readers) {
49322+ if (!atomic_read(&pipe->readers)) {
49323 send_sig(SIGPIPE, current, 0);
49324 ret = -EPIPE;
49325 goto out;
49326@@ -530,7 +530,7 @@ redo1:
49327 for (;;) {
49328 int bufs;
49329
49330- if (!pipe->readers) {
49331+ if (!atomic_read(&pipe->readers)) {
49332 send_sig(SIGPIPE, current, 0);
49333 if (!ret)
49334 ret = -EPIPE;
49335@@ -616,9 +616,9 @@ redo2:
49336 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
49337 do_wakeup = 0;
49338 }
49339- pipe->waiting_writers++;
49340+ atomic_inc(&pipe->waiting_writers);
49341 pipe_wait(pipe);
49342- pipe->waiting_writers--;
49343+ atomic_dec(&pipe->waiting_writers);
49344 }
49345 out:
49346 mutex_unlock(&inode->i_mutex);
49347@@ -685,7 +685,7 @@ pipe_poll(struct file *filp, poll_table
49348 mask = 0;
49349 if (filp->f_mode & FMODE_READ) {
49350 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
49351- if (!pipe->writers && filp->f_version != pipe->w_counter)
49352+ if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
49353 mask |= POLLHUP;
49354 }
49355
49356@@ -695,7 +695,7 @@ pipe_poll(struct file *filp, poll_table
49357 * Most Unices do not set POLLERR for FIFOs but on Linux they
49358 * behave exactly like pipes for poll().
49359 */
49360- if (!pipe->readers)
49361+ if (!atomic_read(&pipe->readers))
49362 mask |= POLLERR;
49363 }
49364
49365@@ -709,10 +709,10 @@ pipe_release(struct inode *inode, int de
49366
49367 mutex_lock(&inode->i_mutex);
49368 pipe = inode->i_pipe;
49369- pipe->readers -= decr;
49370- pipe->writers -= decw;
49371+ atomic_sub(decr, &pipe->readers);
49372+ atomic_sub(decw, &pipe->writers);
49373
49374- if (!pipe->readers && !pipe->writers) {
49375+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
49376 free_pipe_info(inode);
49377 } else {
49378 wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
49379@@ -802,7 +802,7 @@ pipe_read_open(struct inode *inode, stru
49380
49381 if (inode->i_pipe) {
49382 ret = 0;
49383- inode->i_pipe->readers++;
49384+ atomic_inc(&inode->i_pipe->readers);
49385 }
49386
49387 mutex_unlock(&inode->i_mutex);
49388@@ -819,7 +819,7 @@ pipe_write_open(struct inode *inode, str
49389
49390 if (inode->i_pipe) {
49391 ret = 0;
49392- inode->i_pipe->writers++;
49393+ atomic_inc(&inode->i_pipe->writers);
49394 }
49395
49396 mutex_unlock(&inode->i_mutex);
49397@@ -837,9 +837,9 @@ pipe_rdwr_open(struct inode *inode, stru
49398 if (inode->i_pipe) {
49399 ret = 0;
49400 if (filp->f_mode & FMODE_READ)
49401- inode->i_pipe->readers++;
49402+ atomic_inc(&inode->i_pipe->readers);
49403 if (filp->f_mode & FMODE_WRITE)
49404- inode->i_pipe->writers++;
49405+ atomic_inc(&inode->i_pipe->writers);
49406 }
49407
49408 mutex_unlock(&inode->i_mutex);
49409@@ -931,7 +931,7 @@ void free_pipe_info(struct inode *inode)
49410 inode->i_pipe = NULL;
49411 }
49412
49413-static struct vfsmount *pipe_mnt __read_mostly;
49414+struct vfsmount *pipe_mnt __read_mostly;
49415
49416 /*
49417 * pipefs_dname() is called from d_path().
49418@@ -961,7 +961,8 @@ static struct inode * get_pipe_inode(voi
49419 goto fail_iput;
49420 inode->i_pipe = pipe;
49421
49422- pipe->readers = pipe->writers = 1;
49423+ atomic_set(&pipe->readers, 1);
49424+ atomic_set(&pipe->writers, 1);
49425 inode->i_fop = &rdwr_pipefifo_fops;
49426
49427 /*
49428diff -urNp linux-2.6.39.1/fs/proc/array.c linux-2.6.39.1/fs/proc/array.c
49429--- linux-2.6.39.1/fs/proc/array.c 2011-05-19 00:06:34.000000000 -0400
49430+++ linux-2.6.39.1/fs/proc/array.c 2011-05-22 19:41:37.000000000 -0400
49431@@ -60,6 +60,7 @@
49432 #include <linux/tty.h>
49433 #include <linux/string.h>
49434 #include <linux/mman.h>
49435+#include <linux/grsecurity.h>
49436 #include <linux/proc_fs.h>
49437 #include <linux/ioport.h>
49438 #include <linux/uaccess.h>
49439@@ -337,6 +338,21 @@ static void task_cpus_allowed(struct seq
49440 seq_putc(m, '\n');
49441 }
49442
49443+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
49444+static inline void task_pax(struct seq_file *m, struct task_struct *p)
49445+{
49446+ if (p->mm)
49447+ seq_printf(m, "PaX:\t%c%c%c%c%c\n",
49448+ p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
49449+ p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
49450+ p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
49451+ p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
49452+ p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
49453+ else
49454+ seq_printf(m, "PaX:\t-----\n");
49455+}
49456+#endif
49457+
49458 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
49459 struct pid *pid, struct task_struct *task)
49460 {
49461@@ -354,9 +370,24 @@ int proc_pid_status(struct seq_file *m,
49462 task_cpus_allowed(m, task);
49463 cpuset_task_status_allowed(m, task);
49464 task_context_switch_counts(m, task);
49465+
49466+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
49467+ task_pax(m, task);
49468+#endif
49469+
49470+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
49471+ task_grsec_rbac(m, task);
49472+#endif
49473+
49474 return 0;
49475 }
49476
49477+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49478+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
49479+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
49480+ _mm->pax_flags & MF_PAX_SEGMEXEC))
49481+#endif
49482+
49483 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
49484 struct pid *pid, struct task_struct *task, int whole)
49485 {
49486@@ -375,9 +406,11 @@ static int do_task_stat(struct seq_file
49487 cputime_t cutime, cstime, utime, stime;
49488 cputime_t cgtime, gtime;
49489 unsigned long rsslim = 0;
49490- char tcomm[sizeof(task->comm)];
49491+ char tcomm[sizeof(task->comm)] = { 0 };
49492 unsigned long flags;
49493
49494+ pax_track_stack();
49495+
49496 state = *get_task_state(task);
49497 vsize = eip = esp = 0;
49498 permitted = ptrace_may_access(task, PTRACE_MODE_READ);
49499@@ -449,6 +482,19 @@ static int do_task_stat(struct seq_file
49500 gtime = task->gtime;
49501 }
49502
49503+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49504+ if (PAX_RAND_FLAGS(mm)) {
49505+ eip = 0;
49506+ esp = 0;
49507+ wchan = 0;
49508+ }
49509+#endif
49510+#ifdef CONFIG_GRKERNSEC_HIDESYM
49511+ wchan = 0;
49512+ eip =0;
49513+ esp =0;
49514+#endif
49515+
49516 /* scale priority and nice values from timeslices to -20..20 */
49517 /* to make it look like a "normal" Unix priority/nice value */
49518 priority = task_prio(task);
49519@@ -489,9 +535,15 @@ static int do_task_stat(struct seq_file
49520 vsize,
49521 mm ? get_mm_rss(mm) : 0,
49522 rsslim,
49523+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49524+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
49525+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
49526+ PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
49527+#else
49528 mm ? (permitted ? mm->start_code : 1) : 0,
49529 mm ? (permitted ? mm->end_code : 1) : 0,
49530 (permitted && mm) ? mm->start_stack : 0,
49531+#endif
49532 esp,
49533 eip,
49534 /* The signal information here is obsolete.
49535@@ -544,3 +596,18 @@ int proc_pid_statm(struct seq_file *m, s
49536
49537 return 0;
49538 }
49539+
49540+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
49541+int proc_pid_ipaddr(struct task_struct *task, char *buffer)
49542+{
49543+ u32 curr_ip = 0;
49544+ unsigned long flags;
49545+
49546+ if (lock_task_sighand(task, &flags)) {
49547+ curr_ip = task->signal->curr_ip;
49548+ unlock_task_sighand(task, &flags);
49549+ }
49550+
49551+ return sprintf(buffer, "%pI4\n", &curr_ip);
49552+}
49553+#endif
49554diff -urNp linux-2.6.39.1/fs/proc/base.c linux-2.6.39.1/fs/proc/base.c
49555--- linux-2.6.39.1/fs/proc/base.c 2011-05-19 00:06:34.000000000 -0400
49556+++ linux-2.6.39.1/fs/proc/base.c 2011-06-04 21:20:04.000000000 -0400
49557@@ -104,6 +104,22 @@ struct pid_entry {
49558 union proc_op op;
49559 };
49560
49561+struct getdents_callback {
49562+ struct linux_dirent __user * current_dir;
49563+ struct linux_dirent __user * previous;
49564+ struct file * file;
49565+ int count;
49566+ int error;
49567+};
49568+
49569+static int gr_fake_filldir(void * __buf, const char *name, int namlen,
49570+ loff_t offset, u64 ino, unsigned int d_type)
49571+{
49572+ struct getdents_callback * buf = (struct getdents_callback *) __buf;
49573+ buf->error = -EINVAL;
49574+ return 0;
49575+}
49576+
49577 #define NOD(NAME, MODE, IOP, FOP, OP) { \
49578 .name = (NAME), \
49579 .len = sizeof(NAME) - 1, \
49580@@ -206,6 +222,9 @@ static struct mm_struct *__check_mem_per
49581 if (task == current)
49582 return mm;
49583
49584+ if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
49585+ return ERR_PTR(-EPERM);
49586+
49587 /*
49588 * If current is actively ptrace'ing, and would also be
49589 * permitted to freshly attach with ptrace now, permit it.
49590@@ -279,6 +298,9 @@ static int proc_pid_cmdline(struct task_
49591 if (!mm->arg_end)
49592 goto out_mm; /* Shh! No looking before we're done */
49593
49594+ if (gr_acl_handle_procpidmem(task))
49595+ goto out_mm;
49596+
49597 len = mm->arg_end - mm->arg_start;
49598
49599 if (len > PAGE_SIZE)
49600@@ -306,12 +328,28 @@ out:
49601 return res;
49602 }
49603
49604+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49605+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
49606+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
49607+ _mm->pax_flags & MF_PAX_SEGMEXEC))
49608+#endif
49609+
49610 static int proc_pid_auxv(struct task_struct *task, char *buffer)
49611 {
49612 struct mm_struct *mm = mm_for_maps(task);
49613 int res = PTR_ERR(mm);
49614 if (mm && !IS_ERR(mm)) {
49615 unsigned int nwords = 0;
49616+
49617+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49618+ /* allow if we're currently ptracing this task */
49619+ if (PAX_RAND_FLAGS(mm) &&
49620+ (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
49621+ mmput(mm);
49622+ return res;
49623+ }
49624+#endif
49625+
49626 do {
49627 nwords += 2;
49628 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
49629@@ -325,7 +363,7 @@ static int proc_pid_auxv(struct task_str
49630 }
49631
49632
49633-#ifdef CONFIG_KALLSYMS
49634+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49635 /*
49636 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
49637 * Returns the resolved symbol. If that fails, simply return the address.
49638@@ -364,7 +402,7 @@ static void unlock_trace(struct task_str
49639 mutex_unlock(&task->signal->cred_guard_mutex);
49640 }
49641
49642-#ifdef CONFIG_STACKTRACE
49643+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49644
49645 #define MAX_STACK_TRACE_DEPTH 64
49646
49647@@ -555,7 +593,7 @@ static int proc_pid_limits(struct task_s
49648 return count;
49649 }
49650
49651-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
49652+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
49653 static int proc_pid_syscall(struct task_struct *task, char *buffer)
49654 {
49655 long nr;
49656@@ -584,7 +622,7 @@ static int proc_pid_syscall(struct task_
49657 /************************************************************************/
49658
49659 /* permission checks */
49660-static int proc_fd_access_allowed(struct inode *inode)
49661+static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
49662 {
49663 struct task_struct *task;
49664 int allowed = 0;
49665@@ -594,7 +632,10 @@ static int proc_fd_access_allowed(struct
49666 */
49667 task = get_proc_task(inode);
49668 if (task) {
49669- allowed = ptrace_may_access(task, PTRACE_MODE_READ);
49670+ if (log)
49671+ allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
49672+ else
49673+ allowed = ptrace_may_access(task, PTRACE_MODE_READ);
49674 put_task_struct(task);
49675 }
49676 return allowed;
49677@@ -973,6 +1014,9 @@ static ssize_t environ_read(struct file
49678 if (!task)
49679 goto out_no_task;
49680
49681+ if (gr_acl_handle_procpidmem(task))
49682+ goto out;
49683+
49684 ret = -ENOMEM;
49685 page = (char *)__get_free_page(GFP_TEMPORARY);
49686 if (!page)
49687@@ -1660,7 +1704,7 @@ static void *proc_pid_follow_link(struct
49688 path_put(&nd->path);
49689
49690 /* Are we allowed to snoop on the tasks file descriptors? */
49691- if (!proc_fd_access_allowed(inode))
49692+ if (!proc_fd_access_allowed(inode,0))
49693 goto out;
49694
49695 error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
49696@@ -1699,8 +1743,18 @@ static int proc_pid_readlink(struct dent
49697 struct path path;
49698
49699 /* Are we allowed to snoop on the tasks file descriptors? */
49700- if (!proc_fd_access_allowed(inode))
49701- goto out;
49702+ /* logging this is needed for learning on chromium to work properly,
49703+ but we don't want to flood the logs from 'ps' which does a readlink
49704+ on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
49705+ CAP_SYS_PTRACE as it's not necessary for its basic functionality
49706+ */
49707+ if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
49708+ if (!proc_fd_access_allowed(inode,0))
49709+ goto out;
49710+ } else {
49711+ if (!proc_fd_access_allowed(inode,1))
49712+ goto out;
49713+ }
49714
49715 error = PROC_I(inode)->op.proc_get_link(inode, &path);
49716 if (error)
49717@@ -1766,7 +1820,11 @@ static struct inode *proc_pid_make_inode
49718 rcu_read_lock();
49719 cred = __task_cred(task);
49720 inode->i_uid = cred->euid;
49721+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49722+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49723+#else
49724 inode->i_gid = cred->egid;
49725+#endif
49726 rcu_read_unlock();
49727 }
49728 security_task_to_inode(task, inode);
49729@@ -1784,6 +1842,9 @@ static int pid_getattr(struct vfsmount *
49730 struct inode *inode = dentry->d_inode;
49731 struct task_struct *task;
49732 const struct cred *cred;
49733+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49734+ const struct cred *tmpcred = current_cred();
49735+#endif
49736
49737 generic_fillattr(inode, stat);
49738
49739@@ -1791,13 +1852,41 @@ static int pid_getattr(struct vfsmount *
49740 stat->uid = 0;
49741 stat->gid = 0;
49742 task = pid_task(proc_pid(inode), PIDTYPE_PID);
49743+
49744+ if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
49745+ rcu_read_unlock();
49746+ return -ENOENT;
49747+ }
49748+
49749 if (task) {
49750+ cred = __task_cred(task);
49751+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49752+ if (!tmpcred->uid || (tmpcred->uid == cred->uid)
49753+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49754+ || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
49755+#endif
49756+ ) {
49757+#endif
49758 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
49759+#ifdef CONFIG_GRKERNSEC_PROC_USER
49760+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
49761+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49762+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
49763+#endif
49764 task_dumpable(task)) {
49765- cred = __task_cred(task);
49766 stat->uid = cred->euid;
49767+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49768+ stat->gid = CONFIG_GRKERNSEC_PROC_GID;
49769+#else
49770 stat->gid = cred->egid;
49771+#endif
49772 }
49773+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49774+ } else {
49775+ rcu_read_unlock();
49776+ return -ENOENT;
49777+ }
49778+#endif
49779 }
49780 rcu_read_unlock();
49781 return 0;
49782@@ -1834,11 +1923,20 @@ static int pid_revalidate(struct dentry
49783
49784 if (task) {
49785 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
49786+#ifdef CONFIG_GRKERNSEC_PROC_USER
49787+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
49788+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49789+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
49790+#endif
49791 task_dumpable(task)) {
49792 rcu_read_lock();
49793 cred = __task_cred(task);
49794 inode->i_uid = cred->euid;
49795+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49796+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49797+#else
49798 inode->i_gid = cred->egid;
49799+#endif
49800 rcu_read_unlock();
49801 } else {
49802 inode->i_uid = 0;
49803@@ -1959,7 +2057,8 @@ static int proc_fd_info(struct inode *in
49804 int fd = proc_fd(inode);
49805
49806 if (task) {
49807- files = get_files_struct(task);
49808+ if (!gr_acl_handle_procpidmem(task))
49809+ files = get_files_struct(task);
49810 put_task_struct(task);
49811 }
49812 if (files) {
49813@@ -2219,15 +2318,25 @@ static const struct file_operations proc
49814 */
49815 static int proc_fd_permission(struct inode *inode, int mask, unsigned int flags)
49816 {
49817+ struct task_struct *task;
49818 int rv;
49819
49820 if (flags & IPERM_FLAG_RCU)
49821 return -ECHILD;
49822 rv = generic_permission(inode, mask, flags, NULL);
49823- if (rv == 0)
49824- return 0;
49825+
49826 if (task_pid(current) == proc_pid(inode))
49827 rv = 0;
49828+
49829+ task = get_proc_task(inode);
49830+ if (task == NULL)
49831+ return rv;
49832+
49833+ if (gr_acl_handle_procpidmem(task))
49834+ rv = -EACCES;
49835+
49836+ put_task_struct(task);
49837+
49838 return rv;
49839 }
49840
49841@@ -2337,6 +2446,9 @@ static struct dentry *proc_pident_lookup
49842 if (!task)
49843 goto out_no_task;
49844
49845+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
49846+ goto out;
49847+
49848 /*
49849 * Yes, it does not scale. And it should not. Don't add
49850 * new entries into /proc/<tgid>/ without very good reasons.
49851@@ -2381,6 +2493,9 @@ static int proc_pident_readdir(struct fi
49852 if (!task)
49853 goto out_no_task;
49854
49855+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
49856+ goto out;
49857+
49858 ret = 0;
49859 i = filp->f_pos;
49860 switch (i) {
49861@@ -2651,7 +2766,7 @@ static void *proc_self_follow_link(struc
49862 static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
49863 void *cookie)
49864 {
49865- char *s = nd_get_link(nd);
49866+ const char *s = nd_get_link(nd);
49867 if (!IS_ERR(s))
49868 __putname(s);
49869 }
49870@@ -2835,7 +2950,7 @@ static const struct pid_entry tgid_base_
49871 REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
49872 #endif
49873 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
49874-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
49875+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
49876 INF("syscall", S_IRUGO, proc_pid_syscall),
49877 #endif
49878 INF("cmdline", S_IRUGO, proc_pid_cmdline),
49879@@ -2860,10 +2975,10 @@ static const struct pid_entry tgid_base_
49880 #ifdef CONFIG_SECURITY
49881 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
49882 #endif
49883-#ifdef CONFIG_KALLSYMS
49884+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49885 INF("wchan", S_IRUGO, proc_pid_wchan),
49886 #endif
49887-#ifdef CONFIG_STACKTRACE
49888+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49889 ONE("stack", S_IRUGO, proc_pid_stack),
49890 #endif
49891 #ifdef CONFIG_SCHEDSTATS
49892@@ -2894,6 +3009,9 @@ static const struct pid_entry tgid_base_
49893 #ifdef CONFIG_TASK_IO_ACCOUNTING
49894 INF("io", S_IRUGO, proc_tgid_io_accounting),
49895 #endif
49896+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
49897+ INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
49898+#endif
49899 };
49900
49901 static int proc_tgid_base_readdir(struct file * filp,
49902@@ -3019,7 +3137,14 @@ static struct dentry *proc_pid_instantia
49903 if (!inode)
49904 goto out;
49905
49906+#ifdef CONFIG_GRKERNSEC_PROC_USER
49907+ inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
49908+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49909+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49910+ inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
49911+#else
49912 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
49913+#endif
49914 inode->i_op = &proc_tgid_base_inode_operations;
49915 inode->i_fop = &proc_tgid_base_operations;
49916 inode->i_flags|=S_IMMUTABLE;
49917@@ -3061,7 +3186,11 @@ struct dentry *proc_pid_lookup(struct in
49918 if (!task)
49919 goto out;
49920
49921+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
49922+ goto out_put_task;
49923+
49924 result = proc_pid_instantiate(dir, dentry, task, NULL);
49925+out_put_task:
49926 put_task_struct(task);
49927 out:
49928 return result;
49929@@ -3126,6 +3255,11 @@ int proc_pid_readdir(struct file * filp,
49930 {
49931 unsigned int nr;
49932 struct task_struct *reaper;
49933+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49934+ const struct cred *tmpcred = current_cred();
49935+ const struct cred *itercred;
49936+#endif
49937+ filldir_t __filldir = filldir;
49938 struct tgid_iter iter;
49939 struct pid_namespace *ns;
49940
49941@@ -3149,8 +3283,27 @@ int proc_pid_readdir(struct file * filp,
49942 for (iter = next_tgid(ns, iter);
49943 iter.task;
49944 iter.tgid += 1, iter = next_tgid(ns, iter)) {
49945+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49946+ rcu_read_lock();
49947+ itercred = __task_cred(iter.task);
49948+#endif
49949+ if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
49950+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49951+ || (tmpcred->uid && (itercred->uid != tmpcred->uid)
49952+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49953+ && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
49954+#endif
49955+ )
49956+#endif
49957+ )
49958+ __filldir = &gr_fake_filldir;
49959+ else
49960+ __filldir = filldir;
49961+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49962+ rcu_read_unlock();
49963+#endif
49964 filp->f_pos = iter.tgid + TGID_OFFSET;
49965- if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
49966+ if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
49967 put_task_struct(iter.task);
49968 goto out;
49969 }
49970@@ -3177,7 +3330,7 @@ static const struct pid_entry tid_base_s
49971 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
49972 #endif
49973 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
49974-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
49975+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
49976 INF("syscall", S_IRUGO, proc_pid_syscall),
49977 #endif
49978 INF("cmdline", S_IRUGO, proc_pid_cmdline),
49979@@ -3201,10 +3354,10 @@ static const struct pid_entry tid_base_s
49980 #ifdef CONFIG_SECURITY
49981 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
49982 #endif
49983-#ifdef CONFIG_KALLSYMS
49984+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49985 INF("wchan", S_IRUGO, proc_pid_wchan),
49986 #endif
49987-#ifdef CONFIG_STACKTRACE
49988+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49989 ONE("stack", S_IRUGO, proc_pid_stack),
49990 #endif
49991 #ifdef CONFIG_SCHEDSTATS
49992diff -urNp linux-2.6.39.1/fs/proc/cmdline.c linux-2.6.39.1/fs/proc/cmdline.c
49993--- linux-2.6.39.1/fs/proc/cmdline.c 2011-05-19 00:06:34.000000000 -0400
49994+++ linux-2.6.39.1/fs/proc/cmdline.c 2011-05-22 19:41:37.000000000 -0400
49995@@ -23,7 +23,11 @@ static const struct file_operations cmdl
49996
49997 static int __init proc_cmdline_init(void)
49998 {
49999+#ifdef CONFIG_GRKERNSEC_PROC_ADD
50000+ proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
50001+#else
50002 proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
50003+#endif
50004 return 0;
50005 }
50006 module_init(proc_cmdline_init);
50007diff -urNp linux-2.6.39.1/fs/proc/devices.c linux-2.6.39.1/fs/proc/devices.c
50008--- linux-2.6.39.1/fs/proc/devices.c 2011-05-19 00:06:34.000000000 -0400
50009+++ linux-2.6.39.1/fs/proc/devices.c 2011-05-22 19:41:37.000000000 -0400
50010@@ -64,7 +64,11 @@ static const struct file_operations proc
50011
50012 static int __init proc_devices_init(void)
50013 {
50014+#ifdef CONFIG_GRKERNSEC_PROC_ADD
50015+ proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
50016+#else
50017 proc_create("devices", 0, NULL, &proc_devinfo_operations);
50018+#endif
50019 return 0;
50020 }
50021 module_init(proc_devices_init);
50022diff -urNp linux-2.6.39.1/fs/proc/inode.c linux-2.6.39.1/fs/proc/inode.c
50023--- linux-2.6.39.1/fs/proc/inode.c 2011-05-19 00:06:34.000000000 -0400
50024+++ linux-2.6.39.1/fs/proc/inode.c 2011-05-22 19:41:37.000000000 -0400
50025@@ -433,7 +433,11 @@ struct inode *proc_get_inode(struct supe
50026 if (de->mode) {
50027 inode->i_mode = de->mode;
50028 inode->i_uid = de->uid;
50029+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
50030+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
50031+#else
50032 inode->i_gid = de->gid;
50033+#endif
50034 }
50035 if (de->size)
50036 inode->i_size = de->size;
50037diff -urNp linux-2.6.39.1/fs/proc/internal.h linux-2.6.39.1/fs/proc/internal.h
50038--- linux-2.6.39.1/fs/proc/internal.h 2011-05-19 00:06:34.000000000 -0400
50039+++ linux-2.6.39.1/fs/proc/internal.h 2011-05-22 19:41:37.000000000 -0400
50040@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
50041 struct pid *pid, struct task_struct *task);
50042 extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
50043 struct pid *pid, struct task_struct *task);
50044+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
50045+extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
50046+#endif
50047 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
50048
50049 extern const struct file_operations proc_maps_operations;
50050diff -urNp linux-2.6.39.1/fs/proc/Kconfig linux-2.6.39.1/fs/proc/Kconfig
50051--- linux-2.6.39.1/fs/proc/Kconfig 2011-05-19 00:06:34.000000000 -0400
50052+++ linux-2.6.39.1/fs/proc/Kconfig 2011-05-22 19:41:37.000000000 -0400
50053@@ -30,12 +30,12 @@ config PROC_FS
50054
50055 config PROC_KCORE
50056 bool "/proc/kcore support" if !ARM
50057- depends on PROC_FS && MMU
50058+ depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
50059
50060 config PROC_VMCORE
50061 bool "/proc/vmcore support"
50062- depends on PROC_FS && CRASH_DUMP
50063- default y
50064+ depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
50065+ default n
50066 help
50067 Exports the dump image of crashed kernel in ELF format.
50068
50069@@ -59,8 +59,8 @@ config PROC_SYSCTL
50070 limited in memory.
50071
50072 config PROC_PAGE_MONITOR
50073- default y
50074- depends on PROC_FS && MMU
50075+ default n
50076+ depends on PROC_FS && MMU && !GRKERNSEC
50077 bool "Enable /proc page monitoring" if EXPERT
50078 help
50079 Various /proc files exist to monitor process memory utilization:
50080diff -urNp linux-2.6.39.1/fs/proc/kcore.c linux-2.6.39.1/fs/proc/kcore.c
50081--- linux-2.6.39.1/fs/proc/kcore.c 2011-05-19 00:06:34.000000000 -0400
50082+++ linux-2.6.39.1/fs/proc/kcore.c 2011-05-22 19:41:37.000000000 -0400
50083@@ -321,6 +321,8 @@ static void elf_kcore_store_hdr(char *bu
50084 off_t offset = 0;
50085 struct kcore_list *m;
50086
50087+ pax_track_stack();
50088+
50089 /* setup ELF header */
50090 elf = (struct elfhdr *) bufp;
50091 bufp += sizeof(struct elfhdr);
50092@@ -478,9 +480,10 @@ read_kcore(struct file *file, char __use
50093 * the addresses in the elf_phdr on our list.
50094 */
50095 start = kc_offset_to_vaddr(*fpos - elf_buflen);
50096- if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
50097+ tsz = PAGE_SIZE - (start & ~PAGE_MASK);
50098+ if (tsz > buflen)
50099 tsz = buflen;
50100-
50101+
50102 while (buflen) {
50103 struct kcore_list *m;
50104
50105@@ -509,20 +512,23 @@ read_kcore(struct file *file, char __use
50106 kfree(elf_buf);
50107 } else {
50108 if (kern_addr_valid(start)) {
50109- unsigned long n;
50110+ char *elf_buf;
50111+ mm_segment_t oldfs;
50112
50113- n = copy_to_user(buffer, (char *)start, tsz);
50114- /*
50115- * We cannot distingush between fault on source
50116- * and fault on destination. When this happens
50117- * we clear too and hope it will trigger the
50118- * EFAULT again.
50119- */
50120- if (n) {
50121- if (clear_user(buffer + tsz - n,
50122- n))
50123+ elf_buf = kmalloc(tsz, GFP_KERNEL);
50124+ if (!elf_buf)
50125+ return -ENOMEM;
50126+ oldfs = get_fs();
50127+ set_fs(KERNEL_DS);
50128+ if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
50129+ set_fs(oldfs);
50130+ if (copy_to_user(buffer, elf_buf, tsz)) {
50131+ kfree(elf_buf);
50132 return -EFAULT;
50133+ }
50134 }
50135+ set_fs(oldfs);
50136+ kfree(elf_buf);
50137 } else {
50138 if (clear_user(buffer, tsz))
50139 return -EFAULT;
50140@@ -542,6 +548,9 @@ read_kcore(struct file *file, char __use
50141
50142 static int open_kcore(struct inode *inode, struct file *filp)
50143 {
50144+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
50145+ return -EPERM;
50146+#endif
50147 if (!capable(CAP_SYS_RAWIO))
50148 return -EPERM;
50149 if (kcore_need_update)
50150diff -urNp linux-2.6.39.1/fs/proc/meminfo.c linux-2.6.39.1/fs/proc/meminfo.c
50151--- linux-2.6.39.1/fs/proc/meminfo.c 2011-05-19 00:06:34.000000000 -0400
50152+++ linux-2.6.39.1/fs/proc/meminfo.c 2011-05-22 19:36:32.000000000 -0400
50153@@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_
50154 unsigned long pages[NR_LRU_LISTS];
50155 int lru;
50156
50157+ pax_track_stack();
50158+
50159 /*
50160 * display in kilobytes.
50161 */
50162@@ -157,7 +159,7 @@ static int meminfo_proc_show(struct seq_
50163 vmi.used >> 10,
50164 vmi.largest_chunk >> 10
50165 #ifdef CONFIG_MEMORY_FAILURE
50166- ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
50167+ ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
50168 #endif
50169 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
50170 ,K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
50171diff -urNp linux-2.6.39.1/fs/proc/nommu.c linux-2.6.39.1/fs/proc/nommu.c
50172--- linux-2.6.39.1/fs/proc/nommu.c 2011-05-19 00:06:34.000000000 -0400
50173+++ linux-2.6.39.1/fs/proc/nommu.c 2011-05-22 19:36:32.000000000 -0400
50174@@ -66,7 +66,7 @@ static int nommu_region_show(struct seq_
50175 if (len < 1)
50176 len = 1;
50177 seq_printf(m, "%*c", len, ' ');
50178- seq_path(m, &file->f_path, "");
50179+ seq_path(m, &file->f_path, "\n\\");
50180 }
50181
50182 seq_putc(m, '\n');
50183diff -urNp linux-2.6.39.1/fs/proc/proc_net.c linux-2.6.39.1/fs/proc/proc_net.c
50184--- linux-2.6.39.1/fs/proc/proc_net.c 2011-05-19 00:06:34.000000000 -0400
50185+++ linux-2.6.39.1/fs/proc/proc_net.c 2011-05-22 19:41:37.000000000 -0400
50186@@ -105,6 +105,17 @@ static struct net *get_proc_task_net(str
50187 struct task_struct *task;
50188 struct nsproxy *ns;
50189 struct net *net = NULL;
50190+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50191+ const struct cred *cred = current_cred();
50192+#endif
50193+
50194+#ifdef CONFIG_GRKERNSEC_PROC_USER
50195+ if (cred->fsuid)
50196+ return net;
50197+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50198+ if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
50199+ return net;
50200+#endif
50201
50202 rcu_read_lock();
50203 task = pid_task(proc_pid(dir), PIDTYPE_PID);
50204diff -urNp linux-2.6.39.1/fs/proc/proc_sysctl.c linux-2.6.39.1/fs/proc/proc_sysctl.c
50205--- linux-2.6.39.1/fs/proc/proc_sysctl.c 2011-05-19 00:06:34.000000000 -0400
50206+++ linux-2.6.39.1/fs/proc/proc_sysctl.c 2011-05-22 19:41:37.000000000 -0400
50207@@ -8,6 +8,8 @@
50208 #include <linux/namei.h>
50209 #include "internal.h"
50210
50211+extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
50212+
50213 static const struct dentry_operations proc_sys_dentry_operations;
50214 static const struct file_operations proc_sys_file_operations;
50215 static const struct inode_operations proc_sys_inode_operations;
50216@@ -111,6 +113,9 @@ static struct dentry *proc_sys_lookup(st
50217 if (!p)
50218 goto out;
50219
50220+ if (gr_handle_sysctl(p, MAY_EXEC))
50221+ goto out;
50222+
50223 err = ERR_PTR(-ENOMEM);
50224 inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
50225 if (h)
50226@@ -230,6 +235,9 @@ static int scan(struct ctl_table_header
50227 if (*pos < file->f_pos)
50228 continue;
50229
50230+ if (gr_handle_sysctl(table, 0))
50231+ continue;
50232+
50233 res = proc_sys_fill_cache(file, dirent, filldir, head, table);
50234 if (res)
50235 return res;
50236@@ -358,6 +366,9 @@ static int proc_sys_getattr(struct vfsmo
50237 if (IS_ERR(head))
50238 return PTR_ERR(head);
50239
50240+ if (table && gr_handle_sysctl(table, MAY_EXEC))
50241+ return -ENOENT;
50242+
50243 generic_fillattr(inode, stat);
50244 if (table)
50245 stat->mode = (stat->mode & S_IFMT) | table->mode;
50246diff -urNp linux-2.6.39.1/fs/proc/root.c linux-2.6.39.1/fs/proc/root.c
50247--- linux-2.6.39.1/fs/proc/root.c 2011-05-19 00:06:34.000000000 -0400
50248+++ linux-2.6.39.1/fs/proc/root.c 2011-05-22 19:41:37.000000000 -0400
50249@@ -122,7 +122,15 @@ void __init proc_root_init(void)
50250 #ifdef CONFIG_PROC_DEVICETREE
50251 proc_device_tree_init();
50252 #endif
50253+#ifdef CONFIG_GRKERNSEC_PROC_ADD
50254+#ifdef CONFIG_GRKERNSEC_PROC_USER
50255+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
50256+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50257+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
50258+#endif
50259+#else
50260 proc_mkdir("bus", NULL);
50261+#endif
50262 proc_sys_init();
50263 }
50264
50265diff -urNp linux-2.6.39.1/fs/proc/task_mmu.c linux-2.6.39.1/fs/proc/task_mmu.c
50266--- linux-2.6.39.1/fs/proc/task_mmu.c 2011-05-19 00:06:34.000000000 -0400
50267+++ linux-2.6.39.1/fs/proc/task_mmu.c 2011-05-22 22:43:29.000000000 -0400
50268@@ -51,8 +51,13 @@ void task_mem(struct seq_file *m, struct
50269 "VmExe:\t%8lu kB\n"
50270 "VmLib:\t%8lu kB\n"
50271 "VmPTE:\t%8lu kB\n"
50272- "VmSwap:\t%8lu kB\n",
50273- hiwater_vm << (PAGE_SHIFT-10),
50274+ "VmSwap:\t%8lu kB\n"
50275+
50276+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
50277+ "CsBase:\t%8lx\nCsLim:\t%8lx\n"
50278+#endif
50279+
50280+ ,hiwater_vm << (PAGE_SHIFT-10),
50281 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
50282 mm->locked_vm << (PAGE_SHIFT-10),
50283 hiwater_rss << (PAGE_SHIFT-10),
50284@@ -60,7 +65,13 @@ void task_mem(struct seq_file *m, struct
50285 data << (PAGE_SHIFT-10),
50286 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
50287 (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10,
50288- swap << (PAGE_SHIFT-10));
50289+ swap << (PAGE_SHIFT-10)
50290+
50291+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
50292+ , mm->context.user_cs_base, mm->context.user_cs_limit
50293+#endif
50294+
50295+ );
50296 }
50297
50298 unsigned long task_vsize(struct mm_struct *mm)
50299@@ -207,6 +218,12 @@ static int do_maps_open(struct inode *in
50300 return ret;
50301 }
50302
50303+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50304+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
50305+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
50306+ _mm->pax_flags & MF_PAX_SEGMEXEC))
50307+#endif
50308+
50309 static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
50310 {
50311 struct mm_struct *mm = vma->vm_mm;
50312@@ -225,13 +242,13 @@ static void show_map_vma(struct seq_file
50313 pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
50314 }
50315
50316- /* We don't show the stack guard page in /proc/maps */
50317+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50318+ start = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start;
50319+ end = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end;
50320+#else
50321 start = vma->vm_start;
50322- if (stack_guard_page_start(vma, start))
50323- start += PAGE_SIZE;
50324 end = vma->vm_end;
50325- if (stack_guard_page_end(vma, end))
50326- end -= PAGE_SIZE;
50327+#endif
50328
50329 seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
50330 start,
50331@@ -240,7 +257,11 @@ static void show_map_vma(struct seq_file
50332 flags & VM_WRITE ? 'w' : '-',
50333 flags & VM_EXEC ? 'x' : '-',
50334 flags & VM_MAYSHARE ? 's' : 'p',
50335+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50336+ PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
50337+#else
50338 pgoff,
50339+#endif
50340 MAJOR(dev), MINOR(dev), ino, &len);
50341
50342 /*
50343@@ -249,7 +270,7 @@ static void show_map_vma(struct seq_file
50344 */
50345 if (file) {
50346 pad_len_spaces(m, len);
50347- seq_path(m, &file->f_path, "\n");
50348+ seq_path(m, &file->f_path, "\n\\");
50349 } else {
50350 const char *name = arch_vma_name(vma);
50351 if (!name) {
50352@@ -257,8 +278,9 @@ static void show_map_vma(struct seq_file
50353 if (vma->vm_start <= mm->brk &&
50354 vma->vm_end >= mm->start_brk) {
50355 name = "[heap]";
50356- } else if (vma->vm_start <= mm->start_stack &&
50357- vma->vm_end >= mm->start_stack) {
50358+ } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
50359+ (vma->vm_start <= mm->start_stack &&
50360+ vma->vm_end >= mm->start_stack)) {
50361 name = "[stack]";
50362 }
50363 } else {
50364@@ -433,11 +455,16 @@ static int show_smap(struct seq_file *m,
50365 };
50366
50367 memset(&mss, 0, sizeof mss);
50368- mss.vma = vma;
50369- /* mmap_sem is held in m_start */
50370- if (vma->vm_mm && !is_vm_hugetlb_page(vma))
50371- walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
50372-
50373+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50374+ if (!PAX_RAND_FLAGS(vma->vm_mm)) {
50375+#endif
50376+ mss.vma = vma;
50377+ /* mmap_sem is held in m_start */
50378+ if (vma->vm_mm && !is_vm_hugetlb_page(vma))
50379+ walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
50380+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50381+ }
50382+#endif
50383 show_map_vma(m, vma);
50384
50385 seq_printf(m,
50386@@ -455,7 +482,11 @@ static int show_smap(struct seq_file *m,
50387 "KernelPageSize: %8lu kB\n"
50388 "MMUPageSize: %8lu kB\n"
50389 "Locked: %8lu kB\n",
50390+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50391+ PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
50392+#else
50393 (vma->vm_end - vma->vm_start) >> 10,
50394+#endif
50395 mss.resident >> 10,
50396 (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
50397 mss.shared_clean >> 10,
50398diff -urNp linux-2.6.39.1/fs/proc/task_nommu.c linux-2.6.39.1/fs/proc/task_nommu.c
50399--- linux-2.6.39.1/fs/proc/task_nommu.c 2011-05-19 00:06:34.000000000 -0400
50400+++ linux-2.6.39.1/fs/proc/task_nommu.c 2011-05-22 19:36:32.000000000 -0400
50401@@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct
50402 else
50403 bytes += kobjsize(mm);
50404
50405- if (current->fs && current->fs->users > 1)
50406+ if (current->fs && atomic_read(&current->fs->users) > 1)
50407 sbytes += kobjsize(current->fs);
50408 else
50409 bytes += kobjsize(current->fs);
50410@@ -166,7 +166,7 @@ static int nommu_vma_show(struct seq_fil
50411
50412 if (file) {
50413 pad_len_spaces(m, len);
50414- seq_path(m, &file->f_path, "");
50415+ seq_path(m, &file->f_path, "\n\\");
50416 } else if (mm) {
50417 if (vma->vm_start <= mm->start_stack &&
50418 vma->vm_end >= mm->start_stack) {
50419diff -urNp linux-2.6.39.1/fs/quota/netlink.c linux-2.6.39.1/fs/quota/netlink.c
50420--- linux-2.6.39.1/fs/quota/netlink.c 2011-05-19 00:06:34.000000000 -0400
50421+++ linux-2.6.39.1/fs/quota/netlink.c 2011-05-22 19:36:32.000000000 -0400
50422@@ -33,7 +33,7 @@ static struct genl_family quota_genl_fam
50423 void quota_send_warning(short type, unsigned int id, dev_t dev,
50424 const char warntype)
50425 {
50426- static atomic_t seq;
50427+ static atomic_unchecked_t seq;
50428 struct sk_buff *skb;
50429 void *msg_head;
50430 int ret;
50431@@ -49,7 +49,7 @@ void quota_send_warning(short type, unsi
50432 "VFS: Not enough memory to send quota warning.\n");
50433 return;
50434 }
50435- msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq),
50436+ msg_head = genlmsg_put(skb, 0, atomic_add_return_unchecked(1, &seq),
50437 &quota_genl_family, 0, QUOTA_NL_C_WARNING);
50438 if (!msg_head) {
50439 printk(KERN_ERR
50440diff -urNp linux-2.6.39.1/fs/readdir.c linux-2.6.39.1/fs/readdir.c
50441--- linux-2.6.39.1/fs/readdir.c 2011-05-19 00:06:34.000000000 -0400
50442+++ linux-2.6.39.1/fs/readdir.c 2011-05-22 19:41:42.000000000 -0400
50443@@ -17,6 +17,7 @@
50444 #include <linux/security.h>
50445 #include <linux/syscalls.h>
50446 #include <linux/unistd.h>
50447+#include <linux/namei.h>
50448
50449 #include <asm/uaccess.h>
50450
50451@@ -67,6 +68,7 @@ struct old_linux_dirent {
50452
50453 struct readdir_callback {
50454 struct old_linux_dirent __user * dirent;
50455+ struct file * file;
50456 int result;
50457 };
50458
50459@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
50460 buf->result = -EOVERFLOW;
50461 return -EOVERFLOW;
50462 }
50463+
50464+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
50465+ return 0;
50466+
50467 buf->result++;
50468 dirent = buf->dirent;
50469 if (!access_ok(VERIFY_WRITE, dirent,
50470@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
50471
50472 buf.result = 0;
50473 buf.dirent = dirent;
50474+ buf.file = file;
50475
50476 error = vfs_readdir(file, fillonedir, &buf);
50477 if (buf.result)
50478@@ -142,6 +149,7 @@ struct linux_dirent {
50479 struct getdents_callback {
50480 struct linux_dirent __user * current_dir;
50481 struct linux_dirent __user * previous;
50482+ struct file * file;
50483 int count;
50484 int error;
50485 };
50486@@ -163,6 +171,10 @@ static int filldir(void * __buf, const c
50487 buf->error = -EOVERFLOW;
50488 return -EOVERFLOW;
50489 }
50490+
50491+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
50492+ return 0;
50493+
50494 dirent = buf->previous;
50495 if (dirent) {
50496 if (__put_user(offset, &dirent->d_off))
50497@@ -210,6 +222,7 @@ SYSCALL_DEFINE3(getdents, unsigned int,
50498 buf.previous = NULL;
50499 buf.count = count;
50500 buf.error = 0;
50501+ buf.file = file;
50502
50503 error = vfs_readdir(file, filldir, &buf);
50504 if (error >= 0)
50505@@ -229,6 +242,7 @@ out:
50506 struct getdents_callback64 {
50507 struct linux_dirent64 __user * current_dir;
50508 struct linux_dirent64 __user * previous;
50509+ struct file *file;
50510 int count;
50511 int error;
50512 };
50513@@ -244,6 +258,10 @@ static int filldir64(void * __buf, const
50514 buf->error = -EINVAL; /* only used if we fail.. */
50515 if (reclen > buf->count)
50516 return -EINVAL;
50517+
50518+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
50519+ return 0;
50520+
50521 dirent = buf->previous;
50522 if (dirent) {
50523 if (__put_user(offset, &dirent->d_off))
50524@@ -291,6 +309,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
50525
50526 buf.current_dir = dirent;
50527 buf.previous = NULL;
50528+ buf.file = file;
50529 buf.count = count;
50530 buf.error = 0;
50531
50532diff -urNp linux-2.6.39.1/fs/reiserfs/dir.c linux-2.6.39.1/fs/reiserfs/dir.c
50533--- linux-2.6.39.1/fs/reiserfs/dir.c 2011-05-19 00:06:34.000000000 -0400
50534+++ linux-2.6.39.1/fs/reiserfs/dir.c 2011-05-22 19:36:32.000000000 -0400
50535@@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentr
50536 struct reiserfs_dir_entry de;
50537 int ret = 0;
50538
50539+ pax_track_stack();
50540+
50541 reiserfs_write_lock(inode->i_sb);
50542
50543 reiserfs_check_lock_depth(inode->i_sb, "readdir");
50544diff -urNp linux-2.6.39.1/fs/reiserfs/do_balan.c linux-2.6.39.1/fs/reiserfs/do_balan.c
50545--- linux-2.6.39.1/fs/reiserfs/do_balan.c 2011-05-19 00:06:34.000000000 -0400
50546+++ linux-2.6.39.1/fs/reiserfs/do_balan.c 2011-05-22 19:36:32.000000000 -0400
50547@@ -2051,7 +2051,7 @@ void do_balance(struct tree_balance *tb,
50548 return;
50549 }
50550
50551- atomic_inc(&(fs_generation(tb->tb_sb)));
50552+ atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
50553 do_balance_starts(tb);
50554
50555 /* balance leaf returns 0 except if combining L R and S into
50556diff -urNp linux-2.6.39.1/fs/reiserfs/item_ops.c linux-2.6.39.1/fs/reiserfs/item_ops.c
50557--- linux-2.6.39.1/fs/reiserfs/item_ops.c 2011-05-19 00:06:34.000000000 -0400
50558+++ linux-2.6.39.1/fs/reiserfs/item_ops.c 2011-05-22 19:36:32.000000000 -0400
50559@@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
50560 vi->vi_index, vi->vi_type, vi->vi_ih);
50561 }
50562
50563-static struct item_operations stat_data_ops = {
50564+static const struct item_operations stat_data_ops = {
50565 .bytes_number = sd_bytes_number,
50566 .decrement_key = sd_decrement_key,
50567 .is_left_mergeable = sd_is_left_mergeable,
50568@@ -196,7 +196,7 @@ static void direct_print_vi(struct virtu
50569 vi->vi_index, vi->vi_type, vi->vi_ih);
50570 }
50571
50572-static struct item_operations direct_ops = {
50573+static const struct item_operations direct_ops = {
50574 .bytes_number = direct_bytes_number,
50575 .decrement_key = direct_decrement_key,
50576 .is_left_mergeable = direct_is_left_mergeable,
50577@@ -341,7 +341,7 @@ static void indirect_print_vi(struct vir
50578 vi->vi_index, vi->vi_type, vi->vi_ih);
50579 }
50580
50581-static struct item_operations indirect_ops = {
50582+static const struct item_operations indirect_ops = {
50583 .bytes_number = indirect_bytes_number,
50584 .decrement_key = indirect_decrement_key,
50585 .is_left_mergeable = indirect_is_left_mergeable,
50586@@ -628,7 +628,7 @@ static void direntry_print_vi(struct vir
50587 printk("\n");
50588 }
50589
50590-static struct item_operations direntry_ops = {
50591+static const struct item_operations direntry_ops = {
50592 .bytes_number = direntry_bytes_number,
50593 .decrement_key = direntry_decrement_key,
50594 .is_left_mergeable = direntry_is_left_mergeable,
50595@@ -724,7 +724,7 @@ static void errcatch_print_vi(struct vir
50596 "Invalid item type observed, run fsck ASAP");
50597 }
50598
50599-static struct item_operations errcatch_ops = {
50600+static const struct item_operations errcatch_ops = {
50601 errcatch_bytes_number,
50602 errcatch_decrement_key,
50603 errcatch_is_left_mergeable,
50604@@ -746,7 +746,7 @@ static struct item_operations errcatch_o
50605 #error Item types must use disk-format assigned values.
50606 #endif
50607
50608-struct item_operations *item_ops[TYPE_ANY + 1] = {
50609+const struct item_operations * const item_ops[TYPE_ANY + 1] = {
50610 &stat_data_ops,
50611 &indirect_ops,
50612 &direct_ops,
50613diff -urNp linux-2.6.39.1/fs/reiserfs/journal.c linux-2.6.39.1/fs/reiserfs/journal.c
50614--- linux-2.6.39.1/fs/reiserfs/journal.c 2011-05-19 00:06:34.000000000 -0400
50615+++ linux-2.6.39.1/fs/reiserfs/journal.c 2011-05-22 19:36:32.000000000 -0400
50616@@ -2299,6 +2299,8 @@ static struct buffer_head *reiserfs_brea
50617 struct buffer_head *bh;
50618 int i, j;
50619
50620+ pax_track_stack();
50621+
50622 bh = __getblk(dev, block, bufsize);
50623 if (buffer_uptodate(bh))
50624 return (bh);
50625diff -urNp linux-2.6.39.1/fs/reiserfs/namei.c linux-2.6.39.1/fs/reiserfs/namei.c
50626--- linux-2.6.39.1/fs/reiserfs/namei.c 2011-05-19 00:06:34.000000000 -0400
50627+++ linux-2.6.39.1/fs/reiserfs/namei.c 2011-05-22 19:36:32.000000000 -0400
50628@@ -1225,6 +1225,8 @@ static int reiserfs_rename(struct inode
50629 unsigned long savelink = 1;
50630 struct timespec ctime;
50631
50632+ pax_track_stack();
50633+
50634 /* three balancings: (1) old name removal, (2) new name insertion
50635 and (3) maybe "save" link insertion
50636 stat data updates: (1) old directory,
50637diff -urNp linux-2.6.39.1/fs/reiserfs/procfs.c linux-2.6.39.1/fs/reiserfs/procfs.c
50638--- linux-2.6.39.1/fs/reiserfs/procfs.c 2011-05-19 00:06:34.000000000 -0400
50639+++ linux-2.6.39.1/fs/reiserfs/procfs.c 2011-05-22 19:36:32.000000000 -0400
50640@@ -113,7 +113,7 @@ static int show_super(struct seq_file *m
50641 "SMALL_TAILS " : "NO_TAILS ",
50642 replay_only(sb) ? "REPLAY_ONLY " : "",
50643 convert_reiserfs(sb) ? "CONV " : "",
50644- atomic_read(&r->s_generation_counter),
50645+ atomic_read_unchecked(&r->s_generation_counter),
50646 SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
50647 SF(s_do_balance), SF(s_unneeded_left_neighbor),
50648 SF(s_good_search_by_key_reada), SF(s_bmaps),
50649@@ -299,6 +299,8 @@ static int show_journal(struct seq_file
50650 struct journal_params *jp = &rs->s_v1.s_journal;
50651 char b[BDEVNAME_SIZE];
50652
50653+ pax_track_stack();
50654+
50655 seq_printf(m, /* on-disk fields */
50656 "jp_journal_1st_block: \t%i\n"
50657 "jp_journal_dev: \t%s[%x]\n"
50658diff -urNp linux-2.6.39.1/fs/reiserfs/stree.c linux-2.6.39.1/fs/reiserfs/stree.c
50659--- linux-2.6.39.1/fs/reiserfs/stree.c 2011-05-19 00:06:34.000000000 -0400
50660+++ linux-2.6.39.1/fs/reiserfs/stree.c 2011-05-22 19:36:32.000000000 -0400
50661@@ -1196,6 +1196,8 @@ int reiserfs_delete_item(struct reiserfs
50662 int iter = 0;
50663 #endif
50664
50665+ pax_track_stack();
50666+
50667 BUG_ON(!th->t_trans_id);
50668
50669 init_tb_struct(th, &s_del_balance, sb, path,
50670@@ -1333,6 +1335,8 @@ void reiserfs_delete_solid_item(struct r
50671 int retval;
50672 int quota_cut_bytes = 0;
50673
50674+ pax_track_stack();
50675+
50676 BUG_ON(!th->t_trans_id);
50677
50678 le_key2cpu_key(&cpu_key, key);
50679@@ -1562,6 +1566,8 @@ int reiserfs_cut_from_item(struct reiser
50680 int quota_cut_bytes;
50681 loff_t tail_pos = 0;
50682
50683+ pax_track_stack();
50684+
50685 BUG_ON(!th->t_trans_id);
50686
50687 init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
50688@@ -1957,6 +1963,8 @@ int reiserfs_paste_into_item(struct reis
50689 int retval;
50690 int fs_gen;
50691
50692+ pax_track_stack();
50693+
50694 BUG_ON(!th->t_trans_id);
50695
50696 fs_gen = get_generation(inode->i_sb);
50697@@ -2045,6 +2053,8 @@ int reiserfs_insert_item(struct reiserfs
50698 int fs_gen = 0;
50699 int quota_bytes = 0;
50700
50701+ pax_track_stack();
50702+
50703 BUG_ON(!th->t_trans_id);
50704
50705 if (inode) { /* Do we count quotas for item? */
50706diff -urNp linux-2.6.39.1/fs/reiserfs/super.c linux-2.6.39.1/fs/reiserfs/super.c
50707--- linux-2.6.39.1/fs/reiserfs/super.c 2011-05-19 00:06:34.000000000 -0400
50708+++ linux-2.6.39.1/fs/reiserfs/super.c 2011-05-22 19:36:32.000000000 -0400
50709@@ -927,6 +927,8 @@ static int reiserfs_parse_options(struct
50710 {.option_name = NULL}
50711 };
50712
50713+ pax_track_stack();
50714+
50715 *blocks = 0;
50716 if (!options || !*options)
50717 /* use default configuration: create tails, journaling on, no
50718diff -urNp linux-2.6.39.1/fs/select.c linux-2.6.39.1/fs/select.c
50719--- linux-2.6.39.1/fs/select.c 2011-05-19 00:06:34.000000000 -0400
50720+++ linux-2.6.39.1/fs/select.c 2011-05-22 19:41:42.000000000 -0400
50721@@ -20,6 +20,7 @@
50722 #include <linux/module.h>
50723 #include <linux/slab.h>
50724 #include <linux/poll.h>
50725+#include <linux/security.h>
50726 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
50727 #include <linux/file.h>
50728 #include <linux/fdtable.h>
50729@@ -403,6 +404,8 @@ int do_select(int n, fd_set_bits *fds, s
50730 int retval, i, timed_out = 0;
50731 unsigned long slack = 0;
50732
50733+ pax_track_stack();
50734+
50735 rcu_read_lock();
50736 retval = max_select_fd(n, fds);
50737 rcu_read_unlock();
50738@@ -528,6 +531,8 @@ int core_sys_select(int n, fd_set __user
50739 /* Allocate small arguments on the stack to save memory and be faster */
50740 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
50741
50742+ pax_track_stack();
50743+
50744 ret = -EINVAL;
50745 if (n < 0)
50746 goto out_nofds;
50747@@ -837,6 +842,9 @@ int do_sys_poll(struct pollfd __user *uf
50748 struct poll_list *walk = head;
50749 unsigned long todo = nfds;
50750
50751+ pax_track_stack();
50752+
50753+ gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
50754 if (nfds > rlimit(RLIMIT_NOFILE))
50755 return -EINVAL;
50756
50757diff -urNp linux-2.6.39.1/fs/seq_file.c linux-2.6.39.1/fs/seq_file.c
50758--- linux-2.6.39.1/fs/seq_file.c 2011-05-19 00:06:34.000000000 -0400
50759+++ linux-2.6.39.1/fs/seq_file.c 2011-05-22 19:36:32.000000000 -0400
50760@@ -76,7 +76,8 @@ static int traverse(struct seq_file *m,
50761 return 0;
50762 }
50763 if (!m->buf) {
50764- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
50765+ m->size = PAGE_SIZE;
50766+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
50767 if (!m->buf)
50768 return -ENOMEM;
50769 }
50770@@ -116,7 +117,8 @@ static int traverse(struct seq_file *m,
50771 Eoverflow:
50772 m->op->stop(m, p);
50773 kfree(m->buf);
50774- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
50775+ m->size <<= 1;
50776+ m->buf = kmalloc(m->size, GFP_KERNEL);
50777 return !m->buf ? -ENOMEM : -EAGAIN;
50778 }
50779
50780@@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
50781 m->version = file->f_version;
50782 /* grab buffer if we didn't have one */
50783 if (!m->buf) {
50784- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
50785+ m->size = PAGE_SIZE;
50786+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
50787 if (!m->buf)
50788 goto Enomem;
50789 }
50790@@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
50791 goto Fill;
50792 m->op->stop(m, p);
50793 kfree(m->buf);
50794- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
50795+ m->size <<= 1;
50796+ m->buf = kmalloc(m->size, GFP_KERNEL);
50797 if (!m->buf)
50798 goto Enomem;
50799 m->count = 0;
50800diff -urNp linux-2.6.39.1/fs/splice.c linux-2.6.39.1/fs/splice.c
50801--- linux-2.6.39.1/fs/splice.c 2011-05-19 00:06:34.000000000 -0400
50802+++ linux-2.6.39.1/fs/splice.c 2011-05-22 19:36:32.000000000 -0400
50803@@ -186,7 +186,7 @@ ssize_t splice_to_pipe(struct pipe_inode
50804 pipe_lock(pipe);
50805
50806 for (;;) {
50807- if (!pipe->readers) {
50808+ if (!atomic_read(&pipe->readers)) {
50809 send_sig(SIGPIPE, current, 0);
50810 if (!ret)
50811 ret = -EPIPE;
50812@@ -240,9 +240,9 @@ ssize_t splice_to_pipe(struct pipe_inode
50813 do_wakeup = 0;
50814 }
50815
50816- pipe->waiting_writers++;
50817+ atomic_inc(&pipe->waiting_writers);
50818 pipe_wait(pipe);
50819- pipe->waiting_writers--;
50820+ atomic_dec(&pipe->waiting_writers);
50821 }
50822
50823 pipe_unlock(pipe);
50824@@ -316,6 +316,8 @@ __generic_file_splice_read(struct file *
50825 .spd_release = spd_release_page,
50826 };
50827
50828+ pax_track_stack();
50829+
50830 if (splice_grow_spd(pipe, &spd))
50831 return -ENOMEM;
50832
50833@@ -556,7 +558,7 @@ static ssize_t kernel_readv(struct file
50834 old_fs = get_fs();
50835 set_fs(get_ds());
50836 /* The cast to a user pointer is valid due to the set_fs() */
50837- res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
50838+ res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos);
50839 set_fs(old_fs);
50840
50841 return res;
50842@@ -571,7 +573,7 @@ static ssize_t kernel_write(struct file
50843 old_fs = get_fs();
50844 set_fs(get_ds());
50845 /* The cast to a user pointer is valid due to the set_fs() */
50846- res = vfs_write(file, (const char __user *)buf, count, &pos);
50847+ res = vfs_write(file, (__force const char __user *)buf, count, &pos);
50848 set_fs(old_fs);
50849
50850 return res;
50851@@ -599,6 +601,8 @@ ssize_t default_file_splice_read(struct
50852 .spd_release = spd_release_page,
50853 };
50854
50855+ pax_track_stack();
50856+
50857 if (splice_grow_spd(pipe, &spd))
50858 return -ENOMEM;
50859
50860@@ -622,7 +626,7 @@ ssize_t default_file_splice_read(struct
50861 goto err;
50862
50863 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
50864- vec[i].iov_base = (void __user *) page_address(page);
50865+ vec[i].iov_base = (__force void __user *) page_address(page);
50866 vec[i].iov_len = this_len;
50867 spd.pages[i] = page;
50868 spd.nr_pages++;
50869@@ -842,10 +846,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
50870 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
50871 {
50872 while (!pipe->nrbufs) {
50873- if (!pipe->writers)
50874+ if (!atomic_read(&pipe->writers))
50875 return 0;
50876
50877- if (!pipe->waiting_writers && sd->num_spliced)
50878+ if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
50879 return 0;
50880
50881 if (sd->flags & SPLICE_F_NONBLOCK)
50882@@ -1178,7 +1182,7 @@ ssize_t splice_direct_to_actor(struct fi
50883 * out of the pipe right after the splice_to_pipe(). So set
50884 * PIPE_READERS appropriately.
50885 */
50886- pipe->readers = 1;
50887+ atomic_set(&pipe->readers, 1);
50888
50889 current->splice_pipe = pipe;
50890 }
50891@@ -1615,6 +1619,8 @@ static long vmsplice_to_pipe(struct file
50892 };
50893 long ret;
50894
50895+ pax_track_stack();
50896+
50897 pipe = get_pipe_info(file);
50898 if (!pipe)
50899 return -EBADF;
50900@@ -1730,9 +1736,9 @@ static int ipipe_prep(struct pipe_inode_
50901 ret = -ERESTARTSYS;
50902 break;
50903 }
50904- if (!pipe->writers)
50905+ if (!atomic_read(&pipe->writers))
50906 break;
50907- if (!pipe->waiting_writers) {
50908+ if (!atomic_read(&pipe->waiting_writers)) {
50909 if (flags & SPLICE_F_NONBLOCK) {
50910 ret = -EAGAIN;
50911 break;
50912@@ -1764,7 +1770,7 @@ static int opipe_prep(struct pipe_inode_
50913 pipe_lock(pipe);
50914
50915 while (pipe->nrbufs >= pipe->buffers) {
50916- if (!pipe->readers) {
50917+ if (!atomic_read(&pipe->readers)) {
50918 send_sig(SIGPIPE, current, 0);
50919 ret = -EPIPE;
50920 break;
50921@@ -1777,9 +1783,9 @@ static int opipe_prep(struct pipe_inode_
50922 ret = -ERESTARTSYS;
50923 break;
50924 }
50925- pipe->waiting_writers++;
50926+ atomic_inc(&pipe->waiting_writers);
50927 pipe_wait(pipe);
50928- pipe->waiting_writers--;
50929+ atomic_dec(&pipe->waiting_writers);
50930 }
50931
50932 pipe_unlock(pipe);
50933@@ -1815,14 +1821,14 @@ retry:
50934 pipe_double_lock(ipipe, opipe);
50935
50936 do {
50937- if (!opipe->readers) {
50938+ if (!atomic_read(&opipe->readers)) {
50939 send_sig(SIGPIPE, current, 0);
50940 if (!ret)
50941 ret = -EPIPE;
50942 break;
50943 }
50944
50945- if (!ipipe->nrbufs && !ipipe->writers)
50946+ if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
50947 break;
50948
50949 /*
50950@@ -1922,7 +1928,7 @@ static int link_pipe(struct pipe_inode_i
50951 pipe_double_lock(ipipe, opipe);
50952
50953 do {
50954- if (!opipe->readers) {
50955+ if (!atomic_read(&opipe->readers)) {
50956 send_sig(SIGPIPE, current, 0);
50957 if (!ret)
50958 ret = -EPIPE;
50959@@ -1967,7 +1973,7 @@ static int link_pipe(struct pipe_inode_i
50960 * return EAGAIN if we have the potential of some data in the
50961 * future, otherwise just return 0
50962 */
50963- if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
50964+ if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
50965 ret = -EAGAIN;
50966
50967 pipe_unlock(ipipe);
50968diff -urNp linux-2.6.39.1/fs/sysfs/file.c linux-2.6.39.1/fs/sysfs/file.c
50969--- linux-2.6.39.1/fs/sysfs/file.c 2011-05-19 00:06:34.000000000 -0400
50970+++ linux-2.6.39.1/fs/sysfs/file.c 2011-05-22 19:36:32.000000000 -0400
50971@@ -44,7 +44,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent
50972
50973 struct sysfs_open_dirent {
50974 atomic_t refcnt;
50975- atomic_t event;
50976+ atomic_unchecked_t event;
50977 wait_queue_head_t poll;
50978 struct list_head buffers; /* goes through sysfs_buffer.list */
50979 };
50980@@ -88,7 +88,7 @@ static int fill_read_buffer(struct dentr
50981 if (!sysfs_get_active(attr_sd))
50982 return -ENODEV;
50983
50984- buffer->event = atomic_read(&attr_sd->s_attr.open->event);
50985+ buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
50986 count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
50987
50988 sysfs_put_active(attr_sd);
50989@@ -294,7 +294,7 @@ static int sysfs_get_open_dirent(struct
50990 return -ENOMEM;
50991
50992 atomic_set(&new_od->refcnt, 0);
50993- atomic_set(&new_od->event, 1);
50994+ atomic_set_unchecked(&new_od->event, 1);
50995 init_waitqueue_head(&new_od->poll);
50996 INIT_LIST_HEAD(&new_od->buffers);
50997 goto retry;
50998@@ -444,7 +444,7 @@ static unsigned int sysfs_poll(struct fi
50999
51000 sysfs_put_active(attr_sd);
51001
51002- if (buffer->event != atomic_read(&od->event))
51003+ if (buffer->event != atomic_read_unchecked(&od->event))
51004 goto trigger;
51005
51006 return DEFAULT_POLLMASK;
51007@@ -463,7 +463,7 @@ void sysfs_notify_dirent(struct sysfs_di
51008
51009 od = sd->s_attr.open;
51010 if (od) {
51011- atomic_inc(&od->event);
51012+ atomic_inc_unchecked(&od->event);
51013 wake_up_interruptible(&od->poll);
51014 }
51015
51016diff -urNp linux-2.6.39.1/fs/sysfs/mount.c linux-2.6.39.1/fs/sysfs/mount.c
51017--- linux-2.6.39.1/fs/sysfs/mount.c 2011-05-19 00:06:34.000000000 -0400
51018+++ linux-2.6.39.1/fs/sysfs/mount.c 2011-05-22 19:41:42.000000000 -0400
51019@@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
51020 .s_name = "",
51021 .s_count = ATOMIC_INIT(1),
51022 .s_flags = SYSFS_DIR | (KOBJ_NS_TYPE_NONE << SYSFS_NS_TYPE_SHIFT),
51023+#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
51024+ .s_mode = S_IFDIR | S_IRWXU,
51025+#else
51026 .s_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
51027+#endif
51028 .s_ino = 1,
51029 };
51030
51031diff -urNp linux-2.6.39.1/fs/sysfs/symlink.c linux-2.6.39.1/fs/sysfs/symlink.c
51032--- linux-2.6.39.1/fs/sysfs/symlink.c 2011-05-19 00:06:34.000000000 -0400
51033+++ linux-2.6.39.1/fs/sysfs/symlink.c 2011-05-22 19:36:32.000000000 -0400
51034@@ -286,7 +286,7 @@ static void *sysfs_follow_link(struct de
51035
51036 static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
51037 {
51038- char *page = nd_get_link(nd);
51039+ const char *page = nd_get_link(nd);
51040 if (!IS_ERR(page))
51041 free_page((unsigned long)page);
51042 }
51043diff -urNp linux-2.6.39.1/fs/udf/inode.c linux-2.6.39.1/fs/udf/inode.c
51044--- linux-2.6.39.1/fs/udf/inode.c 2011-05-19 00:06:34.000000000 -0400
51045+++ linux-2.6.39.1/fs/udf/inode.c 2011-05-22 19:36:32.000000000 -0400
51046@@ -560,6 +560,8 @@ static struct buffer_head *inode_getblk(
51047 int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
51048 int lastblock = 0;
51049
51050+ pax_track_stack();
51051+
51052 prev_epos.offset = udf_file_entry_alloc_offset(inode);
51053 prev_epos.block = iinfo->i_location;
51054 prev_epos.bh = NULL;
51055diff -urNp linux-2.6.39.1/fs/udf/misc.c linux-2.6.39.1/fs/udf/misc.c
51056--- linux-2.6.39.1/fs/udf/misc.c 2011-05-19 00:06:34.000000000 -0400
51057+++ linux-2.6.39.1/fs/udf/misc.c 2011-05-22 19:36:32.000000000 -0400
51058@@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t id
51059
51060 u8 udf_tag_checksum(const struct tag *t)
51061 {
51062- u8 *data = (u8 *)t;
51063+ const u8 *data = (const u8 *)t;
51064 u8 checksum = 0;
51065 int i;
51066 for (i = 0; i < sizeof(struct tag); ++i)
51067diff -urNp linux-2.6.39.1/fs/utimes.c linux-2.6.39.1/fs/utimes.c
51068--- linux-2.6.39.1/fs/utimes.c 2011-05-19 00:06:34.000000000 -0400
51069+++ linux-2.6.39.1/fs/utimes.c 2011-05-22 19:41:42.000000000 -0400
51070@@ -1,6 +1,7 @@
51071 #include <linux/compiler.h>
51072 #include <linux/file.h>
51073 #include <linux/fs.h>
51074+#include <linux/security.h>
51075 #include <linux/linkage.h>
51076 #include <linux/mount.h>
51077 #include <linux/namei.h>
51078@@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
51079 goto mnt_drop_write_and_out;
51080 }
51081 }
51082+
51083+ if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
51084+ error = -EACCES;
51085+ goto mnt_drop_write_and_out;
51086+ }
51087+
51088 mutex_lock(&inode->i_mutex);
51089 error = notify_change(path->dentry, &newattrs);
51090 mutex_unlock(&inode->i_mutex);
51091diff -urNp linux-2.6.39.1/fs/xattr_acl.c linux-2.6.39.1/fs/xattr_acl.c
51092--- linux-2.6.39.1/fs/xattr_acl.c 2011-05-19 00:06:34.000000000 -0400
51093+++ linux-2.6.39.1/fs/xattr_acl.c 2011-05-22 19:36:32.000000000 -0400
51094@@ -17,8 +17,8 @@
51095 struct posix_acl *
51096 posix_acl_from_xattr(const void *value, size_t size)
51097 {
51098- posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
51099- posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
51100+ const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
51101+ const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
51102 int count;
51103 struct posix_acl *acl;
51104 struct posix_acl_entry *acl_e;
51105diff -urNp linux-2.6.39.1/fs/xattr.c linux-2.6.39.1/fs/xattr.c
51106--- linux-2.6.39.1/fs/xattr.c 2011-05-19 00:06:34.000000000 -0400
51107+++ linux-2.6.39.1/fs/xattr.c 2011-05-22 19:41:42.000000000 -0400
51108@@ -247,7 +247,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
51109 * Extended attribute SET operations
51110 */
51111 static long
51112-setxattr(struct dentry *d, const char __user *name, const void __user *value,
51113+setxattr(struct path *path, const char __user *name, const void __user *value,
51114 size_t size, int flags)
51115 {
51116 int error;
51117@@ -271,7 +271,13 @@ setxattr(struct dentry *d, const char __
51118 return PTR_ERR(kvalue);
51119 }
51120
51121- error = vfs_setxattr(d, kname, kvalue, size, flags);
51122+ if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
51123+ error = -EACCES;
51124+ goto out;
51125+ }
51126+
51127+ error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
51128+out:
51129 kfree(kvalue);
51130 return error;
51131 }
51132@@ -288,7 +294,7 @@ SYSCALL_DEFINE5(setxattr, const char __u
51133 return error;
51134 error = mnt_want_write(path.mnt);
51135 if (!error) {
51136- error = setxattr(path.dentry, name, value, size, flags);
51137+ error = setxattr(&path, name, value, size, flags);
51138 mnt_drop_write(path.mnt);
51139 }
51140 path_put(&path);
51141@@ -307,7 +313,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __
51142 return error;
51143 error = mnt_want_write(path.mnt);
51144 if (!error) {
51145- error = setxattr(path.dentry, name, value, size, flags);
51146+ error = setxattr(&path, name, value, size, flags);
51147 mnt_drop_write(path.mnt);
51148 }
51149 path_put(&path);
51150@@ -318,17 +324,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons
51151 const void __user *,value, size_t, size, int, flags)
51152 {
51153 struct file *f;
51154- struct dentry *dentry;
51155 int error = -EBADF;
51156
51157 f = fget(fd);
51158 if (!f)
51159 return error;
51160- dentry = f->f_path.dentry;
51161- audit_inode(NULL, dentry);
51162+ audit_inode(NULL, f->f_path.dentry);
51163 error = mnt_want_write_file(f);
51164 if (!error) {
51165- error = setxattr(dentry, name, value, size, flags);
51166+ error = setxattr(&f->f_path, name, value, size, flags);
51167 mnt_drop_write(f->f_path.mnt);
51168 }
51169 fput(f);
51170diff -urNp linux-2.6.39.1/fs/xfs/linux-2.6/xfs_ioctl32.c linux-2.6.39.1/fs/xfs/linux-2.6/xfs_ioctl32.c
51171--- linux-2.6.39.1/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-05-19 00:06:34.000000000 -0400
51172+++ linux-2.6.39.1/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-05-22 19:41:42.000000000 -0400
51173@@ -73,6 +73,7 @@ xfs_compat_ioc_fsgeometry_v1(
51174 xfs_fsop_geom_t fsgeo;
51175 int error;
51176
51177+ memset(&fsgeo, 0, sizeof(fsgeo));
51178 error = xfs_fs_geometry(mp, &fsgeo, 3);
51179 if (error)
51180 return -error;
51181diff -urNp linux-2.6.39.1/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.39.1/fs/xfs/linux-2.6/xfs_ioctl.c
51182--- linux-2.6.39.1/fs/xfs/linux-2.6/xfs_ioctl.c 2011-05-19 00:06:34.000000000 -0400
51183+++ linux-2.6.39.1/fs/xfs/linux-2.6/xfs_ioctl.c 2011-05-22 19:36:32.000000000 -0400
51184@@ -128,7 +128,7 @@ xfs_find_handle(
51185 }
51186
51187 error = -EFAULT;
51188- if (copy_to_user(hreq->ohandle, &handle, hsize) ||
51189+ if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
51190 copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
51191 goto out_put;
51192
51193diff -urNp linux-2.6.39.1/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.39.1/fs/xfs/linux-2.6/xfs_iops.c
51194--- linux-2.6.39.1/fs/xfs/linux-2.6/xfs_iops.c 2011-05-19 00:06:34.000000000 -0400
51195+++ linux-2.6.39.1/fs/xfs/linux-2.6/xfs_iops.c 2011-05-22 19:36:32.000000000 -0400
51196@@ -437,7 +437,7 @@ xfs_vn_put_link(
51197 struct nameidata *nd,
51198 void *p)
51199 {
51200- char *s = nd_get_link(nd);
51201+ const char *s = nd_get_link(nd);
51202
51203 if (!IS_ERR(s))
51204 kfree(s);
51205diff -urNp linux-2.6.39.1/fs/xfs/xfs_bmap.c linux-2.6.39.1/fs/xfs/xfs_bmap.c
51206--- linux-2.6.39.1/fs/xfs/xfs_bmap.c 2011-05-19 00:06:34.000000000 -0400
51207+++ linux-2.6.39.1/fs/xfs/xfs_bmap.c 2011-05-22 19:36:32.000000000 -0400
51208@@ -287,7 +287,7 @@ xfs_bmap_validate_ret(
51209 int nmap,
51210 int ret_nmap);
51211 #else
51212-#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
51213+#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
51214 #endif /* DEBUG */
51215
51216 STATIC int
51217diff -urNp linux-2.6.39.1/fs/xfs/xfs_dir2.c linux-2.6.39.1/fs/xfs/xfs_dir2.c
51218--- linux-2.6.39.1/fs/xfs/xfs_dir2.c 2011-05-19 00:06:34.000000000 -0400
51219+++ linux-2.6.39.1/fs/xfs/xfs_dir2.c 2011-05-22 19:36:32.000000000 -0400
51220@@ -85,7 +85,7 @@ xfs_ascii_ci_compname(
51221 return result;
51222 }
51223
51224-static struct xfs_nameops xfs_ascii_ci_nameops = {
51225+static const struct xfs_nameops xfs_ascii_ci_nameops = {
51226 .hashname = xfs_ascii_ci_hashname,
51227 .compname = xfs_ascii_ci_compname,
51228 };
51229diff -urNp linux-2.6.39.1/fs/xfs/xfs_dir2_sf.c linux-2.6.39.1/fs/xfs/xfs_dir2_sf.c
51230--- linux-2.6.39.1/fs/xfs/xfs_dir2_sf.c 2011-05-19 00:06:34.000000000 -0400
51231+++ linux-2.6.39.1/fs/xfs/xfs_dir2_sf.c 2011-05-22 19:36:32.000000000 -0400
51232@@ -780,7 +780,15 @@ xfs_dir2_sf_getdents(
51233 }
51234
51235 ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
51236- if (filldir(dirent, (char *)sfep->name, sfep->namelen,
51237+ if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
51238+ char name[sfep->namelen];
51239+ memcpy(name, sfep->name, sfep->namelen);
51240+ if (filldir(dirent, name, sfep->namelen,
51241+ off & 0x7fffffff, ino, DT_UNKNOWN)) {
51242+ *offset = off & 0x7fffffff;
51243+ return 0;
51244+ }
51245+ } else if (filldir(dirent, (char *)sfep->name, sfep->namelen,
51246 off & 0x7fffffff, ino, DT_UNKNOWN)) {
51247 *offset = off & 0x7fffffff;
51248 return 0;
51249diff -urNp linux-2.6.39.1/grsecurity/gracl_alloc.c linux-2.6.39.1/grsecurity/gracl_alloc.c
51250--- linux-2.6.39.1/grsecurity/gracl_alloc.c 1969-12-31 19:00:00.000000000 -0500
51251+++ linux-2.6.39.1/grsecurity/gracl_alloc.c 2011-05-22 19:41:42.000000000 -0400
51252@@ -0,0 +1,105 @@
51253+#include <linux/kernel.h>
51254+#include <linux/mm.h>
51255+#include <linux/slab.h>
51256+#include <linux/vmalloc.h>
51257+#include <linux/gracl.h>
51258+#include <linux/grsecurity.h>
51259+
51260+static unsigned long alloc_stack_next = 1;
51261+static unsigned long alloc_stack_size = 1;
51262+static void **alloc_stack;
51263+
51264+static __inline__ int
51265+alloc_pop(void)
51266+{
51267+ if (alloc_stack_next == 1)
51268+ return 0;
51269+
51270+ kfree(alloc_stack[alloc_stack_next - 2]);
51271+
51272+ alloc_stack_next--;
51273+
51274+ return 1;
51275+}
51276+
51277+static __inline__ int
51278+alloc_push(void *buf)
51279+{
51280+ if (alloc_stack_next >= alloc_stack_size)
51281+ return 1;
51282+
51283+ alloc_stack[alloc_stack_next - 1] = buf;
51284+
51285+ alloc_stack_next++;
51286+
51287+ return 0;
51288+}
51289+
51290+void *
51291+acl_alloc(unsigned long len)
51292+{
51293+ void *ret = NULL;
51294+
51295+ if (!len || len > PAGE_SIZE)
51296+ goto out;
51297+
51298+ ret = kmalloc(len, GFP_KERNEL);
51299+
51300+ if (ret) {
51301+ if (alloc_push(ret)) {
51302+ kfree(ret);
51303+ ret = NULL;
51304+ }
51305+ }
51306+
51307+out:
51308+ return ret;
51309+}
51310+
51311+void *
51312+acl_alloc_num(unsigned long num, unsigned long len)
51313+{
51314+ if (!len || (num > (PAGE_SIZE / len)))
51315+ return NULL;
51316+
51317+ return acl_alloc(num * len);
51318+}
51319+
51320+void
51321+acl_free_all(void)
51322+{
51323+ if (gr_acl_is_enabled() || !alloc_stack)
51324+ return;
51325+
51326+ while (alloc_pop()) ;
51327+
51328+ if (alloc_stack) {
51329+ if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
51330+ kfree(alloc_stack);
51331+ else
51332+ vfree(alloc_stack);
51333+ }
51334+
51335+ alloc_stack = NULL;
51336+ alloc_stack_size = 1;
51337+ alloc_stack_next = 1;
51338+
51339+ return;
51340+}
51341+
51342+int
51343+acl_alloc_stack_init(unsigned long size)
51344+{
51345+ if ((size * sizeof (void *)) <= PAGE_SIZE)
51346+ alloc_stack =
51347+ (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
51348+ else
51349+ alloc_stack = (void **) vmalloc(size * sizeof (void *));
51350+
51351+ alloc_stack_size = size;
51352+
51353+ if (!alloc_stack)
51354+ return 0;
51355+ else
51356+ return 1;
51357+}
51358diff -urNp linux-2.6.39.1/grsecurity/gracl.c linux-2.6.39.1/grsecurity/gracl.c
51359--- linux-2.6.39.1/grsecurity/gracl.c 1969-12-31 19:00:00.000000000 -0500
51360+++ linux-2.6.39.1/grsecurity/gracl.c 2011-05-24 20:27:30.000000000 -0400
51361@@ -0,0 +1,4103 @@
51362+#include <linux/kernel.h>
51363+#include <linux/module.h>
51364+#include <linux/sched.h>
51365+#include <linux/mm.h>
51366+#include <linux/file.h>
51367+#include <linux/fs.h>
51368+#include <linux/namei.h>
51369+#include <linux/mount.h>
51370+#include <linux/tty.h>
51371+#include <linux/proc_fs.h>
51372+#include <linux/lglock.h>
51373+#include <linux/slab.h>
51374+#include <linux/vmalloc.h>
51375+#include <linux/types.h>
51376+#include <linux/sysctl.h>
51377+#include <linux/netdevice.h>
51378+#include <linux/ptrace.h>
51379+#include <linux/gracl.h>
51380+#include <linux/gralloc.h>
51381+#include <linux/grsecurity.h>
51382+#include <linux/grinternal.h>
51383+#include <linux/pid_namespace.h>
51384+#include <linux/fdtable.h>
51385+#include <linux/percpu.h>
51386+
51387+#include <asm/uaccess.h>
51388+#include <asm/errno.h>
51389+#include <asm/mman.h>
51390+
51391+static struct acl_role_db acl_role_set;
51392+static struct name_db name_set;
51393+static struct inodev_db inodev_set;
51394+
51395+/* for keeping track of userspace pointers used for subjects, so we
51396+ can share references in the kernel as well
51397+*/
51398+
51399+static struct path real_root;
51400+
51401+static struct acl_subj_map_db subj_map_set;
51402+
51403+static struct acl_role_label *default_role;
51404+
51405+static struct acl_role_label *role_list;
51406+
51407+static u16 acl_sp_role_value;
51408+
51409+extern char *gr_shared_page[4];
51410+static DEFINE_MUTEX(gr_dev_mutex);
51411+DEFINE_RWLOCK(gr_inode_lock);
51412+
51413+struct gr_arg *gr_usermode;
51414+
51415+static unsigned int gr_status __read_only = GR_STATUS_INIT;
51416+
51417+extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
51418+extern void gr_clear_learn_entries(void);
51419+
51420+#ifdef CONFIG_GRKERNSEC_RESLOG
51421+extern void gr_log_resource(const struct task_struct *task,
51422+ const int res, const unsigned long wanted, const int gt);
51423+#endif
51424+
51425+unsigned char *gr_system_salt;
51426+unsigned char *gr_system_sum;
51427+
51428+static struct sprole_pw **acl_special_roles = NULL;
51429+static __u16 num_sprole_pws = 0;
51430+
51431+static struct acl_role_label *kernel_role = NULL;
51432+
51433+static unsigned int gr_auth_attempts = 0;
51434+static unsigned long gr_auth_expires = 0UL;
51435+
51436+#ifdef CONFIG_NET
51437+extern struct vfsmount *sock_mnt;
51438+#endif
51439+
51440+extern struct vfsmount *pipe_mnt;
51441+extern struct vfsmount *shm_mnt;
51442+#ifdef CONFIG_HUGETLBFS
51443+extern struct vfsmount *hugetlbfs_vfsmount;
51444+#endif
51445+
51446+static struct acl_object_label *fakefs_obj;
51447+
51448+extern int gr_init_uidset(void);
51449+extern void gr_free_uidset(void);
51450+extern void gr_remove_uid(uid_t uid);
51451+extern int gr_find_uid(uid_t uid);
51452+
51453+DECLARE_BRLOCK(vfsmount_lock);
51454+
51455+__inline__ int
51456+gr_acl_is_enabled(void)
51457+{
51458+ return (gr_status & GR_READY);
51459+}
51460+
51461+#ifdef CONFIG_BTRFS_FS
51462+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
51463+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
51464+#endif
51465+
51466+static inline dev_t __get_dev(const struct dentry *dentry)
51467+{
51468+#ifdef CONFIG_BTRFS_FS
51469+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
51470+ return get_btrfs_dev_from_inode(dentry->d_inode);
51471+ else
51472+#endif
51473+ return dentry->d_inode->i_sb->s_dev;
51474+}
51475+
51476+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
51477+{
51478+ return __get_dev(dentry);
51479+}
51480+
51481+static char gr_task_roletype_to_char(struct task_struct *task)
51482+{
51483+ switch (task->role->roletype &
51484+ (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
51485+ GR_ROLE_SPECIAL)) {
51486+ case GR_ROLE_DEFAULT:
51487+ return 'D';
51488+ case GR_ROLE_USER:
51489+ return 'U';
51490+ case GR_ROLE_GROUP:
51491+ return 'G';
51492+ case GR_ROLE_SPECIAL:
51493+ return 'S';
51494+ }
51495+
51496+ return 'X';
51497+}
51498+
51499+char gr_roletype_to_char(void)
51500+{
51501+ return gr_task_roletype_to_char(current);
51502+}
51503+
51504+__inline__ int
51505+gr_acl_tpe_check(void)
51506+{
51507+ if (unlikely(!(gr_status & GR_READY)))
51508+ return 0;
51509+ if (current->role->roletype & GR_ROLE_TPE)
51510+ return 1;
51511+ else
51512+ return 0;
51513+}
51514+
51515+int
51516+gr_handle_rawio(const struct inode *inode)
51517+{
51518+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
51519+ if (inode && S_ISBLK(inode->i_mode) &&
51520+ grsec_enable_chroot_caps && proc_is_chrooted(current) &&
51521+ !capable(CAP_SYS_RAWIO))
51522+ return 1;
51523+#endif
51524+ return 0;
51525+}
51526+
51527+static int
51528+gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
51529+{
51530+ if (likely(lena != lenb))
51531+ return 0;
51532+
51533+ return !memcmp(a, b, lena);
51534+}
51535+
51536+static int prepend(char **buffer, int *buflen, const char *str, int namelen)
51537+{
51538+ *buflen -= namelen;
51539+ if (*buflen < 0)
51540+ return -ENAMETOOLONG;
51541+ *buffer -= namelen;
51542+ memcpy(*buffer, str, namelen);
51543+ return 0;
51544+}
51545+
51546+static int prepend_name(char **buffer, int *buflen, struct qstr *name)
51547+{
51548+ return prepend(buffer, buflen, name->name, name->len);
51549+}
51550+
51551+static int prepend_path(const struct path *path, struct path *root,
51552+ char **buffer, int *buflen)
51553+{
51554+ struct dentry *dentry = path->dentry;
51555+ struct vfsmount *vfsmnt = path->mnt;
51556+ bool slash = false;
51557+ int error = 0;
51558+
51559+ while (dentry != root->dentry || vfsmnt != root->mnt) {
51560+ struct dentry * parent;
51561+
51562+ if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
51563+ /* Global root? */
51564+ if (vfsmnt->mnt_parent == vfsmnt) {
51565+ goto out;
51566+ }
51567+ dentry = vfsmnt->mnt_mountpoint;
51568+ vfsmnt = vfsmnt->mnt_parent;
51569+ continue;
51570+ }
51571+ parent = dentry->d_parent;
51572+ prefetch(parent);
51573+ spin_lock(&dentry->d_lock);
51574+ error = prepend_name(buffer, buflen, &dentry->d_name);
51575+ spin_unlock(&dentry->d_lock);
51576+ if (!error)
51577+ error = prepend(buffer, buflen, "/", 1);
51578+ if (error)
51579+ break;
51580+
51581+ slash = true;
51582+ dentry = parent;
51583+ }
51584+
51585+out:
51586+ if (!error && !slash)
51587+ error = prepend(buffer, buflen, "/", 1);
51588+
51589+ return error;
51590+}
51591+
51592+/* this must be called with vfsmount_lock and rename_lock held */
51593+
51594+static char *__our_d_path(const struct path *path, struct path *root,
51595+ char *buf, int buflen)
51596+{
51597+ char *res = buf + buflen;
51598+ int error;
51599+
51600+ prepend(&res, &buflen, "\0", 1);
51601+ error = prepend_path(path, root, &res, &buflen);
51602+ if (error)
51603+ return ERR_PTR(error);
51604+
51605+ return res;
51606+}
51607+
51608+static char *
51609+gen_full_path(struct path *path, struct path *root, char *buf, int buflen)
51610+{
51611+ char *retval;
51612+
51613+ retval = __our_d_path(path, root, buf, buflen);
51614+ if (unlikely(IS_ERR(retval)))
51615+ retval = strcpy(buf, "<path too long>");
51616+ else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
51617+ retval[1] = '\0';
51618+
51619+ return retval;
51620+}
51621+
51622+static char *
51623+__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
51624+ char *buf, int buflen)
51625+{
51626+ struct path path;
51627+ char *res;
51628+
51629+ path.dentry = (struct dentry *)dentry;
51630+ path.mnt = (struct vfsmount *)vfsmnt;
51631+
51632+ /* we can use real_root.dentry, real_root.mnt, because this is only called
51633+ by the RBAC system */
51634+ res = gen_full_path(&path, &real_root, buf, buflen);
51635+
51636+ return res;
51637+}
51638+
51639+static char *
51640+d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
51641+ char *buf, int buflen)
51642+{
51643+ char *res;
51644+ struct path path;
51645+ struct path root;
51646+ struct task_struct *reaper = &init_task;
51647+
51648+ path.dentry = (struct dentry *)dentry;
51649+ path.mnt = (struct vfsmount *)vfsmnt;
51650+
51651+ /* we can't use real_root.dentry, real_root.mnt, because they belong only to the RBAC system */
51652+ get_fs_root(reaper->fs, &root);
51653+
51654+ write_seqlock(&rename_lock);
51655+ br_read_lock(vfsmount_lock);
51656+ res = gen_full_path(&path, &root, buf, buflen);
51657+ br_read_unlock(vfsmount_lock);
51658+ write_sequnlock(&rename_lock);
51659+
51660+ path_put(&root);
51661+ return res;
51662+}
51663+
51664+static char *
51665+gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
51666+{
51667+ char *ret;
51668+ write_seqlock(&rename_lock);
51669+ br_read_lock(vfsmount_lock);
51670+ ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51671+ PAGE_SIZE);
51672+ br_read_unlock(vfsmount_lock);
51673+ write_sequnlock(&rename_lock);
51674+ return ret;
51675+}
51676+
51677+char *
51678+gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
51679+{
51680+ return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51681+ PAGE_SIZE);
51682+}
51683+
51684+char *
51685+gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
51686+{
51687+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
51688+ PAGE_SIZE);
51689+}
51690+
51691+char *
51692+gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
51693+{
51694+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
51695+ PAGE_SIZE);
51696+}
51697+
51698+char *
51699+gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
51700+{
51701+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
51702+ PAGE_SIZE);
51703+}
51704+
51705+char *
51706+gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
51707+{
51708+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
51709+ PAGE_SIZE);
51710+}
51711+
51712+__inline__ __u32
51713+to_gr_audit(const __u32 reqmode)
51714+{
51715+ /* masks off auditable permission flags, then shifts them to create
51716+ auditing flags, and adds the special case of append auditing if
51717+ we're requesting write */
51718+ return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
51719+}
51720+
51721+struct acl_subject_label *
51722+lookup_subject_map(const struct acl_subject_label *userp)
51723+{
51724+ unsigned int index = shash(userp, subj_map_set.s_size);
51725+ struct subject_map *match;
51726+
51727+ match = subj_map_set.s_hash[index];
51728+
51729+ while (match && match->user != userp)
51730+ match = match->next;
51731+
51732+ if (match != NULL)
51733+ return match->kernel;
51734+ else
51735+ return NULL;
51736+}
51737+
51738+static void
51739+insert_subj_map_entry(struct subject_map *subjmap)
51740+{
51741+ unsigned int index = shash(subjmap->user, subj_map_set.s_size);
51742+ struct subject_map **curr;
51743+
51744+ subjmap->prev = NULL;
51745+
51746+ curr = &subj_map_set.s_hash[index];
51747+ if (*curr != NULL)
51748+ (*curr)->prev = subjmap;
51749+
51750+ subjmap->next = *curr;
51751+ *curr = subjmap;
51752+
51753+ return;
51754+}
51755+
51756+static struct acl_role_label *
51757+lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
51758+ const gid_t gid)
51759+{
51760+ unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
51761+ struct acl_role_label *match;
51762+ struct role_allowed_ip *ipp;
51763+ unsigned int x;
51764+ u32 curr_ip = task->signal->curr_ip;
51765+
51766+ task->signal->saved_ip = curr_ip;
51767+
51768+ match = acl_role_set.r_hash[index];
51769+
51770+ while (match) {
51771+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
51772+ for (x = 0; x < match->domain_child_num; x++) {
51773+ if (match->domain_children[x] == uid)
51774+ goto found;
51775+ }
51776+ } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
51777+ break;
51778+ match = match->next;
51779+ }
51780+found:
51781+ if (match == NULL) {
51782+ try_group:
51783+ index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
51784+ match = acl_role_set.r_hash[index];
51785+
51786+ while (match) {
51787+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
51788+ for (x = 0; x < match->domain_child_num; x++) {
51789+ if (match->domain_children[x] == gid)
51790+ goto found2;
51791+ }
51792+ } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
51793+ break;
51794+ match = match->next;
51795+ }
51796+found2:
51797+ if (match == NULL)
51798+ match = default_role;
51799+ if (match->allowed_ips == NULL)
51800+ return match;
51801+ else {
51802+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51803+ if (likely
51804+ ((ntohl(curr_ip) & ipp->netmask) ==
51805+ (ntohl(ipp->addr) & ipp->netmask)))
51806+ return match;
51807+ }
51808+ match = default_role;
51809+ }
51810+ } else if (match->allowed_ips == NULL) {
51811+ return match;
51812+ } else {
51813+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51814+ if (likely
51815+ ((ntohl(curr_ip) & ipp->netmask) ==
51816+ (ntohl(ipp->addr) & ipp->netmask)))
51817+ return match;
51818+ }
51819+ goto try_group;
51820+ }
51821+
51822+ return match;
51823+}
51824+
51825+struct acl_subject_label *
51826+lookup_acl_subj_label(const ino_t ino, const dev_t dev,
51827+ const struct acl_role_label *role)
51828+{
51829+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
51830+ struct acl_subject_label *match;
51831+
51832+ match = role->subj_hash[index];
51833+
51834+ while (match && (match->inode != ino || match->device != dev ||
51835+ (match->mode & GR_DELETED))) {
51836+ match = match->next;
51837+ }
51838+
51839+ if (match && !(match->mode & GR_DELETED))
51840+ return match;
51841+ else
51842+ return NULL;
51843+}
51844+
51845+struct acl_subject_label *
51846+lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
51847+ const struct acl_role_label *role)
51848+{
51849+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
51850+ struct acl_subject_label *match;
51851+
51852+ match = role->subj_hash[index];
51853+
51854+ while (match && (match->inode != ino || match->device != dev ||
51855+ !(match->mode & GR_DELETED))) {
51856+ match = match->next;
51857+ }
51858+
51859+ if (match && (match->mode & GR_DELETED))
51860+ return match;
51861+ else
51862+ return NULL;
51863+}
51864+
51865+static struct acl_object_label *
51866+lookup_acl_obj_label(const ino_t ino, const dev_t dev,
51867+ const struct acl_subject_label *subj)
51868+{
51869+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51870+ struct acl_object_label *match;
51871+
51872+ match = subj->obj_hash[index];
51873+
51874+ while (match && (match->inode != ino || match->device != dev ||
51875+ (match->mode & GR_DELETED))) {
51876+ match = match->next;
51877+ }
51878+
51879+ if (match && !(match->mode & GR_DELETED))
51880+ return match;
51881+ else
51882+ return NULL;
51883+}
51884+
51885+static struct acl_object_label *
51886+lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
51887+ const struct acl_subject_label *subj)
51888+{
51889+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51890+ struct acl_object_label *match;
51891+
51892+ match = subj->obj_hash[index];
51893+
51894+ while (match && (match->inode != ino || match->device != dev ||
51895+ !(match->mode & GR_DELETED))) {
51896+ match = match->next;
51897+ }
51898+
51899+ if (match && (match->mode & GR_DELETED))
51900+ return match;
51901+
51902+ match = subj->obj_hash[index];
51903+
51904+ while (match && (match->inode != ino || match->device != dev ||
51905+ (match->mode & GR_DELETED))) {
51906+ match = match->next;
51907+ }
51908+
51909+ if (match && !(match->mode & GR_DELETED))
51910+ return match;
51911+ else
51912+ return NULL;
51913+}
51914+
51915+static struct name_entry *
51916+lookup_name_entry(const char *name)
51917+{
51918+ unsigned int len = strlen(name);
51919+ unsigned int key = full_name_hash(name, len);
51920+ unsigned int index = key % name_set.n_size;
51921+ struct name_entry *match;
51922+
51923+ match = name_set.n_hash[index];
51924+
51925+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
51926+ match = match->next;
51927+
51928+ return match;
51929+}
51930+
51931+static struct name_entry *
51932+lookup_name_entry_create(const char *name)
51933+{
51934+ unsigned int len = strlen(name);
51935+ unsigned int key = full_name_hash(name, len);
51936+ unsigned int index = key % name_set.n_size;
51937+ struct name_entry *match;
51938+
51939+ match = name_set.n_hash[index];
51940+
51941+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
51942+ !match->deleted))
51943+ match = match->next;
51944+
51945+ if (match && match->deleted)
51946+ return match;
51947+
51948+ match = name_set.n_hash[index];
51949+
51950+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
51951+ match->deleted))
51952+ match = match->next;
51953+
51954+ if (match && !match->deleted)
51955+ return match;
51956+ else
51957+ return NULL;
51958+}
51959+
51960+static struct inodev_entry *
51961+lookup_inodev_entry(const ino_t ino, const dev_t dev)
51962+{
51963+ unsigned int index = fhash(ino, dev, inodev_set.i_size);
51964+ struct inodev_entry *match;
51965+
51966+ match = inodev_set.i_hash[index];
51967+
51968+ while (match && (match->nentry->inode != ino || match->nentry->device != dev))
51969+ match = match->next;
51970+
51971+ return match;
51972+}
51973+
51974+static void
51975+insert_inodev_entry(struct inodev_entry *entry)
51976+{
51977+ unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
51978+ inodev_set.i_size);
51979+ struct inodev_entry **curr;
51980+
51981+ entry->prev = NULL;
51982+
51983+ curr = &inodev_set.i_hash[index];
51984+ if (*curr != NULL)
51985+ (*curr)->prev = entry;
51986+
51987+ entry->next = *curr;
51988+ *curr = entry;
51989+
51990+ return;
51991+}
51992+
51993+static void
51994+__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
51995+{
51996+ unsigned int index =
51997+ rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
51998+ struct acl_role_label **curr;
51999+ struct acl_role_label *tmp;
52000+
52001+ curr = &acl_role_set.r_hash[index];
52002+
52003+ /* if role was already inserted due to domains and already has
52004+ a role in the same bucket as it attached, then we need to
52005+ combine these two buckets
52006+ */
52007+ if (role->next) {
52008+ tmp = role->next;
52009+ while (tmp->next)
52010+ tmp = tmp->next;
52011+ tmp->next = *curr;
52012+ } else
52013+ role->next = *curr;
52014+ *curr = role;
52015+
52016+ return;
52017+}
52018+
52019+static void
52020+insert_acl_role_label(struct acl_role_label *role)
52021+{
52022+ int i;
52023+
52024+ if (role_list == NULL) {
52025+ role_list = role;
52026+ role->prev = NULL;
52027+ } else {
52028+ role->prev = role_list;
52029+ role_list = role;
52030+ }
52031+
52032+ /* used for hash chains */
52033+ role->next = NULL;
52034+
52035+ if (role->roletype & GR_ROLE_DOMAIN) {
52036+ for (i = 0; i < role->domain_child_num; i++)
52037+ __insert_acl_role_label(role, role->domain_children[i]);
52038+ } else
52039+ __insert_acl_role_label(role, role->uidgid);
52040+}
52041+
52042+static int
52043+insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
52044+{
52045+ struct name_entry **curr, *nentry;
52046+ struct inodev_entry *ientry;
52047+ unsigned int len = strlen(name);
52048+ unsigned int key = full_name_hash(name, len);
52049+ unsigned int index = key % name_set.n_size;
52050+
52051+ curr = &name_set.n_hash[index];
52052+
52053+ while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
52054+ curr = &((*curr)->next);
52055+
52056+ if (*curr != NULL)
52057+ return 1;
52058+
52059+ nentry = acl_alloc(sizeof (struct name_entry));
52060+ if (nentry == NULL)
52061+ return 0;
52062+ ientry = acl_alloc(sizeof (struct inodev_entry));
52063+ if (ientry == NULL)
52064+ return 0;
52065+ ientry->nentry = nentry;
52066+
52067+ nentry->key = key;
52068+ nentry->name = name;
52069+ nentry->inode = inode;
52070+ nentry->device = device;
52071+ nentry->len = len;
52072+ nentry->deleted = deleted;
52073+
52074+ nentry->prev = NULL;
52075+ curr = &name_set.n_hash[index];
52076+ if (*curr != NULL)
52077+ (*curr)->prev = nentry;
52078+ nentry->next = *curr;
52079+ *curr = nentry;
52080+
52081+ /* insert us into the table searchable by inode/dev */
52082+ insert_inodev_entry(ientry);
52083+
52084+ return 1;
52085+}
52086+
52087+static void
52088+insert_acl_obj_label(struct acl_object_label *obj,
52089+ struct acl_subject_label *subj)
52090+{
52091+ unsigned int index =
52092+ fhash(obj->inode, obj->device, subj->obj_hash_size);
52093+ struct acl_object_label **curr;
52094+
52095+
52096+ obj->prev = NULL;
52097+
52098+ curr = &subj->obj_hash[index];
52099+ if (*curr != NULL)
52100+ (*curr)->prev = obj;
52101+
52102+ obj->next = *curr;
52103+ *curr = obj;
52104+
52105+ return;
52106+}
52107+
52108+static void
52109+insert_acl_subj_label(struct acl_subject_label *obj,
52110+ struct acl_role_label *role)
52111+{
52112+ unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
52113+ struct acl_subject_label **curr;
52114+
52115+ obj->prev = NULL;
52116+
52117+ curr = &role->subj_hash[index];
52118+ if (*curr != NULL)
52119+ (*curr)->prev = obj;
52120+
52121+ obj->next = *curr;
52122+ *curr = obj;
52123+
52124+ return;
52125+}
52126+
52127+/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
52128+
52129+static void *
52130+create_table(__u32 * len, int elementsize)
52131+{
52132+ unsigned int table_sizes[] = {
52133+ 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
52134+ 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
52135+ 4194301, 8388593, 16777213, 33554393, 67108859
52136+ };
52137+ void *newtable = NULL;
52138+ unsigned int pwr = 0;
52139+
52140+ while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
52141+ table_sizes[pwr] <= *len)
52142+ pwr++;
52143+
52144+ if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
52145+ return newtable;
52146+
52147+ if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
52148+ newtable =
52149+ kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
52150+ else
52151+ newtable = vmalloc(table_sizes[pwr] * elementsize);
52152+
52153+ *len = table_sizes[pwr];
52154+
52155+ return newtable;
52156+}
52157+
52158+static int
52159+init_variables(const struct gr_arg *arg)
52160+{
52161+ struct task_struct *reaper = &init_task;
52162+ unsigned int stacksize;
52163+
52164+ subj_map_set.s_size = arg->role_db.num_subjects;
52165+ acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
52166+ name_set.n_size = arg->role_db.num_objects;
52167+ inodev_set.i_size = arg->role_db.num_objects;
52168+
52169+ if (!subj_map_set.s_size || !acl_role_set.r_size ||
52170+ !name_set.n_size || !inodev_set.i_size)
52171+ return 1;
52172+
52173+ if (!gr_init_uidset())
52174+ return 1;
52175+
52176+ /* set up the stack that holds allocation info */
52177+
52178+ stacksize = arg->role_db.num_pointers + 5;
52179+
52180+ if (!acl_alloc_stack_init(stacksize))
52181+ return 1;
52182+
52183+ /* grab reference for the real root dentry and vfsmount */
52184+ get_fs_root(reaper->fs, &real_root);
52185+
52186+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52187+ printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root.dentry), real_root.dentry->d_inode->i_ino);
52188+#endif
52189+
52190+ fakefs_obj = acl_alloc(sizeof(struct acl_object_label));
52191+ if (fakefs_obj == NULL)
52192+ return 1;
52193+ fakefs_obj->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
52194+
52195+ subj_map_set.s_hash =
52196+ (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
52197+ acl_role_set.r_hash =
52198+ (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
52199+ name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
52200+ inodev_set.i_hash =
52201+ (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
52202+
52203+ if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
52204+ !name_set.n_hash || !inodev_set.i_hash)
52205+ return 1;
52206+
52207+ memset(subj_map_set.s_hash, 0,
52208+ sizeof(struct subject_map *) * subj_map_set.s_size);
52209+ memset(acl_role_set.r_hash, 0,
52210+ sizeof (struct acl_role_label *) * acl_role_set.r_size);
52211+ memset(name_set.n_hash, 0,
52212+ sizeof (struct name_entry *) * name_set.n_size);
52213+ memset(inodev_set.i_hash, 0,
52214+ sizeof (struct inodev_entry *) * inodev_set.i_size);
52215+
52216+ return 0;
52217+}
52218+
52219+/* free information not needed after startup
52220+ currently contains user->kernel pointer mappings for subjects
52221+*/
52222+
52223+static void
52224+free_init_variables(void)
52225+{
52226+ __u32 i;
52227+
52228+ if (subj_map_set.s_hash) {
52229+ for (i = 0; i < subj_map_set.s_size; i++) {
52230+ if (subj_map_set.s_hash[i]) {
52231+ kfree(subj_map_set.s_hash[i]);
52232+ subj_map_set.s_hash[i] = NULL;
52233+ }
52234+ }
52235+
52236+ if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
52237+ PAGE_SIZE)
52238+ kfree(subj_map_set.s_hash);
52239+ else
52240+ vfree(subj_map_set.s_hash);
52241+ }
52242+
52243+ return;
52244+}
52245+
52246+static void
52247+free_variables(void)
52248+{
52249+ struct acl_subject_label *s;
52250+ struct acl_role_label *r;
52251+ struct task_struct *task, *task2;
52252+ unsigned int x;
52253+
52254+ gr_clear_learn_entries();
52255+
52256+ read_lock(&tasklist_lock);
52257+ do_each_thread(task2, task) {
52258+ task->acl_sp_role = 0;
52259+ task->acl_role_id = 0;
52260+ task->acl = NULL;
52261+ task->role = NULL;
52262+ } while_each_thread(task2, task);
52263+ read_unlock(&tasklist_lock);
52264+
52265+ /* release the reference to the real root dentry and vfsmount */
52266+ path_put(&real_root);
52267+
52268+ /* free all object hash tables */
52269+
52270+ FOR_EACH_ROLE_START(r)
52271+ if (r->subj_hash == NULL)
52272+ goto next_role;
52273+ FOR_EACH_SUBJECT_START(r, s, x)
52274+ if (s->obj_hash == NULL)
52275+ break;
52276+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
52277+ kfree(s->obj_hash);
52278+ else
52279+ vfree(s->obj_hash);
52280+ FOR_EACH_SUBJECT_END(s, x)
52281+ FOR_EACH_NESTED_SUBJECT_START(r, s)
52282+ if (s->obj_hash == NULL)
52283+ break;
52284+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
52285+ kfree(s->obj_hash);
52286+ else
52287+ vfree(s->obj_hash);
52288+ FOR_EACH_NESTED_SUBJECT_END(s)
52289+ if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
52290+ kfree(r->subj_hash);
52291+ else
52292+ vfree(r->subj_hash);
52293+ r->subj_hash = NULL;
52294+next_role:
52295+ FOR_EACH_ROLE_END(r)
52296+
52297+ acl_free_all();
52298+
52299+ if (acl_role_set.r_hash) {
52300+ if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
52301+ PAGE_SIZE)
52302+ kfree(acl_role_set.r_hash);
52303+ else
52304+ vfree(acl_role_set.r_hash);
52305+ }
52306+ if (name_set.n_hash) {
52307+ if ((name_set.n_size * sizeof (struct name_entry *)) <=
52308+ PAGE_SIZE)
52309+ kfree(name_set.n_hash);
52310+ else
52311+ vfree(name_set.n_hash);
52312+ }
52313+
52314+ if (inodev_set.i_hash) {
52315+ if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
52316+ PAGE_SIZE)
52317+ kfree(inodev_set.i_hash);
52318+ else
52319+ vfree(inodev_set.i_hash);
52320+ }
52321+
52322+ gr_free_uidset();
52323+
52324+ memset(&name_set, 0, sizeof (struct name_db));
52325+ memset(&inodev_set, 0, sizeof (struct inodev_db));
52326+ memset(&acl_role_set, 0, sizeof (struct acl_role_db));
52327+ memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
52328+
52329+ default_role = NULL;
52330+ role_list = NULL;
52331+
52332+ return;
52333+}
52334+
52335+static __u32
52336+count_user_objs(struct acl_object_label *userp)
52337+{
52338+ struct acl_object_label o_tmp;
52339+ __u32 num = 0;
52340+
52341+ while (userp) {
52342+ if (copy_from_user(&o_tmp, userp,
52343+ sizeof (struct acl_object_label)))
52344+ break;
52345+
52346+ userp = o_tmp.prev;
52347+ num++;
52348+ }
52349+
52350+ return num;
52351+}
52352+
52353+static struct acl_subject_label *
52354+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
52355+
52356+static int
52357+copy_user_glob(struct acl_object_label *obj)
52358+{
52359+ struct acl_object_label *g_tmp, **guser;
52360+ unsigned int len;
52361+ char *tmp;
52362+
52363+ if (obj->globbed == NULL)
52364+ return 0;
52365+
52366+ guser = &obj->globbed;
52367+ while (*guser) {
52368+ g_tmp = (struct acl_object_label *)
52369+ acl_alloc(sizeof (struct acl_object_label));
52370+ if (g_tmp == NULL)
52371+ return -ENOMEM;
52372+
52373+ if (copy_from_user(g_tmp, *guser,
52374+ sizeof (struct acl_object_label)))
52375+ return -EFAULT;
52376+
52377+ len = strnlen_user(g_tmp->filename, PATH_MAX);
52378+
52379+ if (!len || len >= PATH_MAX)
52380+ return -EINVAL;
52381+
52382+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52383+ return -ENOMEM;
52384+
52385+ if (copy_from_user(tmp, g_tmp->filename, len))
52386+ return -EFAULT;
52387+ tmp[len-1] = '\0';
52388+ g_tmp->filename = tmp;
52389+
52390+ *guser = g_tmp;
52391+ guser = &(g_tmp->next);
52392+ }
52393+
52394+ return 0;
52395+}
52396+
52397+static int
52398+copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
52399+ struct acl_role_label *role)
52400+{
52401+ struct acl_object_label *o_tmp;
52402+ unsigned int len;
52403+ int ret;
52404+ char *tmp;
52405+
52406+ while (userp) {
52407+ if ((o_tmp = (struct acl_object_label *)
52408+ acl_alloc(sizeof (struct acl_object_label))) == NULL)
52409+ return -ENOMEM;
52410+
52411+ if (copy_from_user(o_tmp, userp,
52412+ sizeof (struct acl_object_label)))
52413+ return -EFAULT;
52414+
52415+ userp = o_tmp->prev;
52416+
52417+ len = strnlen_user(o_tmp->filename, PATH_MAX);
52418+
52419+ if (!len || len >= PATH_MAX)
52420+ return -EINVAL;
52421+
52422+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52423+ return -ENOMEM;
52424+
52425+ if (copy_from_user(tmp, o_tmp->filename, len))
52426+ return -EFAULT;
52427+ tmp[len-1] = '\0';
52428+ o_tmp->filename = tmp;
52429+
52430+ insert_acl_obj_label(o_tmp, subj);
52431+ if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
52432+ o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
52433+ return -ENOMEM;
52434+
52435+ ret = copy_user_glob(o_tmp);
52436+ if (ret)
52437+ return ret;
52438+
52439+ if (o_tmp->nested) {
52440+ o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
52441+ if (IS_ERR(o_tmp->nested))
52442+ return PTR_ERR(o_tmp->nested);
52443+
52444+ /* insert into nested subject list */
52445+ o_tmp->nested->next = role->hash->first;
52446+ role->hash->first = o_tmp->nested;
52447+ }
52448+ }
52449+
52450+ return 0;
52451+}
52452+
52453+static __u32
52454+count_user_subjs(struct acl_subject_label *userp)
52455+{
52456+ struct acl_subject_label s_tmp;
52457+ __u32 num = 0;
52458+
52459+ while (userp) {
52460+ if (copy_from_user(&s_tmp, userp,
52461+ sizeof (struct acl_subject_label)))
52462+ break;
52463+
52464+ userp = s_tmp.prev;
52465+ /* do not count nested subjects against this count, since
52466+ they are not included in the hash table, but are
52467+ attached to objects. We have already counted
52468+ the subjects in userspace for the allocation
52469+ stack
52470+ */
52471+ if (!(s_tmp.mode & GR_NESTED))
52472+ num++;
52473+ }
52474+
52475+ return num;
52476+}
52477+
52478+static int
52479+copy_user_allowedips(struct acl_role_label *rolep)
52480+{
52481+ struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
52482+
52483+ ruserip = rolep->allowed_ips;
52484+
52485+ while (ruserip) {
52486+ rlast = rtmp;
52487+
52488+ if ((rtmp = (struct role_allowed_ip *)
52489+ acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
52490+ return -ENOMEM;
52491+
52492+ if (copy_from_user(rtmp, ruserip,
52493+ sizeof (struct role_allowed_ip)))
52494+ return -EFAULT;
52495+
52496+ ruserip = rtmp->prev;
52497+
52498+ if (!rlast) {
52499+ rtmp->prev = NULL;
52500+ rolep->allowed_ips = rtmp;
52501+ } else {
52502+ rlast->next = rtmp;
52503+ rtmp->prev = rlast;
52504+ }
52505+
52506+ if (!ruserip)
52507+ rtmp->next = NULL;
52508+ }
52509+
52510+ return 0;
52511+}
52512+
52513+static int
52514+copy_user_transitions(struct acl_role_label *rolep)
52515+{
52516+ struct role_transition *rusertp, *rtmp = NULL, *rlast;
52517+
52518+ unsigned int len;
52519+ char *tmp;
52520+
52521+ rusertp = rolep->transitions;
52522+
52523+ while (rusertp) {
52524+ rlast = rtmp;
52525+
52526+ if ((rtmp = (struct role_transition *)
52527+ acl_alloc(sizeof (struct role_transition))) == NULL)
52528+ return -ENOMEM;
52529+
52530+ if (copy_from_user(rtmp, rusertp,
52531+ sizeof (struct role_transition)))
52532+ return -EFAULT;
52533+
52534+ rusertp = rtmp->prev;
52535+
52536+ len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
52537+
52538+ if (!len || len >= GR_SPROLE_LEN)
52539+ return -EINVAL;
52540+
52541+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52542+ return -ENOMEM;
52543+
52544+ if (copy_from_user(tmp, rtmp->rolename, len))
52545+ return -EFAULT;
52546+ tmp[len-1] = '\0';
52547+ rtmp->rolename = tmp;
52548+
52549+ if (!rlast) {
52550+ rtmp->prev = NULL;
52551+ rolep->transitions = rtmp;
52552+ } else {
52553+ rlast->next = rtmp;
52554+ rtmp->prev = rlast;
52555+ }
52556+
52557+ if (!rusertp)
52558+ rtmp->next = NULL;
52559+ }
52560+
52561+ return 0;
52562+}
52563+
52564+static struct acl_subject_label *
52565+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
52566+{
52567+ struct acl_subject_label *s_tmp = NULL, *s_tmp2;
52568+ unsigned int len;
52569+ char *tmp;
52570+ __u32 num_objs;
52571+ struct acl_ip_label **i_tmp, *i_utmp2;
52572+ struct gr_hash_struct ghash;
52573+ struct subject_map *subjmap;
52574+ unsigned int i_num;
52575+ int err;
52576+
52577+ s_tmp = lookup_subject_map(userp);
52578+
52579+ /* we've already copied this subject into the kernel, just return
52580+ the reference to it, and don't copy it over again
52581+ */
52582+ if (s_tmp)
52583+ return(s_tmp);
52584+
52585+ if ((s_tmp = (struct acl_subject_label *)
52586+ acl_alloc(sizeof (struct acl_subject_label))) == NULL)
52587+ return ERR_PTR(-ENOMEM);
52588+
52589+ subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
52590+ if (subjmap == NULL)
52591+ return ERR_PTR(-ENOMEM);
52592+
52593+ subjmap->user = userp;
52594+ subjmap->kernel = s_tmp;
52595+ insert_subj_map_entry(subjmap);
52596+
52597+ if (copy_from_user(s_tmp, userp,
52598+ sizeof (struct acl_subject_label)))
52599+ return ERR_PTR(-EFAULT);
52600+
52601+ len = strnlen_user(s_tmp->filename, PATH_MAX);
52602+
52603+ if (!len || len >= PATH_MAX)
52604+ return ERR_PTR(-EINVAL);
52605+
52606+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52607+ return ERR_PTR(-ENOMEM);
52608+
52609+ if (copy_from_user(tmp, s_tmp->filename, len))
52610+ return ERR_PTR(-EFAULT);
52611+ tmp[len-1] = '\0';
52612+ s_tmp->filename = tmp;
52613+
52614+ if (!strcmp(s_tmp->filename, "/"))
52615+ role->root_label = s_tmp;
52616+
52617+ if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
52618+ return ERR_PTR(-EFAULT);
52619+
52620+ /* copy user and group transition tables */
52621+
52622+ if (s_tmp->user_trans_num) {
52623+ uid_t *uidlist;
52624+
52625+ uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
52626+ if (uidlist == NULL)
52627+ return ERR_PTR(-ENOMEM);
52628+ if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
52629+ return ERR_PTR(-EFAULT);
52630+
52631+ s_tmp->user_transitions = uidlist;
52632+ }
52633+
52634+ if (s_tmp->group_trans_num) {
52635+ gid_t *gidlist;
52636+
52637+ gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
52638+ if (gidlist == NULL)
52639+ return ERR_PTR(-ENOMEM);
52640+ if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
52641+ return ERR_PTR(-EFAULT);
52642+
52643+ s_tmp->group_transitions = gidlist;
52644+ }
52645+
52646+ /* set up object hash table */
52647+ num_objs = count_user_objs(ghash.first);
52648+
52649+ s_tmp->obj_hash_size = num_objs;
52650+ s_tmp->obj_hash =
52651+ (struct acl_object_label **)
52652+ create_table(&(s_tmp->obj_hash_size), sizeof(void *));
52653+
52654+ if (!s_tmp->obj_hash)
52655+ return ERR_PTR(-ENOMEM);
52656+
52657+ memset(s_tmp->obj_hash, 0,
52658+ s_tmp->obj_hash_size *
52659+ sizeof (struct acl_object_label *));
52660+
52661+ /* add in objects */
52662+ err = copy_user_objs(ghash.first, s_tmp, role);
52663+
52664+ if (err)
52665+ return ERR_PTR(err);
52666+
52667+ /* set pointer for parent subject */
52668+ if (s_tmp->parent_subject) {
52669+ s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
52670+
52671+ if (IS_ERR(s_tmp2))
52672+ return s_tmp2;
52673+
52674+ s_tmp->parent_subject = s_tmp2;
52675+ }
52676+
52677+ /* add in ip acls */
52678+
52679+ if (!s_tmp->ip_num) {
52680+ s_tmp->ips = NULL;
52681+ goto insert;
52682+ }
52683+
52684+ i_tmp =
52685+ (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
52686+ sizeof (struct acl_ip_label *));
52687+
52688+ if (!i_tmp)
52689+ return ERR_PTR(-ENOMEM);
52690+
52691+ for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
52692+ *(i_tmp + i_num) =
52693+ (struct acl_ip_label *)
52694+ acl_alloc(sizeof (struct acl_ip_label));
52695+ if (!*(i_tmp + i_num))
52696+ return ERR_PTR(-ENOMEM);
52697+
52698+ if (copy_from_user
52699+ (&i_utmp2, s_tmp->ips + i_num,
52700+ sizeof (struct acl_ip_label *)))
52701+ return ERR_PTR(-EFAULT);
52702+
52703+ if (copy_from_user
52704+ (*(i_tmp + i_num), i_utmp2,
52705+ sizeof (struct acl_ip_label)))
52706+ return ERR_PTR(-EFAULT);
52707+
52708+ if ((*(i_tmp + i_num))->iface == NULL)
52709+ continue;
52710+
52711+ len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
52712+ if (!len || len >= IFNAMSIZ)
52713+ return ERR_PTR(-EINVAL);
52714+ tmp = acl_alloc(len);
52715+ if (tmp == NULL)
52716+ return ERR_PTR(-ENOMEM);
52717+ if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
52718+ return ERR_PTR(-EFAULT);
52719+ (*(i_tmp + i_num))->iface = tmp;
52720+ }
52721+
52722+ s_tmp->ips = i_tmp;
52723+
52724+insert:
52725+ if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
52726+ s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
52727+ return ERR_PTR(-ENOMEM);
52728+
52729+ return s_tmp;
52730+}
52731+
52732+static int
52733+copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
52734+{
52735+ struct acl_subject_label s_pre;
52736+ struct acl_subject_label * ret;
52737+ int err;
52738+
52739+ while (userp) {
52740+ if (copy_from_user(&s_pre, userp,
52741+ sizeof (struct acl_subject_label)))
52742+ return -EFAULT;
52743+
52744+ /* do not add nested subjects here, add
52745+ while parsing objects
52746+ */
52747+
52748+ if (s_pre.mode & GR_NESTED) {
52749+ userp = s_pre.prev;
52750+ continue;
52751+ }
52752+
52753+ ret = do_copy_user_subj(userp, role);
52754+
52755+ err = PTR_ERR(ret);
52756+ if (IS_ERR(ret))
52757+ return err;
52758+
52759+ insert_acl_subj_label(ret, role);
52760+
52761+ userp = s_pre.prev;
52762+ }
52763+
52764+ return 0;
52765+}
52766+
52767+static int
52768+copy_user_acl(struct gr_arg *arg)
52769+{
52770+ struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
52771+ struct sprole_pw *sptmp;
52772+ struct gr_hash_struct *ghash;
52773+ uid_t *domainlist;
52774+ unsigned int r_num;
52775+ unsigned int len;
52776+ char *tmp;
52777+ int err = 0;
52778+ __u16 i;
52779+ __u32 num_subjs;
52780+
52781+ /* we need a default and kernel role */
52782+ if (arg->role_db.num_roles < 2)
52783+ return -EINVAL;
52784+
52785+ /* copy special role authentication info from userspace */
52786+
52787+ num_sprole_pws = arg->num_sprole_pws;
52788+ acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
52789+
52790+ if (!acl_special_roles) {
52791+ err = -ENOMEM;
52792+ goto cleanup;
52793+ }
52794+
52795+ for (i = 0; i < num_sprole_pws; i++) {
52796+ sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
52797+ if (!sptmp) {
52798+ err = -ENOMEM;
52799+ goto cleanup;
52800+ }
52801+ if (copy_from_user(sptmp, arg->sprole_pws + i,
52802+ sizeof (struct sprole_pw))) {
52803+ err = -EFAULT;
52804+ goto cleanup;
52805+ }
52806+
52807+ len =
52808+ strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
52809+
52810+ if (!len || len >= GR_SPROLE_LEN) {
52811+ err = -EINVAL;
52812+ goto cleanup;
52813+ }
52814+
52815+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
52816+ err = -ENOMEM;
52817+ goto cleanup;
52818+ }
52819+
52820+ if (copy_from_user(tmp, sptmp->rolename, len)) {
52821+ err = -EFAULT;
52822+ goto cleanup;
52823+ }
52824+ tmp[len-1] = '\0';
52825+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52826+ printk(KERN_ALERT "Copying special role %s\n", tmp);
52827+#endif
52828+ sptmp->rolename = tmp;
52829+ acl_special_roles[i] = sptmp;
52830+ }
52831+
52832+ r_utmp = (struct acl_role_label **) arg->role_db.r_table;
52833+
52834+ for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
52835+ r_tmp = acl_alloc(sizeof (struct acl_role_label));
52836+
52837+ if (!r_tmp) {
52838+ err = -ENOMEM;
52839+ goto cleanup;
52840+ }
52841+
52842+ if (copy_from_user(&r_utmp2, r_utmp + r_num,
52843+ sizeof (struct acl_role_label *))) {
52844+ err = -EFAULT;
52845+ goto cleanup;
52846+ }
52847+
52848+ if (copy_from_user(r_tmp, r_utmp2,
52849+ sizeof (struct acl_role_label))) {
52850+ err = -EFAULT;
52851+ goto cleanup;
52852+ }
52853+
52854+ len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
52855+
52856+ if (!len || len >= PATH_MAX) {
52857+ err = -EINVAL;
52858+ goto cleanup;
52859+ }
52860+
52861+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
52862+ err = -ENOMEM;
52863+ goto cleanup;
52864+ }
52865+ if (copy_from_user(tmp, r_tmp->rolename, len)) {
52866+ err = -EFAULT;
52867+ goto cleanup;
52868+ }
52869+ tmp[len-1] = '\0';
52870+ r_tmp->rolename = tmp;
52871+
52872+ if (!strcmp(r_tmp->rolename, "default")
52873+ && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
52874+ default_role = r_tmp;
52875+ } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
52876+ kernel_role = r_tmp;
52877+ }
52878+
52879+ if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
52880+ err = -ENOMEM;
52881+ goto cleanup;
52882+ }
52883+ if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
52884+ err = -EFAULT;
52885+ goto cleanup;
52886+ }
52887+
52888+ r_tmp->hash = ghash;
52889+
52890+ num_subjs = count_user_subjs(r_tmp->hash->first);
52891+
52892+ r_tmp->subj_hash_size = num_subjs;
52893+ r_tmp->subj_hash =
52894+ (struct acl_subject_label **)
52895+ create_table(&(r_tmp->subj_hash_size), sizeof(void *));
52896+
52897+ if (!r_tmp->subj_hash) {
52898+ err = -ENOMEM;
52899+ goto cleanup;
52900+ }
52901+
52902+ err = copy_user_allowedips(r_tmp);
52903+ if (err)
52904+ goto cleanup;
52905+
52906+ /* copy domain info */
52907+ if (r_tmp->domain_children != NULL) {
52908+ domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
52909+ if (domainlist == NULL) {
52910+ err = -ENOMEM;
52911+ goto cleanup;
52912+ }
52913+ if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
52914+ err = -EFAULT;
52915+ goto cleanup;
52916+ }
52917+ r_tmp->domain_children = domainlist;
52918+ }
52919+
52920+ err = copy_user_transitions(r_tmp);
52921+ if (err)
52922+ goto cleanup;
52923+
52924+ memset(r_tmp->subj_hash, 0,
52925+ r_tmp->subj_hash_size *
52926+ sizeof (struct acl_subject_label *));
52927+
52928+ err = copy_user_subjs(r_tmp->hash->first, r_tmp);
52929+
52930+ if (err)
52931+ goto cleanup;
52932+
52933+ /* set nested subject list to null */
52934+ r_tmp->hash->first = NULL;
52935+
52936+ insert_acl_role_label(r_tmp);
52937+ }
52938+
52939+ goto return_err;
52940+ cleanup:
52941+ free_variables();
52942+ return_err:
52943+ return err;
52944+
52945+}
52946+
52947+static int
52948+gracl_init(struct gr_arg *args)
52949+{
52950+ int error = 0;
52951+
52952+ memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
52953+ memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
52954+
52955+ if (init_variables(args)) {
52956+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
52957+ error = -ENOMEM;
52958+ free_variables();
52959+ goto out;
52960+ }
52961+
52962+ error = copy_user_acl(args);
52963+ free_init_variables();
52964+ if (error) {
52965+ free_variables();
52966+ goto out;
52967+ }
52968+
52969+ if ((error = gr_set_acls(0))) {
52970+ free_variables();
52971+ goto out;
52972+ }
52973+
52974+ pax_open_kernel();
52975+ gr_status |= GR_READY;
52976+ pax_close_kernel();
52977+
52978+ out:
52979+ return error;
52980+}
52981+
52982+/* derived from glibc fnmatch() 0: match, 1: no match*/
52983+
52984+static int
52985+glob_match(const char *p, const char *n)
52986+{
52987+ char c;
52988+
52989+ while ((c = *p++) != '\0') {
52990+ switch (c) {
52991+ case '?':
52992+ if (*n == '\0')
52993+ return 1;
52994+ else if (*n == '/')
52995+ return 1;
52996+ break;
52997+ case '\\':
52998+ if (*n != c)
52999+ return 1;
53000+ break;
53001+ case '*':
53002+ for (c = *p++; c == '?' || c == '*'; c = *p++) {
53003+ if (*n == '/')
53004+ return 1;
53005+ else if (c == '?') {
53006+ if (*n == '\0')
53007+ return 1;
53008+ else
53009+ ++n;
53010+ }
53011+ }
53012+ if (c == '\0') {
53013+ return 0;
53014+ } else {
53015+ const char *endp;
53016+
53017+ if ((endp = strchr(n, '/')) == NULL)
53018+ endp = n + strlen(n);
53019+
53020+ if (c == '[') {
53021+ for (--p; n < endp; ++n)
53022+ if (!glob_match(p, n))
53023+ return 0;
53024+ } else if (c == '/') {
53025+ while (*n != '\0' && *n != '/')
53026+ ++n;
53027+ if (*n == '/' && !glob_match(p, n + 1))
53028+ return 0;
53029+ } else {
53030+ for (--p; n < endp; ++n)
53031+ if (*n == c && !glob_match(p, n))
53032+ return 0;
53033+ }
53034+
53035+ return 1;
53036+ }
53037+ case '[':
53038+ {
53039+ int not;
53040+ char cold;
53041+
53042+ if (*n == '\0' || *n == '/')
53043+ return 1;
53044+
53045+ not = (*p == '!' || *p == '^');
53046+ if (not)
53047+ ++p;
53048+
53049+ c = *p++;
53050+ for (;;) {
53051+ unsigned char fn = (unsigned char)*n;
53052+
53053+ if (c == '\0')
53054+ return 1;
53055+ else {
53056+ if (c == fn)
53057+ goto matched;
53058+ cold = c;
53059+ c = *p++;
53060+
53061+ if (c == '-' && *p != ']') {
53062+ unsigned char cend = *p++;
53063+
53064+ if (cend == '\0')
53065+ return 1;
53066+
53067+ if (cold <= fn && fn <= cend)
53068+ goto matched;
53069+
53070+ c = *p++;
53071+ }
53072+ }
53073+
53074+ if (c == ']')
53075+ break;
53076+ }
53077+ if (!not)
53078+ return 1;
53079+ break;
53080+ matched:
53081+ while (c != ']') {
53082+ if (c == '\0')
53083+ return 1;
53084+
53085+ c = *p++;
53086+ }
53087+ if (not)
53088+ return 1;
53089+ }
53090+ break;
53091+ default:
53092+ if (c != *n)
53093+ return 1;
53094+ }
53095+
53096+ ++n;
53097+ }
53098+
53099+ if (*n == '\0')
53100+ return 0;
53101+
53102+ if (*n == '/')
53103+ return 0;
53104+
53105+ return 1;
53106+}
53107+
53108+static struct acl_object_label *
53109+chk_glob_label(struct acl_object_label *globbed,
53110+ struct dentry *dentry, struct vfsmount *mnt, char **path)
53111+{
53112+ struct acl_object_label *tmp;
53113+
53114+ if (*path == NULL)
53115+ *path = gr_to_filename_nolock(dentry, mnt);
53116+
53117+ tmp = globbed;
53118+
53119+ while (tmp) {
53120+ if (!glob_match(tmp->filename, *path))
53121+ return tmp;
53122+ tmp = tmp->next;
53123+ }
53124+
53125+ return NULL;
53126+}
53127+
53128+static struct acl_object_label *
53129+__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
53130+ const ino_t curr_ino, const dev_t curr_dev,
53131+ const struct acl_subject_label *subj, char **path, const int checkglob)
53132+{
53133+ struct acl_subject_label *tmpsubj;
53134+ struct acl_object_label *retval;
53135+ struct acl_object_label *retval2;
53136+
53137+ tmpsubj = (struct acl_subject_label *) subj;
53138+ read_lock(&gr_inode_lock);
53139+ do {
53140+ retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
53141+ if (retval) {
53142+ if (checkglob && retval->globbed) {
53143+ retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
53144+ (struct vfsmount *)orig_mnt, path);
53145+ if (retval2)
53146+ retval = retval2;
53147+ }
53148+ break;
53149+ }
53150+ } while ((tmpsubj = tmpsubj->parent_subject));
53151+ read_unlock(&gr_inode_lock);
53152+
53153+ return retval;
53154+}
53155+
53156+static __inline__ struct acl_object_label *
53157+full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
53158+ struct dentry *curr_dentry,
53159+ const struct acl_subject_label *subj, char **path, const int checkglob)
53160+{
53161+ int newglob = checkglob;
53162+ ino_t inode;
53163+ dev_t device;
53164+
53165+ /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
53166+ as we don't want a / * rule to match instead of the / object
53167+ don't do this for create lookups that call this function though, since they're looking up
53168+ on the parent and thus need globbing checks on all paths
53169+ */
53170+ if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
53171+ newglob = GR_NO_GLOB;
53172+
53173+ spin_lock(&curr_dentry->d_lock);
53174+ inode = curr_dentry->d_inode->i_ino;
53175+ device = __get_dev(curr_dentry);
53176+ spin_unlock(&curr_dentry->d_lock);
53177+
53178+ return __full_lookup(orig_dentry, orig_mnt, inode, device, subj, path, newglob);
53179+}
53180+
53181+static struct acl_object_label *
53182+__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53183+ const struct acl_subject_label *subj, char *path, const int checkglob)
53184+{
53185+ struct dentry *dentry = (struct dentry *) l_dentry;
53186+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
53187+ struct acl_object_label *retval;
53188+ struct dentry *parent;
53189+
53190+ write_seqlock(&rename_lock);
53191+ br_read_lock(vfsmount_lock);
53192+
53193+ if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
53194+#ifdef CONFIG_NET
53195+ mnt == sock_mnt ||
53196+#endif
53197+#ifdef CONFIG_HUGETLBFS
53198+ (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
53199+#endif
53200+ /* ignore Eric Biederman */
53201+ IS_PRIVATE(l_dentry->d_inode))) {
53202+ retval = fakefs_obj;
53203+ goto out;
53204+ }
53205+
53206+ for (;;) {
53207+ if (dentry == real_root.dentry && mnt == real_root.mnt)
53208+ break;
53209+
53210+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
53211+ if (mnt->mnt_parent == mnt)
53212+ break;
53213+
53214+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53215+ if (retval != NULL)
53216+ goto out;
53217+
53218+ dentry = mnt->mnt_mountpoint;
53219+ mnt = mnt->mnt_parent;
53220+ continue;
53221+ }
53222+
53223+ parent = dentry->d_parent;
53224+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53225+ if (retval != NULL)
53226+ goto out;
53227+
53228+ dentry = parent;
53229+ }
53230+
53231+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53232+
53233+ /* real_root is pinned so we don't have to hold a reference */
53234+ if (retval == NULL)
53235+ retval = full_lookup(l_dentry, l_mnt, real_root.dentry, subj, &path, checkglob);
53236+out:
53237+ br_read_unlock(vfsmount_lock);
53238+ write_sequnlock(&rename_lock);
53239+
53240+ BUG_ON(retval == NULL);
53241+
53242+ return retval;
53243+}
53244+
53245+static __inline__ struct acl_object_label *
53246+chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53247+ const struct acl_subject_label *subj)
53248+{
53249+ char *path = NULL;
53250+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
53251+}
53252+
53253+static __inline__ struct acl_object_label *
53254+chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53255+ const struct acl_subject_label *subj)
53256+{
53257+ char *path = NULL;
53258+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
53259+}
53260+
53261+static __inline__ struct acl_object_label *
53262+chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53263+ const struct acl_subject_label *subj, char *path)
53264+{
53265+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
53266+}
53267+
53268+static struct acl_subject_label *
53269+chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53270+ const struct acl_role_label *role)
53271+{
53272+ struct dentry *dentry = (struct dentry *) l_dentry;
53273+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
53274+ struct acl_subject_label *retval;
53275+ struct dentry *parent;
53276+
53277+ write_seqlock(&rename_lock);
53278+ br_read_lock(vfsmount_lock);
53279+
53280+ for (;;) {
53281+ if (dentry == real_root.dentry && mnt == real_root.mnt)
53282+ break;
53283+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
53284+ if (mnt->mnt_parent == mnt)
53285+ break;
53286+
53287+ spin_lock(&dentry->d_lock);
53288+ read_lock(&gr_inode_lock);
53289+ retval =
53290+ lookup_acl_subj_label(dentry->d_inode->i_ino,
53291+ __get_dev(dentry), role);
53292+ read_unlock(&gr_inode_lock);
53293+ spin_unlock(&dentry->d_lock);
53294+ if (retval != NULL)
53295+ goto out;
53296+
53297+ dentry = mnt->mnt_mountpoint;
53298+ mnt = mnt->mnt_parent;
53299+ continue;
53300+ }
53301+
53302+ spin_lock(&dentry->d_lock);
53303+ read_lock(&gr_inode_lock);
53304+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
53305+ __get_dev(dentry), role);
53306+ read_unlock(&gr_inode_lock);
53307+ parent = dentry->d_parent;
53308+ spin_unlock(&dentry->d_lock);
53309+
53310+ if (retval != NULL)
53311+ goto out;
53312+
53313+ dentry = parent;
53314+ }
53315+
53316+ spin_lock(&dentry->d_lock);
53317+ read_lock(&gr_inode_lock);
53318+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
53319+ __get_dev(dentry), role);
53320+ read_unlock(&gr_inode_lock);
53321+ spin_unlock(&dentry->d_lock);
53322+
53323+ if (unlikely(retval == NULL)) {
53324+ /* real_root is pinned, we don't need to hold a reference */
53325+ read_lock(&gr_inode_lock);
53326+ retval = lookup_acl_subj_label(real_root.dentry->d_inode->i_ino,
53327+ __get_dev(real_root.dentry), role);
53328+ read_unlock(&gr_inode_lock);
53329+ }
53330+out:
53331+ br_read_unlock(vfsmount_lock);
53332+ write_sequnlock(&rename_lock);
53333+
53334+ BUG_ON(retval == NULL);
53335+
53336+ return retval;
53337+}
53338+
53339+static void
53340+gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
53341+{
53342+ struct task_struct *task = current;
53343+ const struct cred *cred = current_cred();
53344+
53345+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
53346+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53347+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53348+ 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
53349+
53350+ return;
53351+}
53352+
53353+static void
53354+gr_log_learn_sysctl(const char *path, const __u32 mode)
53355+{
53356+ struct task_struct *task = current;
53357+ const struct cred *cred = current_cred();
53358+
53359+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
53360+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53361+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53362+ 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
53363+
53364+ return;
53365+}
53366+
53367+static void
53368+gr_log_learn_id_change(const char type, const unsigned int real,
53369+ const unsigned int effective, const unsigned int fs)
53370+{
53371+ struct task_struct *task = current;
53372+ const struct cred *cred = current_cred();
53373+
53374+ security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
53375+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53376+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53377+ type, real, effective, fs, &task->signal->saved_ip);
53378+
53379+ return;
53380+}
53381+
53382+__u32
53383+gr_check_link(const struct dentry * new_dentry,
53384+ const struct dentry * parent_dentry,
53385+ const struct vfsmount * parent_mnt,
53386+ const struct dentry * old_dentry, const struct vfsmount * old_mnt)
53387+{
53388+ struct acl_object_label *obj;
53389+ __u32 oldmode, newmode;
53390+ __u32 needmode;
53391+
53392+ if (unlikely(!(gr_status & GR_READY)))
53393+ return (GR_CREATE | GR_LINK);
53394+
53395+ obj = chk_obj_label(old_dentry, old_mnt, current->acl);
53396+ oldmode = obj->mode;
53397+
53398+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53399+ oldmode |= (GR_CREATE | GR_LINK);
53400+
53401+ needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS;
53402+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
53403+ needmode |= GR_SETID | GR_AUDIT_SETID;
53404+
53405+ newmode =
53406+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
53407+ oldmode | needmode);
53408+
53409+ needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC |
53410+ GR_SETID | GR_READ | GR_FIND | GR_DELETE |
53411+ GR_INHERIT | GR_AUDIT_INHERIT);
53412+
53413+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID))
53414+ goto bad;
53415+
53416+ if ((oldmode & needmode) != needmode)
53417+ goto bad;
53418+
53419+ needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
53420+ if ((newmode & needmode) != needmode)
53421+ goto bad;
53422+
53423+ if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
53424+ return newmode;
53425+bad:
53426+ needmode = oldmode;
53427+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
53428+ needmode |= GR_SETID;
53429+
53430+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
53431+ gr_log_learn(old_dentry, old_mnt, needmode);
53432+ return (GR_CREATE | GR_LINK);
53433+ } else if (newmode & GR_SUPPRESS)
53434+ return GR_SUPPRESS;
53435+ else
53436+ return 0;
53437+}
53438+
53439+__u32
53440+gr_search_file(const struct dentry * dentry, const __u32 mode,
53441+ const struct vfsmount * mnt)
53442+{
53443+ __u32 retval = mode;
53444+ struct acl_subject_label *curracl;
53445+ struct acl_object_label *currobj;
53446+
53447+ if (unlikely(!(gr_status & GR_READY)))
53448+ return (mode & ~GR_AUDITS);
53449+
53450+ curracl = current->acl;
53451+
53452+ currobj = chk_obj_label(dentry, mnt, curracl);
53453+ retval = currobj->mode & mode;
53454+
53455+ /* if we're opening a specified transfer file for writing
53456+ (e.g. /dev/initctl), then transfer our role to init
53457+ */
53458+ if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
53459+ current->role->roletype & GR_ROLE_PERSIST)) {
53460+ struct task_struct *task = init_pid_ns.child_reaper;
53461+
53462+ if (task->role != current->role) {
53463+ task->acl_sp_role = 0;
53464+ task->acl_role_id = current->acl_role_id;
53465+ task->role = current->role;
53466+ rcu_read_lock();
53467+ read_lock(&grsec_exec_file_lock);
53468+ gr_apply_subject_to_task(task);
53469+ read_unlock(&grsec_exec_file_lock);
53470+ rcu_read_unlock();
53471+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
53472+ }
53473+ }
53474+
53475+ if (unlikely
53476+ ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
53477+ && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
53478+ __u32 new_mode = mode;
53479+
53480+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53481+
53482+ retval = new_mode;
53483+
53484+ if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
53485+ new_mode |= GR_INHERIT;
53486+
53487+ if (!(mode & GR_NOLEARN))
53488+ gr_log_learn(dentry, mnt, new_mode);
53489+ }
53490+
53491+ return retval;
53492+}
53493+
53494+__u32
53495+gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
53496+ const struct vfsmount * mnt, const __u32 mode)
53497+{
53498+ struct name_entry *match;
53499+ struct acl_object_label *matchpo;
53500+ struct acl_subject_label *curracl;
53501+ char *path;
53502+ __u32 retval;
53503+
53504+ if (unlikely(!(gr_status & GR_READY)))
53505+ return (mode & ~GR_AUDITS);
53506+
53507+ preempt_disable();
53508+ path = gr_to_filename_rbac(new_dentry, mnt);
53509+ match = lookup_name_entry_create(path);
53510+
53511+ if (!match)
53512+ goto check_parent;
53513+
53514+ curracl = current->acl;
53515+
53516+ read_lock(&gr_inode_lock);
53517+ matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
53518+ read_unlock(&gr_inode_lock);
53519+
53520+ if (matchpo) {
53521+ if ((matchpo->mode & mode) !=
53522+ (mode & ~(GR_AUDITS | GR_SUPPRESS))
53523+ && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
53524+ __u32 new_mode = mode;
53525+
53526+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53527+
53528+ gr_log_learn(new_dentry, mnt, new_mode);
53529+
53530+ preempt_enable();
53531+ return new_mode;
53532+ }
53533+ preempt_enable();
53534+ return (matchpo->mode & mode);
53535+ }
53536+
53537+ check_parent:
53538+ curracl = current->acl;
53539+
53540+ matchpo = chk_obj_create_label(parent, mnt, curracl, path);
53541+ retval = matchpo->mode & mode;
53542+
53543+ if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
53544+ && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) {
53545+ __u32 new_mode = mode;
53546+
53547+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53548+
53549+ gr_log_learn(new_dentry, mnt, new_mode);
53550+ preempt_enable();
53551+ return new_mode;
53552+ }
53553+
53554+ preempt_enable();
53555+ return retval;
53556+}
53557+
53558+int
53559+gr_check_hidden_task(const struct task_struct *task)
53560+{
53561+ if (unlikely(!(gr_status & GR_READY)))
53562+ return 0;
53563+
53564+ if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
53565+ return 1;
53566+
53567+ return 0;
53568+}
53569+
53570+int
53571+gr_check_protected_task(const struct task_struct *task)
53572+{
53573+ if (unlikely(!(gr_status & GR_READY) || !task))
53574+ return 0;
53575+
53576+ if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
53577+ task->acl != current->acl)
53578+ return 1;
53579+
53580+ return 0;
53581+}
53582+
53583+int
53584+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
53585+{
53586+ struct task_struct *p;
53587+ int ret = 0;
53588+
53589+ if (unlikely(!(gr_status & GR_READY) || !pid))
53590+ return ret;
53591+
53592+ read_lock(&tasklist_lock);
53593+ do_each_pid_task(pid, type, p) {
53594+ if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
53595+ p->acl != current->acl) {
53596+ ret = 1;
53597+ goto out;
53598+ }
53599+ } while_each_pid_task(pid, type, p);
53600+out:
53601+ read_unlock(&tasklist_lock);
53602+
53603+ return ret;
53604+}
53605+
53606+void
53607+gr_copy_label(struct task_struct *tsk)
53608+{
53609+ tsk->signal->used_accept = 0;
53610+ tsk->acl_sp_role = 0;
53611+ tsk->acl_role_id = current->acl_role_id;
53612+ tsk->acl = current->acl;
53613+ tsk->role = current->role;
53614+ tsk->signal->curr_ip = current->signal->curr_ip;
53615+ tsk->signal->saved_ip = current->signal->saved_ip;
53616+ if (current->exec_file)
53617+ get_file(current->exec_file);
53618+ tsk->exec_file = current->exec_file;
53619+ tsk->is_writable = current->is_writable;
53620+ if (unlikely(current->signal->used_accept)) {
53621+ current->signal->curr_ip = 0;
53622+ current->signal->saved_ip = 0;
53623+ }
53624+
53625+ return;
53626+}
53627+
53628+static void
53629+gr_set_proc_res(struct task_struct *task)
53630+{
53631+ struct acl_subject_label *proc;
53632+ unsigned short i;
53633+
53634+ proc = task->acl;
53635+
53636+ if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
53637+ return;
53638+
53639+ for (i = 0; i < RLIM_NLIMITS; i++) {
53640+ if (!(proc->resmask & (1 << i)))
53641+ continue;
53642+
53643+ task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
53644+ task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
53645+ }
53646+
53647+ return;
53648+}
53649+
53650+extern int __gr_process_user_ban(struct user_struct *user);
53651+
53652+int
53653+gr_check_user_change(int real, int effective, int fs)
53654+{
53655+ unsigned int i;
53656+ __u16 num;
53657+ uid_t *uidlist;
53658+ int curuid;
53659+ int realok = 0;
53660+ int effectiveok = 0;
53661+ int fsok = 0;
53662+
53663+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
53664+ struct user_struct *user;
53665+
53666+ if (real == -1)
53667+ goto skipit;
53668+
53669+ user = find_user(real);
53670+ if (user == NULL)
53671+ goto skipit;
53672+
53673+ if (__gr_process_user_ban(user)) {
53674+ /* for find_user */
53675+ free_uid(user);
53676+ return 1;
53677+ }
53678+
53679+ /* for find_user */
53680+ free_uid(user);
53681+
53682+skipit:
53683+#endif
53684+
53685+ if (unlikely(!(gr_status & GR_READY)))
53686+ return 0;
53687+
53688+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53689+ gr_log_learn_id_change('u', real, effective, fs);
53690+
53691+ num = current->acl->user_trans_num;
53692+ uidlist = current->acl->user_transitions;
53693+
53694+ if (uidlist == NULL)
53695+ return 0;
53696+
53697+ if (real == -1)
53698+ realok = 1;
53699+ if (effective == -1)
53700+ effectiveok = 1;
53701+ if (fs == -1)
53702+ fsok = 1;
53703+
53704+ if (current->acl->user_trans_type & GR_ID_ALLOW) {
53705+ for (i = 0; i < num; i++) {
53706+ curuid = (int)uidlist[i];
53707+ if (real == curuid)
53708+ realok = 1;
53709+ if (effective == curuid)
53710+ effectiveok = 1;
53711+ if (fs == curuid)
53712+ fsok = 1;
53713+ }
53714+ } else if (current->acl->user_trans_type & GR_ID_DENY) {
53715+ for (i = 0; i < num; i++) {
53716+ curuid = (int)uidlist[i];
53717+ if (real == curuid)
53718+ break;
53719+ if (effective == curuid)
53720+ break;
53721+ if (fs == curuid)
53722+ break;
53723+ }
53724+ /* not in deny list */
53725+ if (i == num) {
53726+ realok = 1;
53727+ effectiveok = 1;
53728+ fsok = 1;
53729+ }
53730+ }
53731+
53732+ if (realok && effectiveok && fsok)
53733+ return 0;
53734+ else {
53735+ gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53736+ return 1;
53737+ }
53738+}
53739+
53740+int
53741+gr_check_group_change(int real, int effective, int fs)
53742+{
53743+ unsigned int i;
53744+ __u16 num;
53745+ gid_t *gidlist;
53746+ int curgid;
53747+ int realok = 0;
53748+ int effectiveok = 0;
53749+ int fsok = 0;
53750+
53751+ if (unlikely(!(gr_status & GR_READY)))
53752+ return 0;
53753+
53754+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53755+ gr_log_learn_id_change('g', real, effective, fs);
53756+
53757+ num = current->acl->group_trans_num;
53758+ gidlist = current->acl->group_transitions;
53759+
53760+ if (gidlist == NULL)
53761+ return 0;
53762+
53763+ if (real == -1)
53764+ realok = 1;
53765+ if (effective == -1)
53766+ effectiveok = 1;
53767+ if (fs == -1)
53768+ fsok = 1;
53769+
53770+ if (current->acl->group_trans_type & GR_ID_ALLOW) {
53771+ for (i = 0; i < num; i++) {
53772+ curgid = (int)gidlist[i];
53773+ if (real == curgid)
53774+ realok = 1;
53775+ if (effective == curgid)
53776+ effectiveok = 1;
53777+ if (fs == curgid)
53778+ fsok = 1;
53779+ }
53780+ } else if (current->acl->group_trans_type & GR_ID_DENY) {
53781+ for (i = 0; i < num; i++) {
53782+ curgid = (int)gidlist[i];
53783+ if (real == curgid)
53784+ break;
53785+ if (effective == curgid)
53786+ break;
53787+ if (fs == curgid)
53788+ break;
53789+ }
53790+ /* not in deny list */
53791+ if (i == num) {
53792+ realok = 1;
53793+ effectiveok = 1;
53794+ fsok = 1;
53795+ }
53796+ }
53797+
53798+ if (realok && effectiveok && fsok)
53799+ return 0;
53800+ else {
53801+ gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53802+ return 1;
53803+ }
53804+}
53805+
53806+void
53807+gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
53808+{
53809+ struct acl_role_label *role = task->role;
53810+ struct acl_subject_label *subj = NULL;
53811+ struct acl_object_label *obj;
53812+ struct file *filp;
53813+
53814+ if (unlikely(!(gr_status & GR_READY)))
53815+ return;
53816+
53817+ filp = task->exec_file;
53818+
53819+ /* kernel process, we'll give them the kernel role */
53820+ if (unlikely(!filp)) {
53821+ task->role = kernel_role;
53822+ task->acl = kernel_role->root_label;
53823+ return;
53824+ } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
53825+ role = lookup_acl_role_label(task, uid, gid);
53826+
53827+ /* perform subject lookup in possibly new role
53828+ we can use this result below in the case where role == task->role
53829+ */
53830+ subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
53831+
53832+ /* if we changed uid/gid, but result in the same role
53833+ and are using inheritance, don't lose the inherited subject
53834+ if current subject is other than what normal lookup
53835+ would result in, we arrived via inheritance, don't
53836+ lose subject
53837+ */
53838+ if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
53839+ (subj == task->acl)))
53840+ task->acl = subj;
53841+
53842+ task->role = role;
53843+
53844+ task->is_writable = 0;
53845+
53846+ /* ignore additional mmap checks for processes that are writable
53847+ by the default ACL */
53848+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
53849+ if (unlikely(obj->mode & GR_WRITE))
53850+ task->is_writable = 1;
53851+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
53852+ if (unlikely(obj->mode & GR_WRITE))
53853+ task->is_writable = 1;
53854+
53855+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53856+ printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53857+#endif
53858+
53859+ gr_set_proc_res(task);
53860+
53861+ return;
53862+}
53863+
53864+int
53865+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
53866+ const int unsafe_share)
53867+{
53868+ struct task_struct *task = current;
53869+ struct acl_subject_label *newacl;
53870+ struct acl_object_label *obj;
53871+ __u32 retmode;
53872+
53873+ if (unlikely(!(gr_status & GR_READY)))
53874+ return 0;
53875+
53876+ newacl = chk_subj_label(dentry, mnt, task->role);
53877+
53878+ task_lock(task);
53879+ if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
53880+ !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
53881+ !(task->role->roletype & GR_ROLE_GOD) &&
53882+ !gr_search_file(dentry, GR_PTRACERD, mnt) &&
53883+ !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
53884+ task_unlock(task);
53885+ if (unsafe_share)
53886+ gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
53887+ else
53888+ gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
53889+ return -EACCES;
53890+ }
53891+ task_unlock(task);
53892+
53893+ obj = chk_obj_label(dentry, mnt, task->acl);
53894+ retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
53895+
53896+ if (!(task->acl->mode & GR_INHERITLEARN) &&
53897+ ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
53898+ if (obj->nested)
53899+ task->acl = obj->nested;
53900+ else
53901+ task->acl = newacl;
53902+ } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
53903+ gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
53904+
53905+ task->is_writable = 0;
53906+
53907+ /* ignore additional mmap checks for processes that are writable
53908+ by the default ACL */
53909+ obj = chk_obj_label(dentry, mnt, default_role->root_label);
53910+ if (unlikely(obj->mode & GR_WRITE))
53911+ task->is_writable = 1;
53912+ obj = chk_obj_label(dentry, mnt, task->role->root_label);
53913+ if (unlikely(obj->mode & GR_WRITE))
53914+ task->is_writable = 1;
53915+
53916+ gr_set_proc_res(task);
53917+
53918+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53919+ printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53920+#endif
53921+ return 0;
53922+}
53923+
53924+/* always called with valid inodev ptr */
53925+static void
53926+do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
53927+{
53928+ struct acl_object_label *matchpo;
53929+ struct acl_subject_label *matchps;
53930+ struct acl_subject_label *subj;
53931+ struct acl_role_label *role;
53932+ unsigned int x;
53933+
53934+ FOR_EACH_ROLE_START(role)
53935+ FOR_EACH_SUBJECT_START(role, subj, x)
53936+ if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
53937+ matchpo->mode |= GR_DELETED;
53938+ FOR_EACH_SUBJECT_END(subj,x)
53939+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
53940+ if (subj->inode == ino && subj->device == dev)
53941+ subj->mode |= GR_DELETED;
53942+ FOR_EACH_NESTED_SUBJECT_END(subj)
53943+ if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
53944+ matchps->mode |= GR_DELETED;
53945+ FOR_EACH_ROLE_END(role)
53946+
53947+ inodev->nentry->deleted = 1;
53948+
53949+ return;
53950+}
53951+
53952+void
53953+gr_handle_delete(const ino_t ino, const dev_t dev)
53954+{
53955+ struct inodev_entry *inodev;
53956+
53957+ if (unlikely(!(gr_status & GR_READY)))
53958+ return;
53959+
53960+ write_lock(&gr_inode_lock);
53961+ inodev = lookup_inodev_entry(ino, dev);
53962+ if (inodev != NULL)
53963+ do_handle_delete(inodev, ino, dev);
53964+ write_unlock(&gr_inode_lock);
53965+
53966+ return;
53967+}
53968+
53969+static void
53970+update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
53971+ const ino_t newinode, const dev_t newdevice,
53972+ struct acl_subject_label *subj)
53973+{
53974+ unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
53975+ struct acl_object_label *match;
53976+
53977+ match = subj->obj_hash[index];
53978+
53979+ while (match && (match->inode != oldinode ||
53980+ match->device != olddevice ||
53981+ !(match->mode & GR_DELETED)))
53982+ match = match->next;
53983+
53984+ if (match && (match->inode == oldinode)
53985+ && (match->device == olddevice)
53986+ && (match->mode & GR_DELETED)) {
53987+ if (match->prev == NULL) {
53988+ subj->obj_hash[index] = match->next;
53989+ if (match->next != NULL)
53990+ match->next->prev = NULL;
53991+ } else {
53992+ match->prev->next = match->next;
53993+ if (match->next != NULL)
53994+ match->next->prev = match->prev;
53995+ }
53996+ match->prev = NULL;
53997+ match->next = NULL;
53998+ match->inode = newinode;
53999+ match->device = newdevice;
54000+ match->mode &= ~GR_DELETED;
54001+
54002+ insert_acl_obj_label(match, subj);
54003+ }
54004+
54005+ return;
54006+}
54007+
54008+static void
54009+update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
54010+ const ino_t newinode, const dev_t newdevice,
54011+ struct acl_role_label *role)
54012+{
54013+ unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
54014+ struct acl_subject_label *match;
54015+
54016+ match = role->subj_hash[index];
54017+
54018+ while (match && (match->inode != oldinode ||
54019+ match->device != olddevice ||
54020+ !(match->mode & GR_DELETED)))
54021+ match = match->next;
54022+
54023+ if (match && (match->inode == oldinode)
54024+ && (match->device == olddevice)
54025+ && (match->mode & GR_DELETED)) {
54026+ if (match->prev == NULL) {
54027+ role->subj_hash[index] = match->next;
54028+ if (match->next != NULL)
54029+ match->next->prev = NULL;
54030+ } else {
54031+ match->prev->next = match->next;
54032+ if (match->next != NULL)
54033+ match->next->prev = match->prev;
54034+ }
54035+ match->prev = NULL;
54036+ match->next = NULL;
54037+ match->inode = newinode;
54038+ match->device = newdevice;
54039+ match->mode &= ~GR_DELETED;
54040+
54041+ insert_acl_subj_label(match, role);
54042+ }
54043+
54044+ return;
54045+}
54046+
54047+static void
54048+update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
54049+ const ino_t newinode, const dev_t newdevice)
54050+{
54051+ unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
54052+ struct inodev_entry *match;
54053+
54054+ match = inodev_set.i_hash[index];
54055+
54056+ while (match && (match->nentry->inode != oldinode ||
54057+ match->nentry->device != olddevice || !match->nentry->deleted))
54058+ match = match->next;
54059+
54060+ if (match && (match->nentry->inode == oldinode)
54061+ && (match->nentry->device == olddevice) &&
54062+ match->nentry->deleted) {
54063+ if (match->prev == NULL) {
54064+ inodev_set.i_hash[index] = match->next;
54065+ if (match->next != NULL)
54066+ match->next->prev = NULL;
54067+ } else {
54068+ match->prev->next = match->next;
54069+ if (match->next != NULL)
54070+ match->next->prev = match->prev;
54071+ }
54072+ match->prev = NULL;
54073+ match->next = NULL;
54074+ match->nentry->inode = newinode;
54075+ match->nentry->device = newdevice;
54076+ match->nentry->deleted = 0;
54077+
54078+ insert_inodev_entry(match);
54079+ }
54080+
54081+ return;
54082+}
54083+
54084+static void
54085+do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
54086+ const struct vfsmount *mnt)
54087+{
54088+ struct acl_subject_label *subj;
54089+ struct acl_role_label *role;
54090+ unsigned int x;
54091+ ino_t ino = dentry->d_inode->i_ino;
54092+ dev_t dev = __get_dev(dentry);
54093+
54094+ FOR_EACH_ROLE_START(role)
54095+ update_acl_subj_label(matchn->inode, matchn->device, ino, dev, role);
54096+
54097+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
54098+ if ((subj->inode == ino) && (subj->device == dev)) {
54099+ subj->inode = ino;
54100+ subj->device = dev;
54101+ }
54102+ FOR_EACH_NESTED_SUBJECT_END(subj)
54103+ FOR_EACH_SUBJECT_START(role, subj, x)
54104+ update_acl_obj_label(matchn->inode, matchn->device,
54105+ ino, dev, subj);
54106+ FOR_EACH_SUBJECT_END(subj,x)
54107+ FOR_EACH_ROLE_END(role)
54108+
54109+ update_inodev_entry(matchn->inode, matchn->device, ino, dev);
54110+
54111+ return;
54112+}
54113+
54114+void
54115+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
54116+{
54117+ struct name_entry *matchn;
54118+
54119+ if (unlikely(!(gr_status & GR_READY)))
54120+ return;
54121+
54122+ preempt_disable();
54123+ matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
54124+
54125+ if (unlikely((unsigned long)matchn)) {
54126+ write_lock(&gr_inode_lock);
54127+ do_handle_create(matchn, dentry, mnt);
54128+ write_unlock(&gr_inode_lock);
54129+ }
54130+ preempt_enable();
54131+
54132+ return;
54133+}
54134+
54135+void
54136+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
54137+ struct dentry *old_dentry,
54138+ struct dentry *new_dentry,
54139+ struct vfsmount *mnt, const __u8 replace)
54140+{
54141+ struct name_entry *matchn;
54142+ struct inodev_entry *inodev;
54143+ ino_t old_ino = old_dentry->d_inode->i_ino;
54144+ dev_t old_dev = __get_dev(old_dentry);
54145+
54146+ /* vfs_rename swaps the name and parent link for old_dentry and
54147+ new_dentry
54148+ at this point, old_dentry has the new name, parent link, and inode
54149+ for the renamed file
54150+ if a file is being replaced by a rename, new_dentry has the inode
54151+ and name for the replaced file
54152+ */
54153+
54154+ if (unlikely(!(gr_status & GR_READY)))
54155+ return;
54156+
54157+ preempt_disable();
54158+ matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
54159+
54160+ /* we wouldn't have to check d_inode if it weren't for
54161+ NFS silly-renaming
54162+ */
54163+
54164+ write_lock(&gr_inode_lock);
54165+ if (unlikely(replace && new_dentry->d_inode)) {
54166+ ino_t new_ino = new_dentry->d_inode->i_ino;
54167+ dev_t new_dev = __get_dev(new_dentry);
54168+
54169+ inodev = lookup_inodev_entry(new_ino, new_dev);
54170+ if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
54171+ do_handle_delete(inodev, new_ino, new_dev);
54172+ }
54173+
54174+ inodev = lookup_inodev_entry(old_ino, old_dev);
54175+ if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
54176+ do_handle_delete(inodev, old_ino, old_dev);
54177+
54178+ if (unlikely((unsigned long)matchn))
54179+ do_handle_create(matchn, old_dentry, mnt);
54180+
54181+ write_unlock(&gr_inode_lock);
54182+ preempt_enable();
54183+
54184+ return;
54185+}
54186+
54187+static int
54188+lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
54189+ unsigned char **sum)
54190+{
54191+ struct acl_role_label *r;
54192+ struct role_allowed_ip *ipp;
54193+ struct role_transition *trans;
54194+ unsigned int i;
54195+ int found = 0;
54196+ u32 curr_ip = current->signal->curr_ip;
54197+
54198+ current->signal->saved_ip = curr_ip;
54199+
54200+ /* check transition table */
54201+
54202+ for (trans = current->role->transitions; trans; trans = trans->next) {
54203+ if (!strcmp(rolename, trans->rolename)) {
54204+ found = 1;
54205+ break;
54206+ }
54207+ }
54208+
54209+ if (!found)
54210+ return 0;
54211+
54212+ /* handle special roles that do not require authentication
54213+ and check ip */
54214+
54215+ FOR_EACH_ROLE_START(r)
54216+ if (!strcmp(rolename, r->rolename) &&
54217+ (r->roletype & GR_ROLE_SPECIAL)) {
54218+ found = 0;
54219+ if (r->allowed_ips != NULL) {
54220+ for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
54221+ if ((ntohl(curr_ip) & ipp->netmask) ==
54222+ (ntohl(ipp->addr) & ipp->netmask))
54223+ found = 1;
54224+ }
54225+ } else
54226+ found = 2;
54227+ if (!found)
54228+ return 0;
54229+
54230+ if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
54231+ ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
54232+ *salt = NULL;
54233+ *sum = NULL;
54234+ return 1;
54235+ }
54236+ }
54237+ FOR_EACH_ROLE_END(r)
54238+
54239+ for (i = 0; i < num_sprole_pws; i++) {
54240+ if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
54241+ *salt = acl_special_roles[i]->salt;
54242+ *sum = acl_special_roles[i]->sum;
54243+ return 1;
54244+ }
54245+ }
54246+
54247+ return 0;
54248+}
54249+
54250+static void
54251+assign_special_role(char *rolename)
54252+{
54253+ struct acl_object_label *obj;
54254+ struct acl_role_label *r;
54255+ struct acl_role_label *assigned = NULL;
54256+ struct task_struct *tsk;
54257+ struct file *filp;
54258+
54259+ FOR_EACH_ROLE_START(r)
54260+ if (!strcmp(rolename, r->rolename) &&
54261+ (r->roletype & GR_ROLE_SPECIAL)) {
54262+ assigned = r;
54263+ break;
54264+ }
54265+ FOR_EACH_ROLE_END(r)
54266+
54267+ if (!assigned)
54268+ return;
54269+
54270+ read_lock(&tasklist_lock);
54271+ read_lock(&grsec_exec_file_lock);
54272+
54273+ tsk = current->real_parent;
54274+ if (tsk == NULL)
54275+ goto out_unlock;
54276+
54277+ filp = tsk->exec_file;
54278+ if (filp == NULL)
54279+ goto out_unlock;
54280+
54281+ tsk->is_writable = 0;
54282+
54283+ tsk->acl_sp_role = 1;
54284+ tsk->acl_role_id = ++acl_sp_role_value;
54285+ tsk->role = assigned;
54286+ tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
54287+
54288+ /* ignore additional mmap checks for processes that are writable
54289+ by the default ACL */
54290+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54291+ if (unlikely(obj->mode & GR_WRITE))
54292+ tsk->is_writable = 1;
54293+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
54294+ if (unlikely(obj->mode & GR_WRITE))
54295+ tsk->is_writable = 1;
54296+
54297+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54298+ printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
54299+#endif
54300+
54301+out_unlock:
54302+ read_unlock(&grsec_exec_file_lock);
54303+ read_unlock(&tasklist_lock);
54304+ return;
54305+}
54306+
54307+int gr_check_secure_terminal(struct task_struct *task)
54308+{
54309+ struct task_struct *p, *p2, *p3;
54310+ struct files_struct *files;
54311+ struct fdtable *fdt;
54312+ struct file *our_file = NULL, *file;
54313+ int i;
54314+
54315+ if (task->signal->tty == NULL)
54316+ return 1;
54317+
54318+ files = get_files_struct(task);
54319+ if (files != NULL) {
54320+ rcu_read_lock();
54321+ fdt = files_fdtable(files);
54322+ for (i=0; i < fdt->max_fds; i++) {
54323+ file = fcheck_files(files, i);
54324+ if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
54325+ get_file(file);
54326+ our_file = file;
54327+ }
54328+ }
54329+ rcu_read_unlock();
54330+ put_files_struct(files);
54331+ }
54332+
54333+ if (our_file == NULL)
54334+ return 1;
54335+
54336+ read_lock(&tasklist_lock);
54337+ do_each_thread(p2, p) {
54338+ files = get_files_struct(p);
54339+ if (files == NULL ||
54340+ (p->signal && p->signal->tty == task->signal->tty)) {
54341+ if (files != NULL)
54342+ put_files_struct(files);
54343+ continue;
54344+ }
54345+ rcu_read_lock();
54346+ fdt = files_fdtable(files);
54347+ for (i=0; i < fdt->max_fds; i++) {
54348+ file = fcheck_files(files, i);
54349+ if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
54350+ file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
54351+ p3 = task;
54352+ while (p3->pid > 0) {
54353+ if (p3 == p)
54354+ break;
54355+ p3 = p3->real_parent;
54356+ }
54357+ if (p3 == p)
54358+ break;
54359+ gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
54360+ gr_handle_alertkill(p);
54361+ rcu_read_unlock();
54362+ put_files_struct(files);
54363+ read_unlock(&tasklist_lock);
54364+ fput(our_file);
54365+ return 0;
54366+ }
54367+ }
54368+ rcu_read_unlock();
54369+ put_files_struct(files);
54370+ } while_each_thread(p2, p);
54371+ read_unlock(&tasklist_lock);
54372+
54373+ fput(our_file);
54374+ return 1;
54375+}
54376+
54377+ssize_t
54378+write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
54379+{
54380+ struct gr_arg_wrapper uwrap;
54381+ unsigned char *sprole_salt = NULL;
54382+ unsigned char *sprole_sum = NULL;
54383+ int error = sizeof (struct gr_arg_wrapper);
54384+ int error2 = 0;
54385+
54386+ mutex_lock(&gr_dev_mutex);
54387+
54388+ if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
54389+ error = -EPERM;
54390+ goto out;
54391+ }
54392+
54393+ if (count != sizeof (struct gr_arg_wrapper)) {
54394+ gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
54395+ error = -EINVAL;
54396+ goto out;
54397+ }
54398+
54399+
54400+ if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
54401+ gr_auth_expires = 0;
54402+ gr_auth_attempts = 0;
54403+ }
54404+
54405+ if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
54406+ error = -EFAULT;
54407+ goto out;
54408+ }
54409+
54410+ if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
54411+ error = -EINVAL;
54412+ goto out;
54413+ }
54414+
54415+ if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
54416+ error = -EFAULT;
54417+ goto out;
54418+ }
54419+
54420+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
54421+ gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
54422+ time_after(gr_auth_expires, get_seconds())) {
54423+ error = -EBUSY;
54424+ goto out;
54425+ }
54426+
54427+ /* if non-root trying to do anything other than use a special role,
54428+ do not attempt authentication, do not count towards authentication
54429+ locking
54430+ */
54431+
54432+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
54433+ gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
54434+ current_uid()) {
54435+ error = -EPERM;
54436+ goto out;
54437+ }
54438+
54439+ /* ensure pw and special role name are null terminated */
54440+
54441+ gr_usermode->pw[GR_PW_LEN - 1] = '\0';
54442+ gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
54443+
54444+ /* Okay.
54445+ * We have our enough of the argument structure..(we have yet
54446+ * to copy_from_user the tables themselves) . Copy the tables
54447+ * only if we need them, i.e. for loading operations. */
54448+
54449+ switch (gr_usermode->mode) {
54450+ case GR_STATUS:
54451+ if (gr_status & GR_READY) {
54452+ error = 1;
54453+ if (!gr_check_secure_terminal(current))
54454+ error = 3;
54455+ } else
54456+ error = 2;
54457+ goto out;
54458+ case GR_SHUTDOWN:
54459+ if ((gr_status & GR_READY)
54460+ && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54461+ pax_open_kernel();
54462+ gr_status &= ~GR_READY;
54463+ pax_close_kernel();
54464+
54465+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
54466+ free_variables();
54467+ memset(gr_usermode, 0, sizeof (struct gr_arg));
54468+ memset(gr_system_salt, 0, GR_SALT_LEN);
54469+ memset(gr_system_sum, 0, GR_SHA_LEN);
54470+ } else if (gr_status & GR_READY) {
54471+ gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
54472+ error = -EPERM;
54473+ } else {
54474+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
54475+ error = -EAGAIN;
54476+ }
54477+ break;
54478+ case GR_ENABLE:
54479+ if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
54480+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
54481+ else {
54482+ if (gr_status & GR_READY)
54483+ error = -EAGAIN;
54484+ else
54485+ error = error2;
54486+ gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
54487+ }
54488+ break;
54489+ case GR_RELOAD:
54490+ if (!(gr_status & GR_READY)) {
54491+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
54492+ error = -EAGAIN;
54493+ } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54494+ preempt_disable();
54495+
54496+ pax_open_kernel();
54497+ gr_status &= ~GR_READY;
54498+ pax_close_kernel();
54499+
54500+ free_variables();
54501+ if (!(error2 = gracl_init(gr_usermode))) {
54502+ preempt_enable();
54503+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
54504+ } else {
54505+ preempt_enable();
54506+ error = error2;
54507+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
54508+ }
54509+ } else {
54510+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
54511+ error = -EPERM;
54512+ }
54513+ break;
54514+ case GR_SEGVMOD:
54515+ if (unlikely(!(gr_status & GR_READY))) {
54516+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
54517+ error = -EAGAIN;
54518+ break;
54519+ }
54520+
54521+ if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54522+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
54523+ if (gr_usermode->segv_device && gr_usermode->segv_inode) {
54524+ struct acl_subject_label *segvacl;
54525+ segvacl =
54526+ lookup_acl_subj_label(gr_usermode->segv_inode,
54527+ gr_usermode->segv_device,
54528+ current->role);
54529+ if (segvacl) {
54530+ segvacl->crashes = 0;
54531+ segvacl->expires = 0;
54532+ }
54533+ } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
54534+ gr_remove_uid(gr_usermode->segv_uid);
54535+ }
54536+ } else {
54537+ gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
54538+ error = -EPERM;
54539+ }
54540+ break;
54541+ case GR_SPROLE:
54542+ case GR_SPROLEPAM:
54543+ if (unlikely(!(gr_status & GR_READY))) {
54544+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
54545+ error = -EAGAIN;
54546+ break;
54547+ }
54548+
54549+ if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
54550+ current->role->expires = 0;
54551+ current->role->auth_attempts = 0;
54552+ }
54553+
54554+ if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
54555+ time_after(current->role->expires, get_seconds())) {
54556+ error = -EBUSY;
54557+ goto out;
54558+ }
54559+
54560+ if (lookup_special_role_auth
54561+ (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
54562+ && ((!sprole_salt && !sprole_sum)
54563+ || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
54564+ char *p = "";
54565+ assign_special_role(gr_usermode->sp_role);
54566+ read_lock(&tasklist_lock);
54567+ if (current->real_parent)
54568+ p = current->real_parent->role->rolename;
54569+ read_unlock(&tasklist_lock);
54570+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
54571+ p, acl_sp_role_value);
54572+ } else {
54573+ gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
54574+ error = -EPERM;
54575+ if(!(current->role->auth_attempts++))
54576+ current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
54577+
54578+ goto out;
54579+ }
54580+ break;
54581+ case GR_UNSPROLE:
54582+ if (unlikely(!(gr_status & GR_READY))) {
54583+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
54584+ error = -EAGAIN;
54585+ break;
54586+ }
54587+
54588+ if (current->role->roletype & GR_ROLE_SPECIAL) {
54589+ char *p = "";
54590+ int i = 0;
54591+
54592+ read_lock(&tasklist_lock);
54593+ if (current->real_parent) {
54594+ p = current->real_parent->role->rolename;
54595+ i = current->real_parent->acl_role_id;
54596+ }
54597+ read_unlock(&tasklist_lock);
54598+
54599+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
54600+ gr_set_acls(1);
54601+ } else {
54602+ error = -EPERM;
54603+ goto out;
54604+ }
54605+ break;
54606+ default:
54607+ gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
54608+ error = -EINVAL;
54609+ break;
54610+ }
54611+
54612+ if (error != -EPERM)
54613+ goto out;
54614+
54615+ if(!(gr_auth_attempts++))
54616+ gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
54617+
54618+ out:
54619+ mutex_unlock(&gr_dev_mutex);
54620+ return error;
54621+}
54622+
54623+/* must be called with
54624+ rcu_read_lock();
54625+ read_lock(&tasklist_lock);
54626+ read_lock(&grsec_exec_file_lock);
54627+*/
54628+int gr_apply_subject_to_task(struct task_struct *task)
54629+{
54630+ struct acl_object_label *obj;
54631+ char *tmpname;
54632+ struct acl_subject_label *tmpsubj;
54633+ struct file *filp;
54634+ struct name_entry *nmatch;
54635+
54636+ filp = task->exec_file;
54637+ if (filp == NULL)
54638+ return 0;
54639+
54640+ /* the following is to apply the correct subject
54641+ on binaries running when the RBAC system
54642+ is enabled, when the binaries have been
54643+ replaced or deleted since their execution
54644+ -----
54645+ when the RBAC system starts, the inode/dev
54646+ from exec_file will be one the RBAC system
54647+ is unaware of. It only knows the inode/dev
54648+ of the present file on disk, or the absence
54649+ of it.
54650+ */
54651+ preempt_disable();
54652+ tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
54653+
54654+ nmatch = lookup_name_entry(tmpname);
54655+ preempt_enable();
54656+ tmpsubj = NULL;
54657+ if (nmatch) {
54658+ if (nmatch->deleted)
54659+ tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
54660+ else
54661+ tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
54662+ if (tmpsubj != NULL)
54663+ task->acl = tmpsubj;
54664+ }
54665+ if (tmpsubj == NULL)
54666+ task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
54667+ task->role);
54668+ if (task->acl) {
54669+ struct acl_subject_label *curr;
54670+ curr = task->acl;
54671+
54672+ task->is_writable = 0;
54673+ /* ignore additional mmap checks for processes that are writable
54674+ by the default ACL */
54675+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54676+ if (unlikely(obj->mode & GR_WRITE))
54677+ task->is_writable = 1;
54678+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
54679+ if (unlikely(obj->mode & GR_WRITE))
54680+ task->is_writable = 1;
54681+
54682+ gr_set_proc_res(task);
54683+
54684+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54685+ printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54686+#endif
54687+ } else {
54688+ return 1;
54689+ }
54690+
54691+ return 0;
54692+}
54693+
54694+int
54695+gr_set_acls(const int type)
54696+{
54697+ struct task_struct *task, *task2;
54698+ struct acl_role_label *role = current->role;
54699+ __u16 acl_role_id = current->acl_role_id;
54700+ const struct cred *cred;
54701+ int ret;
54702+
54703+ rcu_read_lock();
54704+ read_lock(&tasklist_lock);
54705+ read_lock(&grsec_exec_file_lock);
54706+ do_each_thread(task2, task) {
54707+ /* check to see if we're called from the exit handler,
54708+ if so, only replace ACLs that have inherited the admin
54709+ ACL */
54710+
54711+ if (type && (task->role != role ||
54712+ task->acl_role_id != acl_role_id))
54713+ continue;
54714+
54715+ task->acl_role_id = 0;
54716+ task->acl_sp_role = 0;
54717+
54718+ if (task->exec_file) {
54719+ cred = __task_cred(task);
54720+ task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
54721+ ret = gr_apply_subject_to_task(task);
54722+ if (ret) {
54723+ read_unlock(&grsec_exec_file_lock);
54724+ read_unlock(&tasklist_lock);
54725+ rcu_read_unlock();
54726+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
54727+ return ret;
54728+ }
54729+ } else {
54730+ // it's a kernel process
54731+ task->role = kernel_role;
54732+ task->acl = kernel_role->root_label;
54733+#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
54734+ task->acl->mode &= ~GR_PROCFIND;
54735+#endif
54736+ }
54737+ } while_each_thread(task2, task);
54738+ read_unlock(&grsec_exec_file_lock);
54739+ read_unlock(&tasklist_lock);
54740+ rcu_read_unlock();
54741+
54742+ return 0;
54743+}
54744+
54745+void
54746+gr_learn_resource(const struct task_struct *task,
54747+ const int res, const unsigned long wanted, const int gt)
54748+{
54749+ struct acl_subject_label *acl;
54750+ const struct cred *cred;
54751+
54752+ if (unlikely((gr_status & GR_READY) &&
54753+ task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
54754+ goto skip_reslog;
54755+
54756+#ifdef CONFIG_GRKERNSEC_RESLOG
54757+ gr_log_resource(task, res, wanted, gt);
54758+#endif
54759+ skip_reslog:
54760+
54761+ if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
54762+ return;
54763+
54764+ acl = task->acl;
54765+
54766+ if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
54767+ !(acl->resmask & (1 << (unsigned short) res))))
54768+ return;
54769+
54770+ if (wanted >= acl->res[res].rlim_cur) {
54771+ unsigned long res_add;
54772+
54773+ res_add = wanted;
54774+ switch (res) {
54775+ case RLIMIT_CPU:
54776+ res_add += GR_RLIM_CPU_BUMP;
54777+ break;
54778+ case RLIMIT_FSIZE:
54779+ res_add += GR_RLIM_FSIZE_BUMP;
54780+ break;
54781+ case RLIMIT_DATA:
54782+ res_add += GR_RLIM_DATA_BUMP;
54783+ break;
54784+ case RLIMIT_STACK:
54785+ res_add += GR_RLIM_STACK_BUMP;
54786+ break;
54787+ case RLIMIT_CORE:
54788+ res_add += GR_RLIM_CORE_BUMP;
54789+ break;
54790+ case RLIMIT_RSS:
54791+ res_add += GR_RLIM_RSS_BUMP;
54792+ break;
54793+ case RLIMIT_NPROC:
54794+ res_add += GR_RLIM_NPROC_BUMP;
54795+ break;
54796+ case RLIMIT_NOFILE:
54797+ res_add += GR_RLIM_NOFILE_BUMP;
54798+ break;
54799+ case RLIMIT_MEMLOCK:
54800+ res_add += GR_RLIM_MEMLOCK_BUMP;
54801+ break;
54802+ case RLIMIT_AS:
54803+ res_add += GR_RLIM_AS_BUMP;
54804+ break;
54805+ case RLIMIT_LOCKS:
54806+ res_add += GR_RLIM_LOCKS_BUMP;
54807+ break;
54808+ case RLIMIT_SIGPENDING:
54809+ res_add += GR_RLIM_SIGPENDING_BUMP;
54810+ break;
54811+ case RLIMIT_MSGQUEUE:
54812+ res_add += GR_RLIM_MSGQUEUE_BUMP;
54813+ break;
54814+ case RLIMIT_NICE:
54815+ res_add += GR_RLIM_NICE_BUMP;
54816+ break;
54817+ case RLIMIT_RTPRIO:
54818+ res_add += GR_RLIM_RTPRIO_BUMP;
54819+ break;
54820+ case RLIMIT_RTTIME:
54821+ res_add += GR_RLIM_RTTIME_BUMP;
54822+ break;
54823+ }
54824+
54825+ acl->res[res].rlim_cur = res_add;
54826+
54827+ if (wanted > acl->res[res].rlim_max)
54828+ acl->res[res].rlim_max = res_add;
54829+
54830+ /* only log the subject filename, since resource logging is supported for
54831+ single-subject learning only */
54832+ rcu_read_lock();
54833+ cred = __task_cred(task);
54834+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
54835+ task->role->roletype, cred->uid, cred->gid, acl->filename,
54836+ acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
54837+ "", (unsigned long) res, &task->signal->saved_ip);
54838+ rcu_read_unlock();
54839+ }
54840+
54841+ return;
54842+}
54843+
54844+#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
54845+void
54846+pax_set_initial_flags(struct linux_binprm *bprm)
54847+{
54848+ struct task_struct *task = current;
54849+ struct acl_subject_label *proc;
54850+ unsigned long flags;
54851+
54852+ if (unlikely(!(gr_status & GR_READY)))
54853+ return;
54854+
54855+ flags = pax_get_flags(task);
54856+
54857+ proc = task->acl;
54858+
54859+ if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
54860+ flags &= ~MF_PAX_PAGEEXEC;
54861+ if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
54862+ flags &= ~MF_PAX_SEGMEXEC;
54863+ if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
54864+ flags &= ~MF_PAX_RANDMMAP;
54865+ if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
54866+ flags &= ~MF_PAX_EMUTRAMP;
54867+ if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
54868+ flags &= ~MF_PAX_MPROTECT;
54869+
54870+ if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
54871+ flags |= MF_PAX_PAGEEXEC;
54872+ if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
54873+ flags |= MF_PAX_SEGMEXEC;
54874+ if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
54875+ flags |= MF_PAX_RANDMMAP;
54876+ if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
54877+ flags |= MF_PAX_EMUTRAMP;
54878+ if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
54879+ flags |= MF_PAX_MPROTECT;
54880+
54881+ pax_set_flags(task, flags);
54882+
54883+ return;
54884+}
54885+#endif
54886+
54887+#ifdef CONFIG_SYSCTL
54888+/* Eric Biederman likes breaking userland ABI and every inode-based security
54889+ system to save 35kb of memory */
54890+
54891+/* we modify the passed in filename, but adjust it back before returning */
54892+static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
54893+{
54894+ struct name_entry *nmatch;
54895+ char *p, *lastp = NULL;
54896+ struct acl_object_label *obj = NULL, *tmp;
54897+ struct acl_subject_label *tmpsubj;
54898+ char c = '\0';
54899+
54900+ read_lock(&gr_inode_lock);
54901+
54902+ p = name + len - 1;
54903+ do {
54904+ nmatch = lookup_name_entry(name);
54905+ if (lastp != NULL)
54906+ *lastp = c;
54907+
54908+ if (nmatch == NULL)
54909+ goto next_component;
54910+ tmpsubj = current->acl;
54911+ do {
54912+ obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
54913+ if (obj != NULL) {
54914+ tmp = obj->globbed;
54915+ while (tmp) {
54916+ if (!glob_match(tmp->filename, name)) {
54917+ obj = tmp;
54918+ goto found_obj;
54919+ }
54920+ tmp = tmp->next;
54921+ }
54922+ goto found_obj;
54923+ }
54924+ } while ((tmpsubj = tmpsubj->parent_subject));
54925+next_component:
54926+ /* end case */
54927+ if (p == name)
54928+ break;
54929+
54930+ while (*p != '/')
54931+ p--;
54932+ if (p == name)
54933+ lastp = p + 1;
54934+ else {
54935+ lastp = p;
54936+ p--;
54937+ }
54938+ c = *lastp;
54939+ *lastp = '\0';
54940+ } while (1);
54941+found_obj:
54942+ read_unlock(&gr_inode_lock);
54943+ /* obj returned will always be non-null */
54944+ return obj;
54945+}
54946+
54947+/* returns 0 when allowing, non-zero on error
54948+ op of 0 is used for readdir, so we don't log the names of hidden files
54949+*/
54950+__u32
54951+gr_handle_sysctl(const struct ctl_table *table, const int op)
54952+{
54953+ struct ctl_table *tmp;
54954+ const char *proc_sys = "/proc/sys";
54955+ char *path;
54956+ struct acl_object_label *obj;
54957+ unsigned short len = 0, pos = 0, depth = 0, i;
54958+ __u32 err = 0;
54959+ __u32 mode = 0;
54960+
54961+ if (unlikely(!(gr_status & GR_READY)))
54962+ return 0;
54963+
54964+ /* for now, ignore operations on non-sysctl entries if it's not a
54965+ readdir*/
54966+ if (table->child != NULL && op != 0)
54967+ return 0;
54968+
54969+ mode |= GR_FIND;
54970+ /* it's only a read if it's an entry, read on dirs is for readdir */
54971+ if (op & MAY_READ)
54972+ mode |= GR_READ;
54973+ if (op & MAY_WRITE)
54974+ mode |= GR_WRITE;
54975+
54976+ preempt_disable();
54977+
54978+ path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
54979+
54980+ /* it's only a read/write if it's an actual entry, not a dir
54981+ (which are opened for readdir)
54982+ */
54983+
54984+ /* convert the requested sysctl entry into a pathname */
54985+
54986+ for (tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
54987+ len += strlen(tmp->procname);
54988+ len++;
54989+ depth++;
54990+ }
54991+
54992+ if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
54993+ /* deny */
54994+ goto out;
54995+ }
54996+
54997+ memset(path, 0, PAGE_SIZE);
54998+
54999+ memcpy(path, proc_sys, strlen(proc_sys));
55000+
55001+ pos += strlen(proc_sys);
55002+
55003+ for (; depth > 0; depth--) {
55004+ path[pos] = '/';
55005+ pos++;
55006+ for (i = 1, tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
55007+ if (depth == i) {
55008+ memcpy(path + pos, tmp->procname,
55009+ strlen(tmp->procname));
55010+ pos += strlen(tmp->procname);
55011+ }
55012+ i++;
55013+ }
55014+ }
55015+
55016+ obj = gr_lookup_by_name(path, pos);
55017+ err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
55018+
55019+ if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
55020+ ((err & mode) != mode))) {
55021+ __u32 new_mode = mode;
55022+
55023+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
55024+
55025+ err = 0;
55026+ gr_log_learn_sysctl(path, new_mode);
55027+ } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
55028+ gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
55029+ err = -ENOENT;
55030+ } else if (!(err & GR_FIND)) {
55031+ err = -ENOENT;
55032+ } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
55033+ gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
55034+ path, (mode & GR_READ) ? " reading" : "",
55035+ (mode & GR_WRITE) ? " writing" : "");
55036+ err = -EACCES;
55037+ } else if ((err & mode) != mode) {
55038+ err = -EACCES;
55039+ } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
55040+ gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
55041+ path, (mode & GR_READ) ? " reading" : "",
55042+ (mode & GR_WRITE) ? " writing" : "");
55043+ err = 0;
55044+ } else
55045+ err = 0;
55046+
55047+ out:
55048+ preempt_enable();
55049+
55050+ return err;
55051+}
55052+#endif
55053+
55054+int
55055+gr_handle_proc_ptrace(struct task_struct *task)
55056+{
55057+ struct file *filp;
55058+ struct task_struct *tmp = task;
55059+ struct task_struct *curtemp = current;
55060+ __u32 retmode;
55061+
55062+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
55063+ if (unlikely(!(gr_status & GR_READY)))
55064+ return 0;
55065+#endif
55066+
55067+ read_lock(&tasklist_lock);
55068+ read_lock(&grsec_exec_file_lock);
55069+ filp = task->exec_file;
55070+
55071+ while (tmp->pid > 0) {
55072+ if (tmp == curtemp)
55073+ break;
55074+ tmp = tmp->real_parent;
55075+ }
55076+
55077+ if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
55078+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
55079+ read_unlock(&grsec_exec_file_lock);
55080+ read_unlock(&tasklist_lock);
55081+ return 1;
55082+ }
55083+
55084+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
55085+ if (!(gr_status & GR_READY)) {
55086+ read_unlock(&grsec_exec_file_lock);
55087+ read_unlock(&tasklist_lock);
55088+ return 0;
55089+ }
55090+#endif
55091+
55092+ retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
55093+ read_unlock(&grsec_exec_file_lock);
55094+ read_unlock(&tasklist_lock);
55095+
55096+ if (retmode & GR_NOPTRACE)
55097+ return 1;
55098+
55099+ if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
55100+ && (current->acl != task->acl || (current->acl != current->role->root_label
55101+ && current->pid != task->pid)))
55102+ return 1;
55103+
55104+ return 0;
55105+}
55106+
55107+void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
55108+{
55109+ if (unlikely(!(gr_status & GR_READY)))
55110+ return;
55111+
55112+ if (!(current->role->roletype & GR_ROLE_GOD))
55113+ return;
55114+
55115+ seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
55116+ p->role->rolename, gr_task_roletype_to_char(p),
55117+ p->acl->filename);
55118+}
55119+
55120+int
55121+gr_handle_ptrace(struct task_struct *task, const long request)
55122+{
55123+ struct task_struct *tmp = task;
55124+ struct task_struct *curtemp = current;
55125+ __u32 retmode;
55126+
55127+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
55128+ if (unlikely(!(gr_status & GR_READY)))
55129+ return 0;
55130+#endif
55131+
55132+ read_lock(&tasklist_lock);
55133+ while (tmp->pid > 0) {
55134+ if (tmp == curtemp)
55135+ break;
55136+ tmp = tmp->real_parent;
55137+ }
55138+
55139+ if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
55140+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
55141+ read_unlock(&tasklist_lock);
55142+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55143+ return 1;
55144+ }
55145+ read_unlock(&tasklist_lock);
55146+
55147+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
55148+ if (!(gr_status & GR_READY))
55149+ return 0;
55150+#endif
55151+
55152+ read_lock(&grsec_exec_file_lock);
55153+ if (unlikely(!task->exec_file)) {
55154+ read_unlock(&grsec_exec_file_lock);
55155+ return 0;
55156+ }
55157+
55158+ retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
55159+ read_unlock(&grsec_exec_file_lock);
55160+
55161+ if (retmode & GR_NOPTRACE) {
55162+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55163+ return 1;
55164+ }
55165+
55166+ if (retmode & GR_PTRACERD) {
55167+ switch (request) {
55168+ case PTRACE_POKETEXT:
55169+ case PTRACE_POKEDATA:
55170+ case PTRACE_POKEUSR:
55171+#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
55172+ case PTRACE_SETREGS:
55173+ case PTRACE_SETFPREGS:
55174+#endif
55175+#ifdef CONFIG_X86
55176+ case PTRACE_SETFPXREGS:
55177+#endif
55178+#ifdef CONFIG_ALTIVEC
55179+ case PTRACE_SETVRREGS:
55180+#endif
55181+ return 1;
55182+ default:
55183+ return 0;
55184+ }
55185+ } else if (!(current->acl->mode & GR_POVERRIDE) &&
55186+ !(current->role->roletype & GR_ROLE_GOD) &&
55187+ (current->acl != task->acl)) {
55188+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55189+ return 1;
55190+ }
55191+
55192+ return 0;
55193+}
55194+
55195+static int is_writable_mmap(const struct file *filp)
55196+{
55197+ struct task_struct *task = current;
55198+ struct acl_object_label *obj, *obj2;
55199+
55200+ if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
55201+ !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
55202+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
55203+ obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
55204+ task->role->root_label);
55205+ if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
55206+ gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
55207+ return 1;
55208+ }
55209+ }
55210+ return 0;
55211+}
55212+
55213+int
55214+gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
55215+{
55216+ __u32 mode;
55217+
55218+ if (unlikely(!file || !(prot & PROT_EXEC)))
55219+ return 1;
55220+
55221+ if (is_writable_mmap(file))
55222+ return 0;
55223+
55224+ mode =
55225+ gr_search_file(file->f_path.dentry,
55226+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
55227+ file->f_path.mnt);
55228+
55229+ if (!gr_tpe_allow(file))
55230+ return 0;
55231+
55232+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
55233+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55234+ return 0;
55235+ } else if (unlikely(!(mode & GR_EXEC))) {
55236+ return 0;
55237+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
55238+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55239+ return 1;
55240+ }
55241+
55242+ return 1;
55243+}
55244+
55245+int
55246+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
55247+{
55248+ __u32 mode;
55249+
55250+ if (unlikely(!file || !(prot & PROT_EXEC)))
55251+ return 1;
55252+
55253+ if (is_writable_mmap(file))
55254+ return 0;
55255+
55256+ mode =
55257+ gr_search_file(file->f_path.dentry,
55258+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
55259+ file->f_path.mnt);
55260+
55261+ if (!gr_tpe_allow(file))
55262+ return 0;
55263+
55264+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
55265+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55266+ return 0;
55267+ } else if (unlikely(!(mode & GR_EXEC))) {
55268+ return 0;
55269+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
55270+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55271+ return 1;
55272+ }
55273+
55274+ return 1;
55275+}
55276+
55277+void
55278+gr_acl_handle_psacct(struct task_struct *task, const long code)
55279+{
55280+ unsigned long runtime;
55281+ unsigned long cputime;
55282+ unsigned int wday, cday;
55283+ __u8 whr, chr;
55284+ __u8 wmin, cmin;
55285+ __u8 wsec, csec;
55286+ struct timespec timeval;
55287+
55288+ if (unlikely(!(gr_status & GR_READY) || !task->acl ||
55289+ !(task->acl->mode & GR_PROCACCT)))
55290+ return;
55291+
55292+ do_posix_clock_monotonic_gettime(&timeval);
55293+ runtime = timeval.tv_sec - task->start_time.tv_sec;
55294+ wday = runtime / (3600 * 24);
55295+ runtime -= wday * (3600 * 24);
55296+ whr = runtime / 3600;
55297+ runtime -= whr * 3600;
55298+ wmin = runtime / 60;
55299+ runtime -= wmin * 60;
55300+ wsec = runtime;
55301+
55302+ cputime = (task->utime + task->stime) / HZ;
55303+ cday = cputime / (3600 * 24);
55304+ cputime -= cday * (3600 * 24);
55305+ chr = cputime / 3600;
55306+ cputime -= chr * 3600;
55307+ cmin = cputime / 60;
55308+ cputime -= cmin * 60;
55309+ csec = cputime;
55310+
55311+ gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
55312+
55313+ return;
55314+}
55315+
55316+void gr_set_kernel_label(struct task_struct *task)
55317+{
55318+ if (gr_status & GR_READY) {
55319+ task->role = kernel_role;
55320+ task->acl = kernel_role->root_label;
55321+ }
55322+ return;
55323+}
55324+
55325+#ifdef CONFIG_TASKSTATS
55326+int gr_is_taskstats_denied(int pid)
55327+{
55328+ struct task_struct *task;
55329+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55330+ const struct cred *cred;
55331+#endif
55332+ int ret = 0;
55333+
55334+ /* restrict taskstats viewing to un-chrooted root users
55335+ who have the 'view' subject flag if the RBAC system is enabled
55336+ */
55337+
55338+ rcu_read_lock();
55339+ read_lock(&tasklist_lock);
55340+ task = find_task_by_vpid(pid);
55341+ if (task) {
55342+#ifdef CONFIG_GRKERNSEC_CHROOT
55343+ if (proc_is_chrooted(task))
55344+ ret = -EACCES;
55345+#endif
55346+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55347+ cred = __task_cred(task);
55348+#ifdef CONFIG_GRKERNSEC_PROC_USER
55349+ if (cred->uid != 0)
55350+ ret = -EACCES;
55351+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55352+ if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
55353+ ret = -EACCES;
55354+#endif
55355+#endif
55356+ if (gr_status & GR_READY) {
55357+ if (!(task->acl->mode & GR_VIEW))
55358+ ret = -EACCES;
55359+ }
55360+ } else
55361+ ret = -ENOENT;
55362+
55363+ read_unlock(&tasklist_lock);
55364+ rcu_read_unlock();
55365+
55366+ return ret;
55367+}
55368+#endif
55369+
55370+/* AUXV entries are filled via a descendant of search_binary_handler
55371+ after we've already applied the subject for the target
55372+*/
55373+int gr_acl_enable_at_secure(void)
55374+{
55375+ if (unlikely(!(gr_status & GR_READY)))
55376+ return 0;
55377+
55378+ if (current->acl->mode & GR_ATSECURE)
55379+ return 1;
55380+
55381+ return 0;
55382+}
55383+
55384+int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
55385+{
55386+ struct task_struct *task = current;
55387+ struct dentry *dentry = file->f_path.dentry;
55388+ struct vfsmount *mnt = file->f_path.mnt;
55389+ struct acl_object_label *obj, *tmp;
55390+ struct acl_subject_label *subj;
55391+ unsigned int bufsize;
55392+ int is_not_root;
55393+ char *path;
55394+ dev_t dev = __get_dev(dentry);
55395+
55396+ if (unlikely(!(gr_status & GR_READY)))
55397+ return 1;
55398+
55399+ if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
55400+ return 1;
55401+
55402+ /* ignore Eric Biederman */
55403+ if (IS_PRIVATE(dentry->d_inode))
55404+ return 1;
55405+
55406+ subj = task->acl;
55407+ do {
55408+ obj = lookup_acl_obj_label(ino, dev, subj);
55409+ if (obj != NULL)
55410+ return (obj->mode & GR_FIND) ? 1 : 0;
55411+ } while ((subj = subj->parent_subject));
55412+
55413+ /* this is purely an optimization since we're looking for an object
55414+ for the directory we're doing a readdir on
55415+ if it's possible for any globbed object to match the entry we're
55416+ filling into the directory, then the object we find here will be
55417+ an anchor point with attached globbed objects
55418+ */
55419+ obj = chk_obj_label_noglob(dentry, mnt, task->acl);
55420+ if (obj->globbed == NULL)
55421+ return (obj->mode & GR_FIND) ? 1 : 0;
55422+
55423+ is_not_root = ((obj->filename[0] == '/') &&
55424+ (obj->filename[1] == '\0')) ? 0 : 1;
55425+ bufsize = PAGE_SIZE - namelen - is_not_root;
55426+
55427+ /* check bufsize > PAGE_SIZE || bufsize == 0 */
55428+ if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
55429+ return 1;
55430+
55431+ preempt_disable();
55432+ path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
55433+ bufsize);
55434+
55435+ bufsize = strlen(path);
55436+
55437+ /* if base is "/", don't append an additional slash */
55438+ if (is_not_root)
55439+ *(path + bufsize) = '/';
55440+ memcpy(path + bufsize + is_not_root, name, namelen);
55441+ *(path + bufsize + namelen + is_not_root) = '\0';
55442+
55443+ tmp = obj->globbed;
55444+ while (tmp) {
55445+ if (!glob_match(tmp->filename, path)) {
55446+ preempt_enable();
55447+ return (tmp->mode & GR_FIND) ? 1 : 0;
55448+ }
55449+ tmp = tmp->next;
55450+ }
55451+ preempt_enable();
55452+ return (obj->mode & GR_FIND) ? 1 : 0;
55453+}
55454+
55455+#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
55456+EXPORT_SYMBOL(gr_acl_is_enabled);
55457+#endif
55458+EXPORT_SYMBOL(gr_learn_resource);
55459+EXPORT_SYMBOL(gr_set_kernel_label);
55460+#ifdef CONFIG_SECURITY
55461+EXPORT_SYMBOL(gr_check_user_change);
55462+EXPORT_SYMBOL(gr_check_group_change);
55463+#endif
55464+
55465diff -urNp linux-2.6.39.1/grsecurity/gracl_cap.c linux-2.6.39.1/grsecurity/gracl_cap.c
55466--- linux-2.6.39.1/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500
55467+++ linux-2.6.39.1/grsecurity/gracl_cap.c 2011-05-22 19:41:42.000000000 -0400
55468@@ -0,0 +1,139 @@
55469+#include <linux/kernel.h>
55470+#include <linux/module.h>
55471+#include <linux/sched.h>
55472+#include <linux/gracl.h>
55473+#include <linux/grsecurity.h>
55474+#include <linux/grinternal.h>
55475+
55476+static const char *captab_log[] = {
55477+ "CAP_CHOWN",
55478+ "CAP_DAC_OVERRIDE",
55479+ "CAP_DAC_READ_SEARCH",
55480+ "CAP_FOWNER",
55481+ "CAP_FSETID",
55482+ "CAP_KILL",
55483+ "CAP_SETGID",
55484+ "CAP_SETUID",
55485+ "CAP_SETPCAP",
55486+ "CAP_LINUX_IMMUTABLE",
55487+ "CAP_NET_BIND_SERVICE",
55488+ "CAP_NET_BROADCAST",
55489+ "CAP_NET_ADMIN",
55490+ "CAP_NET_RAW",
55491+ "CAP_IPC_LOCK",
55492+ "CAP_IPC_OWNER",
55493+ "CAP_SYS_MODULE",
55494+ "CAP_SYS_RAWIO",
55495+ "CAP_SYS_CHROOT",
55496+ "CAP_SYS_PTRACE",
55497+ "CAP_SYS_PACCT",
55498+ "CAP_SYS_ADMIN",
55499+ "CAP_SYS_BOOT",
55500+ "CAP_SYS_NICE",
55501+ "CAP_SYS_RESOURCE",
55502+ "CAP_SYS_TIME",
55503+ "CAP_SYS_TTY_CONFIG",
55504+ "CAP_MKNOD",
55505+ "CAP_LEASE",
55506+ "CAP_AUDIT_WRITE",
55507+ "CAP_AUDIT_CONTROL",
55508+ "CAP_SETFCAP",
55509+ "CAP_MAC_OVERRIDE",
55510+ "CAP_MAC_ADMIN",
55511+ "CAP_SYSLOG"
55512+};
55513+
55514+EXPORT_SYMBOL(gr_is_capable);
55515+EXPORT_SYMBOL(gr_is_capable_nolog);
55516+
55517+int
55518+gr_is_capable(const int cap)
55519+{
55520+ struct task_struct *task = current;
55521+ const struct cred *cred = current_cred();
55522+ struct acl_subject_label *curracl;
55523+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55524+ kernel_cap_t cap_audit = __cap_empty_set;
55525+
55526+ if (!gr_acl_is_enabled())
55527+ return 1;
55528+
55529+ curracl = task->acl;
55530+
55531+ cap_drop = curracl->cap_lower;
55532+ cap_mask = curracl->cap_mask;
55533+ cap_audit = curracl->cap_invert_audit;
55534+
55535+ while ((curracl = curracl->parent_subject)) {
55536+ /* if the cap isn't specified in the current computed mask but is specified in the
55537+ current level subject, and is lowered in the current level subject, then add
55538+ it to the set of dropped capabilities
55539+ otherwise, add the current level subject's mask to the current computed mask
55540+ */
55541+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55542+ cap_raise(cap_mask, cap);
55543+ if (cap_raised(curracl->cap_lower, cap))
55544+ cap_raise(cap_drop, cap);
55545+ if (cap_raised(curracl->cap_invert_audit, cap))
55546+ cap_raise(cap_audit, cap);
55547+ }
55548+ }
55549+
55550+ if (!cap_raised(cap_drop, cap)) {
55551+ if (cap_raised(cap_audit, cap))
55552+ gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
55553+ return 1;
55554+ }
55555+
55556+ curracl = task->acl;
55557+
55558+ if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
55559+ && cap_raised(cred->cap_effective, cap)) {
55560+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
55561+ task->role->roletype, cred->uid,
55562+ cred->gid, task->exec_file ?
55563+ gr_to_filename(task->exec_file->f_path.dentry,
55564+ task->exec_file->f_path.mnt) : curracl->filename,
55565+ curracl->filename, 0UL,
55566+ 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
55567+ return 1;
55568+ }
55569+
55570+ if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
55571+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
55572+ return 0;
55573+}
55574+
55575+int
55576+gr_is_capable_nolog(const int cap)
55577+{
55578+ struct acl_subject_label *curracl;
55579+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55580+
55581+ if (!gr_acl_is_enabled())
55582+ return 1;
55583+
55584+ curracl = current->acl;
55585+
55586+ cap_drop = curracl->cap_lower;
55587+ cap_mask = curracl->cap_mask;
55588+
55589+ while ((curracl = curracl->parent_subject)) {
55590+ /* if the cap isn't specified in the current computed mask but is specified in the
55591+ current level subject, and is lowered in the current level subject, then add
55592+ it to the set of dropped capabilities
55593+ otherwise, add the current level subject's mask to the current computed mask
55594+ */
55595+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55596+ cap_raise(cap_mask, cap);
55597+ if (cap_raised(curracl->cap_lower, cap))
55598+ cap_raise(cap_drop, cap);
55599+ }
55600+ }
55601+
55602+ if (!cap_raised(cap_drop, cap))
55603+ return 1;
55604+
55605+ return 0;
55606+}
55607+
55608diff -urNp linux-2.6.39.1/grsecurity/gracl_fs.c linux-2.6.39.1/grsecurity/gracl_fs.c
55609--- linux-2.6.39.1/grsecurity/gracl_fs.c 1969-12-31 19:00:00.000000000 -0500
55610+++ linux-2.6.39.1/grsecurity/gracl_fs.c 2011-05-22 19:41:42.000000000 -0400
55611@@ -0,0 +1,431 @@
55612+#include <linux/kernel.h>
55613+#include <linux/sched.h>
55614+#include <linux/types.h>
55615+#include <linux/fs.h>
55616+#include <linux/file.h>
55617+#include <linux/stat.h>
55618+#include <linux/grsecurity.h>
55619+#include <linux/grinternal.h>
55620+#include <linux/gracl.h>
55621+
55622+__u32
55623+gr_acl_handle_hidden_file(const struct dentry * dentry,
55624+ const struct vfsmount * mnt)
55625+{
55626+ __u32 mode;
55627+
55628+ if (unlikely(!dentry->d_inode))
55629+ return GR_FIND;
55630+
55631+ mode =
55632+ gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
55633+
55634+ if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
55635+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55636+ return mode;
55637+ } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
55638+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55639+ return 0;
55640+ } else if (unlikely(!(mode & GR_FIND)))
55641+ return 0;
55642+
55643+ return GR_FIND;
55644+}
55645+
55646+__u32
55647+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
55648+ const int fmode)
55649+{
55650+ __u32 reqmode = GR_FIND;
55651+ __u32 mode;
55652+
55653+ if (unlikely(!dentry->d_inode))
55654+ return reqmode;
55655+
55656+ if (unlikely(fmode & O_APPEND))
55657+ reqmode |= GR_APPEND;
55658+ else if (unlikely(fmode & FMODE_WRITE))
55659+ reqmode |= GR_WRITE;
55660+ if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
55661+ reqmode |= GR_READ;
55662+ if ((fmode & FMODE_GREXEC) && (fmode & __FMODE_EXEC))
55663+ reqmode &= ~GR_READ;
55664+ mode =
55665+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55666+ mnt);
55667+
55668+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55669+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55670+ reqmode & GR_READ ? " reading" : "",
55671+ reqmode & GR_WRITE ? " writing" : reqmode &
55672+ GR_APPEND ? " appending" : "");
55673+ return reqmode;
55674+ } else
55675+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55676+ {
55677+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55678+ reqmode & GR_READ ? " reading" : "",
55679+ reqmode & GR_WRITE ? " writing" : reqmode &
55680+ GR_APPEND ? " appending" : "");
55681+ return 0;
55682+ } else if (unlikely((mode & reqmode) != reqmode))
55683+ return 0;
55684+
55685+ return reqmode;
55686+}
55687+
55688+__u32
55689+gr_acl_handle_creat(const struct dentry * dentry,
55690+ const struct dentry * p_dentry,
55691+ const struct vfsmount * p_mnt, const int fmode,
55692+ const int imode)
55693+{
55694+ __u32 reqmode = GR_WRITE | GR_CREATE;
55695+ __u32 mode;
55696+
55697+ if (unlikely(fmode & O_APPEND))
55698+ reqmode |= GR_APPEND;
55699+ if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
55700+ reqmode |= GR_READ;
55701+ if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
55702+ reqmode |= GR_SETID;
55703+
55704+ mode =
55705+ gr_check_create(dentry, p_dentry, p_mnt,
55706+ reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55707+
55708+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55709+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55710+ reqmode & GR_READ ? " reading" : "",
55711+ reqmode & GR_WRITE ? " writing" : reqmode &
55712+ GR_APPEND ? " appending" : "");
55713+ return reqmode;
55714+ } else
55715+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55716+ {
55717+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55718+ reqmode & GR_READ ? " reading" : "",
55719+ reqmode & GR_WRITE ? " writing" : reqmode &
55720+ GR_APPEND ? " appending" : "");
55721+ return 0;
55722+ } else if (unlikely((mode & reqmode) != reqmode))
55723+ return 0;
55724+
55725+ return reqmode;
55726+}
55727+
55728+__u32
55729+gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
55730+ const int fmode)
55731+{
55732+ __u32 mode, reqmode = GR_FIND;
55733+
55734+ if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
55735+ reqmode |= GR_EXEC;
55736+ if (fmode & S_IWOTH)
55737+ reqmode |= GR_WRITE;
55738+ if (fmode & S_IROTH)
55739+ reqmode |= GR_READ;
55740+
55741+ mode =
55742+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55743+ mnt);
55744+
55745+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55746+ gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55747+ reqmode & GR_READ ? " reading" : "",
55748+ reqmode & GR_WRITE ? " writing" : "",
55749+ reqmode & GR_EXEC ? " executing" : "");
55750+ return reqmode;
55751+ } else
55752+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55753+ {
55754+ gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55755+ reqmode & GR_READ ? " reading" : "",
55756+ reqmode & GR_WRITE ? " writing" : "",
55757+ reqmode & GR_EXEC ? " executing" : "");
55758+ return 0;
55759+ } else if (unlikely((mode & reqmode) != reqmode))
55760+ return 0;
55761+
55762+ return reqmode;
55763+}
55764+
55765+static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
55766+{
55767+ __u32 mode;
55768+
55769+ mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
55770+
55771+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55772+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
55773+ return mode;
55774+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55775+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
55776+ return 0;
55777+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
55778+ return 0;
55779+
55780+ return (reqmode);
55781+}
55782+
55783+__u32
55784+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
55785+{
55786+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
55787+}
55788+
55789+__u32
55790+gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
55791+{
55792+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
55793+}
55794+
55795+__u32
55796+gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
55797+{
55798+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
55799+}
55800+
55801+__u32
55802+gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
55803+{
55804+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
55805+}
55806+
55807+__u32
55808+gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
55809+ mode_t mode)
55810+{
55811+ if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
55812+ return 1;
55813+
55814+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
55815+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55816+ GR_FCHMOD_ACL_MSG);
55817+ } else {
55818+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
55819+ }
55820+}
55821+
55822+__u32
55823+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
55824+ mode_t mode)
55825+{
55826+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
55827+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55828+ GR_CHMOD_ACL_MSG);
55829+ } else {
55830+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
55831+ }
55832+}
55833+
55834+__u32
55835+gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
55836+{
55837+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
55838+}
55839+
55840+__u32
55841+gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
55842+{
55843+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
55844+}
55845+
55846+__u32
55847+gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
55848+{
55849+ return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
55850+}
55851+
55852+__u32
55853+gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
55854+{
55855+ return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
55856+ GR_UNIXCONNECT_ACL_MSG);
55857+}
55858+
55859+/* hardlinks require at minimum create permission,
55860+ any additional privilege required is based on the
55861+ privilege of the file being linked to
55862+*/
55863+__u32
55864+gr_acl_handle_link(const struct dentry * new_dentry,
55865+ const struct dentry * parent_dentry,
55866+ const struct vfsmount * parent_mnt,
55867+ const struct dentry * old_dentry,
55868+ const struct vfsmount * old_mnt, const char *to)
55869+{
55870+ __u32 mode;
55871+ __u32 needmode = GR_CREATE | GR_LINK;
55872+ __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
55873+
55874+ mode =
55875+ gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
55876+ old_mnt);
55877+
55878+ if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
55879+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55880+ return mode;
55881+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55882+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55883+ return 0;
55884+ } else if (unlikely((mode & needmode) != needmode))
55885+ return 0;
55886+
55887+ return 1;
55888+}
55889+
55890+__u32
55891+gr_acl_handle_symlink(const struct dentry * new_dentry,
55892+ const struct dentry * parent_dentry,
55893+ const struct vfsmount * parent_mnt, const char *from)
55894+{
55895+ __u32 needmode = GR_WRITE | GR_CREATE;
55896+ __u32 mode;
55897+
55898+ mode =
55899+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
55900+ GR_CREATE | GR_AUDIT_CREATE |
55901+ GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
55902+
55903+ if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
55904+ gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55905+ return mode;
55906+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55907+ gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55908+ return 0;
55909+ } else if (unlikely((mode & needmode) != needmode))
55910+ return 0;
55911+
55912+ return (GR_WRITE | GR_CREATE);
55913+}
55914+
55915+static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
55916+{
55917+ __u32 mode;
55918+
55919+ mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55920+
55921+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55922+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
55923+ return mode;
55924+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55925+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
55926+ return 0;
55927+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
55928+ return 0;
55929+
55930+ return (reqmode);
55931+}
55932+
55933+__u32
55934+gr_acl_handle_mknod(const struct dentry * new_dentry,
55935+ const struct dentry * parent_dentry,
55936+ const struct vfsmount * parent_mnt,
55937+ const int mode)
55938+{
55939+ __u32 reqmode = GR_WRITE | GR_CREATE;
55940+ if (unlikely(mode & (S_ISUID | S_ISGID)))
55941+ reqmode |= GR_SETID;
55942+
55943+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
55944+ reqmode, GR_MKNOD_ACL_MSG);
55945+}
55946+
55947+__u32
55948+gr_acl_handle_mkdir(const struct dentry *new_dentry,
55949+ const struct dentry *parent_dentry,
55950+ const struct vfsmount *parent_mnt)
55951+{
55952+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
55953+ GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
55954+}
55955+
55956+#define RENAME_CHECK_SUCCESS(old, new) \
55957+ (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
55958+ ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
55959+
55960+int
55961+gr_acl_handle_rename(struct dentry *new_dentry,
55962+ struct dentry *parent_dentry,
55963+ const struct vfsmount *parent_mnt,
55964+ struct dentry *old_dentry,
55965+ struct inode *old_parent_inode,
55966+ struct vfsmount *old_mnt, const char *newname)
55967+{
55968+ __u32 comp1, comp2;
55969+ int error = 0;
55970+
55971+ if (unlikely(!gr_acl_is_enabled()))
55972+ return 0;
55973+
55974+ if (!new_dentry->d_inode) {
55975+ comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
55976+ GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
55977+ GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
55978+ comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
55979+ GR_DELETE | GR_AUDIT_DELETE |
55980+ GR_AUDIT_READ | GR_AUDIT_WRITE |
55981+ GR_SUPPRESS, old_mnt);
55982+ } else {
55983+ comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
55984+ GR_CREATE | GR_DELETE |
55985+ GR_AUDIT_CREATE | GR_AUDIT_DELETE |
55986+ GR_AUDIT_READ | GR_AUDIT_WRITE |
55987+ GR_SUPPRESS, parent_mnt);
55988+ comp2 =
55989+ gr_search_file(old_dentry,
55990+ GR_READ | GR_WRITE | GR_AUDIT_READ |
55991+ GR_DELETE | GR_AUDIT_DELETE |
55992+ GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
55993+ }
55994+
55995+ if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
55996+ ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
55997+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
55998+ else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
55999+ && !(comp2 & GR_SUPPRESS)) {
56000+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
56001+ error = -EACCES;
56002+ } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
56003+ error = -EACCES;
56004+
56005+ return error;
56006+}
56007+
56008+void
56009+gr_acl_handle_exit(void)
56010+{
56011+ u16 id;
56012+ char *rolename;
56013+ struct file *exec_file;
56014+
56015+ if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
56016+ !(current->role->roletype & GR_ROLE_PERSIST))) {
56017+ id = current->acl_role_id;
56018+ rolename = current->role->rolename;
56019+ gr_set_acls(1);
56020+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
56021+ }
56022+
56023+ write_lock(&grsec_exec_file_lock);
56024+ exec_file = current->exec_file;
56025+ current->exec_file = NULL;
56026+ write_unlock(&grsec_exec_file_lock);
56027+
56028+ if (exec_file)
56029+ fput(exec_file);
56030+}
56031+
56032+int
56033+gr_acl_handle_procpidmem(const struct task_struct *task)
56034+{
56035+ if (unlikely(!gr_acl_is_enabled()))
56036+ return 0;
56037+
56038+ if (task != current && task->acl->mode & GR_PROTPROCFD)
56039+ return -EACCES;
56040+
56041+ return 0;
56042+}
56043diff -urNp linux-2.6.39.1/grsecurity/gracl_ip.c linux-2.6.39.1/grsecurity/gracl_ip.c
56044--- linux-2.6.39.1/grsecurity/gracl_ip.c 1969-12-31 19:00:00.000000000 -0500
56045+++ linux-2.6.39.1/grsecurity/gracl_ip.c 2011-05-22 22:47:31.000000000 -0400
56046@@ -0,0 +1,381 @@
56047+#include <linux/kernel.h>
56048+#include <asm/uaccess.h>
56049+#include <asm/errno.h>
56050+#include <net/sock.h>
56051+#include <linux/file.h>
56052+#include <linux/fs.h>
56053+#include <linux/net.h>
56054+#include <linux/in.h>
56055+#include <linux/skbuff.h>
56056+#include <linux/ip.h>
56057+#include <linux/udp.h>
56058+#include <linux/types.h>
56059+#include <linux/sched.h>
56060+#include <linux/netdevice.h>
56061+#include <linux/inetdevice.h>
56062+#include <linux/gracl.h>
56063+#include <linux/grsecurity.h>
56064+#include <linux/grinternal.h>
56065+
56066+#define GR_BIND 0x01
56067+#define GR_CONNECT 0x02
56068+#define GR_INVERT 0x04
56069+#define GR_BINDOVERRIDE 0x08
56070+#define GR_CONNECTOVERRIDE 0x10
56071+#define GR_SOCK_FAMILY 0x20
56072+
56073+static const char * gr_protocols[IPPROTO_MAX] = {
56074+ "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
56075+ "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
56076+ "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
56077+ "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
56078+ "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
56079+ "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
56080+ "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
56081+ "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
56082+ "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
56083+ "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
56084+ "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
56085+ "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
56086+ "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
56087+ "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
56088+ "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
56089+ "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
56090+ "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
56091+ "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
56092+ "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
56093+ "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
56094+ "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
56095+ "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
56096+ "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
56097+ "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
56098+ "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
56099+ "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
56100+ "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
56101+ "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
56102+ "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
56103+ "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
56104+ "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
56105+ "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
56106+ };
56107+
56108+static const char * gr_socktypes[SOCK_MAX] = {
56109+ "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
56110+ "unknown:7", "unknown:8", "unknown:9", "packet"
56111+ };
56112+
56113+static const char * gr_sockfamilies[AF_MAX+1] = {
56114+ "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
56115+ "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
56116+ "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
56117+ "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154", "ciaf"
56118+ };
56119+
56120+const char *
56121+gr_proto_to_name(unsigned char proto)
56122+{
56123+ return gr_protocols[proto];
56124+}
56125+
56126+const char *
56127+gr_socktype_to_name(unsigned char type)
56128+{
56129+ return gr_socktypes[type];
56130+}
56131+
56132+const char *
56133+gr_sockfamily_to_name(unsigned char family)
56134+{
56135+ return gr_sockfamilies[family];
56136+}
56137+
56138+int
56139+gr_search_socket(const int domain, const int type, const int protocol)
56140+{
56141+ struct acl_subject_label *curr;
56142+ const struct cred *cred = current_cred();
56143+
56144+ if (unlikely(!gr_acl_is_enabled()))
56145+ goto exit;
56146+
56147+ if ((domain < 0) || (type < 0) || (protocol < 0) ||
56148+ (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
56149+ goto exit; // let the kernel handle it
56150+
56151+ curr = current->acl;
56152+
56153+ if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
56154+ /* the family is allowed, if this is PF_INET allow it only if
56155+ the extra sock type/protocol checks pass */
56156+ if (domain == PF_INET)
56157+ goto inet_check;
56158+ goto exit;
56159+ } else {
56160+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56161+ __u32 fakeip = 0;
56162+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56163+ current->role->roletype, cred->uid,
56164+ cred->gid, current->exec_file ?
56165+ gr_to_filename(current->exec_file->f_path.dentry,
56166+ current->exec_file->f_path.mnt) :
56167+ curr->filename, curr->filename,
56168+ &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
56169+ &current->signal->saved_ip);
56170+ goto exit;
56171+ }
56172+ goto exit_fail;
56173+ }
56174+
56175+inet_check:
56176+ /* the rest of this checking is for IPv4 only */
56177+ if (!curr->ips)
56178+ goto exit;
56179+
56180+ if ((curr->ip_type & (1 << type)) &&
56181+ (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
56182+ goto exit;
56183+
56184+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56185+ /* we don't place acls on raw sockets , and sometimes
56186+ dgram/ip sockets are opened for ioctl and not
56187+ bind/connect, so we'll fake a bind learn log */
56188+ if (type == SOCK_RAW || type == SOCK_PACKET) {
56189+ __u32 fakeip = 0;
56190+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56191+ current->role->roletype, cred->uid,
56192+ cred->gid, current->exec_file ?
56193+ gr_to_filename(current->exec_file->f_path.dentry,
56194+ current->exec_file->f_path.mnt) :
56195+ curr->filename, curr->filename,
56196+ &fakeip, 0, type,
56197+ protocol, GR_CONNECT, &current->signal->saved_ip);
56198+ } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
56199+ __u32 fakeip = 0;
56200+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56201+ current->role->roletype, cred->uid,
56202+ cred->gid, current->exec_file ?
56203+ gr_to_filename(current->exec_file->f_path.dentry,
56204+ current->exec_file->f_path.mnt) :
56205+ curr->filename, curr->filename,
56206+ &fakeip, 0, type,
56207+ protocol, GR_BIND, &current->signal->saved_ip);
56208+ }
56209+ /* we'll log when they use connect or bind */
56210+ goto exit;
56211+ }
56212+
56213+exit_fail:
56214+ if (domain == PF_INET)
56215+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
56216+ gr_socktype_to_name(type), gr_proto_to_name(protocol));
56217+ else
56218+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
56219+ gr_socktype_to_name(type), protocol);
56220+
56221+ return 0;
56222+exit:
56223+ return 1;
56224+}
56225+
56226+int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
56227+{
56228+ if ((ip->mode & mode) &&
56229+ (ip_port >= ip->low) &&
56230+ (ip_port <= ip->high) &&
56231+ ((ntohl(ip_addr) & our_netmask) ==
56232+ (ntohl(our_addr) & our_netmask))
56233+ && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
56234+ && (ip->type & (1 << type))) {
56235+ if (ip->mode & GR_INVERT)
56236+ return 2; // specifically denied
56237+ else
56238+ return 1; // allowed
56239+ }
56240+
56241+ return 0; // not specifically allowed, may continue parsing
56242+}
56243+
56244+static int
56245+gr_search_connectbind(const int full_mode, struct sock *sk,
56246+ struct sockaddr_in *addr, const int type)
56247+{
56248+ char iface[IFNAMSIZ] = {0};
56249+ struct acl_subject_label *curr;
56250+ struct acl_ip_label *ip;
56251+ struct inet_sock *isk;
56252+ struct net_device *dev;
56253+ struct in_device *idev;
56254+ unsigned long i;
56255+ int ret;
56256+ int mode = full_mode & (GR_BIND | GR_CONNECT);
56257+ __u32 ip_addr = 0;
56258+ __u32 our_addr;
56259+ __u32 our_netmask;
56260+ char *p;
56261+ __u16 ip_port = 0;
56262+ const struct cred *cred = current_cred();
56263+
56264+ if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
56265+ return 0;
56266+
56267+ curr = current->acl;
56268+ isk = inet_sk(sk);
56269+
56270+ /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
56271+ if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
56272+ addr->sin_addr.s_addr = curr->inaddr_any_override;
56273+ if ((full_mode & GR_CONNECT) && isk->inet_saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
56274+ struct sockaddr_in saddr;
56275+ int err;
56276+
56277+ saddr.sin_family = AF_INET;
56278+ saddr.sin_addr.s_addr = curr->inaddr_any_override;
56279+ saddr.sin_port = isk->inet_sport;
56280+
56281+ err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
56282+ if (err)
56283+ return err;
56284+
56285+ err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
56286+ if (err)
56287+ return err;
56288+ }
56289+
56290+ if (!curr->ips)
56291+ return 0;
56292+
56293+ ip_addr = addr->sin_addr.s_addr;
56294+ ip_port = ntohs(addr->sin_port);
56295+
56296+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56297+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56298+ current->role->roletype, cred->uid,
56299+ cred->gid, current->exec_file ?
56300+ gr_to_filename(current->exec_file->f_path.dentry,
56301+ current->exec_file->f_path.mnt) :
56302+ curr->filename, curr->filename,
56303+ &ip_addr, ip_port, type,
56304+ sk->sk_protocol, mode, &current->signal->saved_ip);
56305+ return 0;
56306+ }
56307+
56308+ for (i = 0; i < curr->ip_num; i++) {
56309+ ip = *(curr->ips + i);
56310+ if (ip->iface != NULL) {
56311+ strncpy(iface, ip->iface, IFNAMSIZ - 1);
56312+ p = strchr(iface, ':');
56313+ if (p != NULL)
56314+ *p = '\0';
56315+ dev = dev_get_by_name(sock_net(sk), iface);
56316+ if (dev == NULL)
56317+ continue;
56318+ idev = in_dev_get(dev);
56319+ if (idev == NULL) {
56320+ dev_put(dev);
56321+ continue;
56322+ }
56323+ rcu_read_lock();
56324+ for_ifa(idev) {
56325+ if (!strcmp(ip->iface, ifa->ifa_label)) {
56326+ our_addr = ifa->ifa_address;
56327+ our_netmask = 0xffffffff;
56328+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
56329+ if (ret == 1) {
56330+ rcu_read_unlock();
56331+ in_dev_put(idev);
56332+ dev_put(dev);
56333+ return 0;
56334+ } else if (ret == 2) {
56335+ rcu_read_unlock();
56336+ in_dev_put(idev);
56337+ dev_put(dev);
56338+ goto denied;
56339+ }
56340+ }
56341+ } endfor_ifa(idev);
56342+ rcu_read_unlock();
56343+ in_dev_put(idev);
56344+ dev_put(dev);
56345+ } else {
56346+ our_addr = ip->addr;
56347+ our_netmask = ip->netmask;
56348+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
56349+ if (ret == 1)
56350+ return 0;
56351+ else if (ret == 2)
56352+ goto denied;
56353+ }
56354+ }
56355+
56356+denied:
56357+ if (mode == GR_BIND)
56358+ gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
56359+ else if (mode == GR_CONNECT)
56360+ gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
56361+
56362+ return -EACCES;
56363+}
56364+
56365+int
56366+gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
56367+{
56368+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
56369+}
56370+
56371+int
56372+gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
56373+{
56374+ return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
56375+}
56376+
56377+int gr_search_listen(struct socket *sock)
56378+{
56379+ struct sock *sk = sock->sk;
56380+ struct sockaddr_in addr;
56381+
56382+ addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
56383+ addr.sin_port = inet_sk(sk)->inet_sport;
56384+
56385+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
56386+}
56387+
56388+int gr_search_accept(struct socket *sock)
56389+{
56390+ struct sock *sk = sock->sk;
56391+ struct sockaddr_in addr;
56392+
56393+ addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
56394+ addr.sin_port = inet_sk(sk)->inet_sport;
56395+
56396+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
56397+}
56398+
56399+int
56400+gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
56401+{
56402+ if (addr)
56403+ return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
56404+ else {
56405+ struct sockaddr_in sin;
56406+ const struct inet_sock *inet = inet_sk(sk);
56407+
56408+ sin.sin_addr.s_addr = inet->inet_daddr;
56409+ sin.sin_port = inet->inet_dport;
56410+
56411+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
56412+ }
56413+}
56414+
56415+int
56416+gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
56417+{
56418+ struct sockaddr_in sin;
56419+
56420+ if (unlikely(skb->len < sizeof (struct udphdr)))
56421+ return 0; // skip this packet
56422+
56423+ sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
56424+ sin.sin_port = udp_hdr(skb)->source;
56425+
56426+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
56427+}
56428diff -urNp linux-2.6.39.1/grsecurity/gracl_learn.c linux-2.6.39.1/grsecurity/gracl_learn.c
56429--- linux-2.6.39.1/grsecurity/gracl_learn.c 1969-12-31 19:00:00.000000000 -0500
56430+++ linux-2.6.39.1/grsecurity/gracl_learn.c 2011-05-22 22:47:45.000000000 -0400
56431@@ -0,0 +1,210 @@
56432+#include <linux/kernel.h>
56433+#include <linux/mm.h>
56434+#include <linux/sched.h>
56435+#include <linux/poll.h>
56436+#include <linux/string.h>
56437+#include <linux/file.h>
56438+#include <linux/types.h>
56439+#include <linux/vmalloc.h>
56440+#include <linux/grinternal.h>
56441+
56442+extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
56443+ size_t count, loff_t *ppos);
56444+extern int gr_acl_is_enabled(void);
56445+
56446+static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
56447+static int gr_learn_attached;
56448+
56449+/* use a 512k buffer */
56450+#define LEARN_BUFFER_SIZE (512 * 1024)
56451+
56452+static DEFINE_SPINLOCK(gr_learn_lock);
56453+static DEFINE_MUTEX(gr_learn_user_mutex);
56454+
56455+/* we need to maintain two buffers, so that the kernel context of grlearn
56456+ uses a semaphore around the userspace copying, and the other kernel contexts
56457+ use a spinlock when copying into the buffer, since they cannot sleep
56458+*/
56459+static char *learn_buffer;
56460+static char *learn_buffer_user;
56461+static int learn_buffer_len;
56462+static int learn_buffer_user_len;
56463+
56464+static ssize_t
56465+read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
56466+{
56467+ DECLARE_WAITQUEUE(wait, current);
56468+ ssize_t retval = 0;
56469+
56470+ add_wait_queue(&learn_wait, &wait);
56471+ set_current_state(TASK_INTERRUPTIBLE);
56472+ do {
56473+ mutex_lock(&gr_learn_user_mutex);
56474+ spin_lock(&gr_learn_lock);
56475+ if (learn_buffer_len)
56476+ break;
56477+ spin_unlock(&gr_learn_lock);
56478+ mutex_unlock(&gr_learn_user_mutex);
56479+ if (file->f_flags & O_NONBLOCK) {
56480+ retval = -EAGAIN;
56481+ goto out;
56482+ }
56483+ if (signal_pending(current)) {
56484+ retval = -ERESTARTSYS;
56485+ goto out;
56486+ }
56487+
56488+ schedule();
56489+ } while (1);
56490+
56491+ memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
56492+ learn_buffer_user_len = learn_buffer_len;
56493+ retval = learn_buffer_len;
56494+ learn_buffer_len = 0;
56495+
56496+ spin_unlock(&gr_learn_lock);
56497+
56498+ if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
56499+ retval = -EFAULT;
56500+
56501+ mutex_unlock(&gr_learn_user_mutex);
56502+out:
56503+ set_current_state(TASK_RUNNING);
56504+ remove_wait_queue(&learn_wait, &wait);
56505+ return retval;
56506+}
56507+
56508+static unsigned int
56509+poll_learn(struct file * file, poll_table * wait)
56510+{
56511+ poll_wait(file, &learn_wait, wait);
56512+
56513+ if (learn_buffer_len)
56514+ return (POLLIN | POLLRDNORM);
56515+
56516+ return 0;
56517+}
56518+
56519+void
56520+gr_clear_learn_entries(void)
56521+{
56522+ char *tmp;
56523+
56524+ mutex_lock(&gr_learn_user_mutex);
56525+ if (learn_buffer != NULL) {
56526+ spin_lock(&gr_learn_lock);
56527+ tmp = learn_buffer;
56528+ learn_buffer = NULL;
56529+ spin_unlock(&gr_learn_lock);
56530+ vfree(learn_buffer);
56531+ }
56532+ if (learn_buffer_user != NULL) {
56533+ vfree(learn_buffer_user);
56534+ learn_buffer_user = NULL;
56535+ }
56536+ learn_buffer_len = 0;
56537+ mutex_unlock(&gr_learn_user_mutex);
56538+
56539+ return;
56540+}
56541+
56542+void
56543+gr_add_learn_entry(const char *fmt, ...)
56544+{
56545+ va_list args;
56546+ unsigned int len;
56547+
56548+ if (!gr_learn_attached)
56549+ return;
56550+
56551+ spin_lock(&gr_learn_lock);
56552+
56553+ /* leave a gap at the end so we know when it's "full" but don't have to
56554+ compute the exact length of the string we're trying to append
56555+ */
56556+ if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
56557+ spin_unlock(&gr_learn_lock);
56558+ wake_up_interruptible(&learn_wait);
56559+ return;
56560+ }
56561+ if (learn_buffer == NULL) {
56562+ spin_unlock(&gr_learn_lock);
56563+ return;
56564+ }
56565+
56566+ va_start(args, fmt);
56567+ len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
56568+ va_end(args);
56569+
56570+ learn_buffer_len += len + 1;
56571+
56572+ spin_unlock(&gr_learn_lock);
56573+ wake_up_interruptible(&learn_wait);
56574+
56575+ return;
56576+}
56577+
56578+static int
56579+open_learn(struct inode *inode, struct file *file)
56580+{
56581+ if (file->f_mode & FMODE_READ && gr_learn_attached)
56582+ return -EBUSY;
56583+ if (file->f_mode & FMODE_READ) {
56584+ int retval = 0;
56585+ mutex_lock(&gr_learn_user_mutex);
56586+ if (learn_buffer == NULL)
56587+ learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
56588+ if (learn_buffer_user == NULL)
56589+ learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
56590+ if (learn_buffer == NULL) {
56591+ retval = -ENOMEM;
56592+ goto out_error;
56593+ }
56594+ if (learn_buffer_user == NULL) {
56595+ retval = -ENOMEM;
56596+ goto out_error;
56597+ }
56598+ learn_buffer_len = 0;
56599+ learn_buffer_user_len = 0;
56600+ gr_learn_attached = 1;
56601+out_error:
56602+ mutex_unlock(&gr_learn_user_mutex);
56603+ return retval;
56604+ }
56605+ return 0;
56606+}
56607+
56608+static int
56609+close_learn(struct inode *inode, struct file *file)
56610+{
56611+ char *tmp;
56612+
56613+ if (file->f_mode & FMODE_READ) {
56614+ mutex_lock(&gr_learn_user_mutex);
56615+ if (learn_buffer != NULL) {
56616+ spin_lock(&gr_learn_lock);
56617+ tmp = learn_buffer;
56618+ learn_buffer = NULL;
56619+ spin_unlock(&gr_learn_lock);
56620+ vfree(tmp);
56621+ }
56622+ if (learn_buffer_user != NULL) {
56623+ vfree(learn_buffer_user);
56624+ learn_buffer_user = NULL;
56625+ }
56626+ learn_buffer_len = 0;
56627+ learn_buffer_user_len = 0;
56628+ gr_learn_attached = 0;
56629+ mutex_unlock(&gr_learn_user_mutex);
56630+ }
56631+
56632+ return 0;
56633+}
56634+
56635+const struct file_operations grsec_fops = {
56636+ .read = read_learn,
56637+ .write = write_grsec_handler,
56638+ .open = open_learn,
56639+ .release = close_learn,
56640+ .poll = poll_learn,
56641+};
56642diff -urNp linux-2.6.39.1/grsecurity/gracl_res.c linux-2.6.39.1/grsecurity/gracl_res.c
56643--- linux-2.6.39.1/grsecurity/gracl_res.c 1969-12-31 19:00:00.000000000 -0500
56644+++ linux-2.6.39.1/grsecurity/gracl_res.c 2011-05-22 19:41:42.000000000 -0400
56645@@ -0,0 +1,68 @@
56646+#include <linux/kernel.h>
56647+#include <linux/sched.h>
56648+#include <linux/gracl.h>
56649+#include <linux/grinternal.h>
56650+
56651+static const char *restab_log[] = {
56652+ [RLIMIT_CPU] = "RLIMIT_CPU",
56653+ [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
56654+ [RLIMIT_DATA] = "RLIMIT_DATA",
56655+ [RLIMIT_STACK] = "RLIMIT_STACK",
56656+ [RLIMIT_CORE] = "RLIMIT_CORE",
56657+ [RLIMIT_RSS] = "RLIMIT_RSS",
56658+ [RLIMIT_NPROC] = "RLIMIT_NPROC",
56659+ [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
56660+ [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
56661+ [RLIMIT_AS] = "RLIMIT_AS",
56662+ [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
56663+ [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
56664+ [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
56665+ [RLIMIT_NICE] = "RLIMIT_NICE",
56666+ [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
56667+ [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
56668+ [GR_CRASH_RES] = "RLIMIT_CRASH"
56669+};
56670+
56671+void
56672+gr_log_resource(const struct task_struct *task,
56673+ const int res, const unsigned long wanted, const int gt)
56674+{
56675+ const struct cred *cred;
56676+ unsigned long rlim;
56677+
56678+ if (!gr_acl_is_enabled() && !grsec_resource_logging)
56679+ return;
56680+
56681+ // not yet supported resource
56682+ if (unlikely(!restab_log[res]))
56683+ return;
56684+
56685+ if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
56686+ rlim = task_rlimit_max(task, res);
56687+ else
56688+ rlim = task_rlimit(task, res);
56689+
56690+ if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
56691+ return;
56692+
56693+ rcu_read_lock();
56694+ cred = __task_cred(task);
56695+
56696+ if (res == RLIMIT_NPROC &&
56697+ (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
56698+ cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
56699+ goto out_rcu_unlock;
56700+ else if (res == RLIMIT_MEMLOCK &&
56701+ cap_raised(cred->cap_effective, CAP_IPC_LOCK))
56702+ goto out_rcu_unlock;
56703+ else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
56704+ goto out_rcu_unlock;
56705+ rcu_read_unlock();
56706+
56707+ gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
56708+
56709+ return;
56710+out_rcu_unlock:
56711+ rcu_read_unlock();
56712+ return;
56713+}
56714diff -urNp linux-2.6.39.1/grsecurity/gracl_segv.c linux-2.6.39.1/grsecurity/gracl_segv.c
56715--- linux-2.6.39.1/grsecurity/gracl_segv.c 1969-12-31 19:00:00.000000000 -0500
56716+++ linux-2.6.39.1/grsecurity/gracl_segv.c 2011-05-22 22:47:39.000000000 -0400
56717@@ -0,0 +1,299 @@
56718+#include <linux/kernel.h>
56719+#include <linux/mm.h>
56720+#include <asm/uaccess.h>
56721+#include <asm/errno.h>
56722+#include <asm/mman.h>
56723+#include <net/sock.h>
56724+#include <linux/file.h>
56725+#include <linux/fs.h>
56726+#include <linux/net.h>
56727+#include <linux/in.h>
56728+#include <linux/slab.h>
56729+#include <linux/types.h>
56730+#include <linux/sched.h>
56731+#include <linux/timer.h>
56732+#include <linux/gracl.h>
56733+#include <linux/grsecurity.h>
56734+#include <linux/grinternal.h>
56735+
56736+static struct crash_uid *uid_set;
56737+static unsigned short uid_used;
56738+static DEFINE_SPINLOCK(gr_uid_lock);
56739+extern rwlock_t gr_inode_lock;
56740+extern struct acl_subject_label *
56741+ lookup_acl_subj_label(const ino_t inode, const dev_t dev,
56742+ struct acl_role_label *role);
56743+
56744+#ifdef CONFIG_BTRFS_FS
56745+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
56746+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
56747+#endif
56748+
56749+static inline dev_t __get_dev(const struct dentry *dentry)
56750+{
56751+#ifdef CONFIG_BTRFS_FS
56752+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
56753+ return get_btrfs_dev_from_inode(dentry->d_inode);
56754+ else
56755+#endif
56756+ return dentry->d_inode->i_sb->s_dev;
56757+}
56758+
56759+int
56760+gr_init_uidset(void)
56761+{
56762+ uid_set =
56763+ kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
56764+ uid_used = 0;
56765+
56766+ return uid_set ? 1 : 0;
56767+}
56768+
56769+void
56770+gr_free_uidset(void)
56771+{
56772+ if (uid_set)
56773+ kfree(uid_set);
56774+
56775+ return;
56776+}
56777+
56778+int
56779+gr_find_uid(const uid_t uid)
56780+{
56781+ struct crash_uid *tmp = uid_set;
56782+ uid_t buid;
56783+ int low = 0, high = uid_used - 1, mid;
56784+
56785+ while (high >= low) {
56786+ mid = (low + high) >> 1;
56787+ buid = tmp[mid].uid;
56788+ if (buid == uid)
56789+ return mid;
56790+ if (buid > uid)
56791+ high = mid - 1;
56792+ if (buid < uid)
56793+ low = mid + 1;
56794+ }
56795+
56796+ return -1;
56797+}
56798+
56799+static __inline__ void
56800+gr_insertsort(void)
56801+{
56802+ unsigned short i, j;
56803+ struct crash_uid index;
56804+
56805+ for (i = 1; i < uid_used; i++) {
56806+ index = uid_set[i];
56807+ j = i;
56808+ while ((j > 0) && uid_set[j - 1].uid > index.uid) {
56809+ uid_set[j] = uid_set[j - 1];
56810+ j--;
56811+ }
56812+ uid_set[j] = index;
56813+ }
56814+
56815+ return;
56816+}
56817+
56818+static __inline__ void
56819+gr_insert_uid(const uid_t uid, const unsigned long expires)
56820+{
56821+ int loc;
56822+
56823+ if (uid_used == GR_UIDTABLE_MAX)
56824+ return;
56825+
56826+ loc = gr_find_uid(uid);
56827+
56828+ if (loc >= 0) {
56829+ uid_set[loc].expires = expires;
56830+ return;
56831+ }
56832+
56833+ uid_set[uid_used].uid = uid;
56834+ uid_set[uid_used].expires = expires;
56835+ uid_used++;
56836+
56837+ gr_insertsort();
56838+
56839+ return;
56840+}
56841+
56842+void
56843+gr_remove_uid(const unsigned short loc)
56844+{
56845+ unsigned short i;
56846+
56847+ for (i = loc + 1; i < uid_used; i++)
56848+ uid_set[i - 1] = uid_set[i];
56849+
56850+ uid_used--;
56851+
56852+ return;
56853+}
56854+
56855+int
56856+gr_check_crash_uid(const uid_t uid)
56857+{
56858+ int loc;
56859+ int ret = 0;
56860+
56861+ if (unlikely(!gr_acl_is_enabled()))
56862+ return 0;
56863+
56864+ spin_lock(&gr_uid_lock);
56865+ loc = gr_find_uid(uid);
56866+
56867+ if (loc < 0)
56868+ goto out_unlock;
56869+
56870+ if (time_before_eq(uid_set[loc].expires, get_seconds()))
56871+ gr_remove_uid(loc);
56872+ else
56873+ ret = 1;
56874+
56875+out_unlock:
56876+ spin_unlock(&gr_uid_lock);
56877+ return ret;
56878+}
56879+
56880+static __inline__ int
56881+proc_is_setxid(const struct cred *cred)
56882+{
56883+ if (cred->uid != cred->euid || cred->uid != cred->suid ||
56884+ cred->uid != cred->fsuid)
56885+ return 1;
56886+ if (cred->gid != cred->egid || cred->gid != cred->sgid ||
56887+ cred->gid != cred->fsgid)
56888+ return 1;
56889+
56890+ return 0;
56891+}
56892+
56893+extern int gr_fake_force_sig(int sig, struct task_struct *t);
56894+
56895+void
56896+gr_handle_crash(struct task_struct *task, const int sig)
56897+{
56898+ struct acl_subject_label *curr;
56899+ struct acl_subject_label *curr2;
56900+ struct task_struct *tsk, *tsk2;
56901+ const struct cred *cred;
56902+ const struct cred *cred2;
56903+
56904+ if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
56905+ return;
56906+
56907+ if (unlikely(!gr_acl_is_enabled()))
56908+ return;
56909+
56910+ curr = task->acl;
56911+
56912+ if (!(curr->resmask & (1 << GR_CRASH_RES)))
56913+ return;
56914+
56915+ if (time_before_eq(curr->expires, get_seconds())) {
56916+ curr->expires = 0;
56917+ curr->crashes = 0;
56918+ }
56919+
56920+ curr->crashes++;
56921+
56922+ if (!curr->expires)
56923+ curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
56924+
56925+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
56926+ time_after(curr->expires, get_seconds())) {
56927+ rcu_read_lock();
56928+ cred = __task_cred(task);
56929+ if (cred->uid && proc_is_setxid(cred)) {
56930+ gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
56931+ spin_lock(&gr_uid_lock);
56932+ gr_insert_uid(cred->uid, curr->expires);
56933+ spin_unlock(&gr_uid_lock);
56934+ curr->expires = 0;
56935+ curr->crashes = 0;
56936+ read_lock(&tasklist_lock);
56937+ do_each_thread(tsk2, tsk) {
56938+ cred2 = __task_cred(tsk);
56939+ if (tsk != task && cred2->uid == cred->uid)
56940+ gr_fake_force_sig(SIGKILL, tsk);
56941+ } while_each_thread(tsk2, tsk);
56942+ read_unlock(&tasklist_lock);
56943+ } else {
56944+ gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
56945+ read_lock(&tasklist_lock);
56946+ do_each_thread(tsk2, tsk) {
56947+ if (likely(tsk != task)) {
56948+ curr2 = tsk->acl;
56949+
56950+ if (curr2->device == curr->device &&
56951+ curr2->inode == curr->inode)
56952+ gr_fake_force_sig(SIGKILL, tsk);
56953+ }
56954+ } while_each_thread(tsk2, tsk);
56955+ read_unlock(&tasklist_lock);
56956+ }
56957+ rcu_read_unlock();
56958+ }
56959+
56960+ return;
56961+}
56962+
56963+int
56964+gr_check_crash_exec(const struct file *filp)
56965+{
56966+ struct acl_subject_label *curr;
56967+
56968+ if (unlikely(!gr_acl_is_enabled()))
56969+ return 0;
56970+
56971+ read_lock(&gr_inode_lock);
56972+ curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
56973+ __get_dev(filp->f_path.dentry),
56974+ current->role);
56975+ read_unlock(&gr_inode_lock);
56976+
56977+ if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
56978+ (!curr->crashes && !curr->expires))
56979+ return 0;
56980+
56981+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
56982+ time_after(curr->expires, get_seconds()))
56983+ return 1;
56984+ else if (time_before_eq(curr->expires, get_seconds())) {
56985+ curr->crashes = 0;
56986+ curr->expires = 0;
56987+ }
56988+
56989+ return 0;
56990+}
56991+
56992+void
56993+gr_handle_alertkill(struct task_struct *task)
56994+{
56995+ struct acl_subject_label *curracl;
56996+ __u32 curr_ip;
56997+ struct task_struct *p, *p2;
56998+
56999+ if (unlikely(!gr_acl_is_enabled()))
57000+ return;
57001+
57002+ curracl = task->acl;
57003+ curr_ip = task->signal->curr_ip;
57004+
57005+ if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
57006+ read_lock(&tasklist_lock);
57007+ do_each_thread(p2, p) {
57008+ if (p->signal->curr_ip == curr_ip)
57009+ gr_fake_force_sig(SIGKILL, p);
57010+ } while_each_thread(p2, p);
57011+ read_unlock(&tasklist_lock);
57012+ } else if (curracl->mode & GR_KILLPROC)
57013+ gr_fake_force_sig(SIGKILL, task);
57014+
57015+ return;
57016+}
57017diff -urNp linux-2.6.39.1/grsecurity/gracl_shm.c linux-2.6.39.1/grsecurity/gracl_shm.c
57018--- linux-2.6.39.1/grsecurity/gracl_shm.c 1969-12-31 19:00:00.000000000 -0500
57019+++ linux-2.6.39.1/grsecurity/gracl_shm.c 2011-05-22 19:41:42.000000000 -0400
57020@@ -0,0 +1,40 @@
57021+#include <linux/kernel.h>
57022+#include <linux/mm.h>
57023+#include <linux/sched.h>
57024+#include <linux/file.h>
57025+#include <linux/ipc.h>
57026+#include <linux/gracl.h>
57027+#include <linux/grsecurity.h>
57028+#include <linux/grinternal.h>
57029+
57030+int
57031+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57032+ const time_t shm_createtime, const uid_t cuid, const int shmid)
57033+{
57034+ struct task_struct *task;
57035+
57036+ if (!gr_acl_is_enabled())
57037+ return 1;
57038+
57039+ rcu_read_lock();
57040+ read_lock(&tasklist_lock);
57041+
57042+ task = find_task_by_vpid(shm_cprid);
57043+
57044+ if (unlikely(!task))
57045+ task = find_task_by_vpid(shm_lapid);
57046+
57047+ if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
57048+ (task->pid == shm_lapid)) &&
57049+ (task->acl->mode & GR_PROTSHM) &&
57050+ (task->acl != current->acl))) {
57051+ read_unlock(&tasklist_lock);
57052+ rcu_read_unlock();
57053+ gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
57054+ return 0;
57055+ }
57056+ read_unlock(&tasklist_lock);
57057+ rcu_read_unlock();
57058+
57059+ return 1;
57060+}
57061diff -urNp linux-2.6.39.1/grsecurity/grsec_chdir.c linux-2.6.39.1/grsecurity/grsec_chdir.c
57062--- linux-2.6.39.1/grsecurity/grsec_chdir.c 1969-12-31 19:00:00.000000000 -0500
57063+++ linux-2.6.39.1/grsecurity/grsec_chdir.c 2011-05-22 19:41:42.000000000 -0400
57064@@ -0,0 +1,19 @@
57065+#include <linux/kernel.h>
57066+#include <linux/sched.h>
57067+#include <linux/fs.h>
57068+#include <linux/file.h>
57069+#include <linux/grsecurity.h>
57070+#include <linux/grinternal.h>
57071+
57072+void
57073+gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
57074+{
57075+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
57076+ if ((grsec_enable_chdir && grsec_enable_group &&
57077+ in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
57078+ !grsec_enable_group)) {
57079+ gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
57080+ }
57081+#endif
57082+ return;
57083+}
57084diff -urNp linux-2.6.39.1/grsecurity/grsec_chroot.c linux-2.6.39.1/grsecurity/grsec_chroot.c
57085--- linux-2.6.39.1/grsecurity/grsec_chroot.c 1969-12-31 19:00:00.000000000 -0500
57086+++ linux-2.6.39.1/grsecurity/grsec_chroot.c 2011-05-22 19:41:42.000000000 -0400
57087@@ -0,0 +1,355 @@
57088+#include <linux/kernel.h>
57089+#include <linux/module.h>
57090+#include <linux/sched.h>
57091+#include <linux/file.h>
57092+#include <linux/fs.h>
57093+#include <linux/mount.h>
57094+#include <linux/types.h>
57095+#include <linux/pid_namespace.h>
57096+#include <linux/grsecurity.h>
57097+#include <linux/grinternal.h>
57098+
57099+void gr_set_chroot_entries(struct task_struct *task, struct path *path)
57100+{
57101+#ifdef CONFIG_GRKERNSEC
57102+ if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
57103+ path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
57104+ task->gr_is_chrooted = 1;
57105+ else
57106+ task->gr_is_chrooted = 0;
57107+
57108+ task->gr_chroot_dentry = path->dentry;
57109+#endif
57110+ return;
57111+}
57112+
57113+void gr_clear_chroot_entries(struct task_struct *task)
57114+{
57115+#ifdef CONFIG_GRKERNSEC
57116+ task->gr_is_chrooted = 0;
57117+ task->gr_chroot_dentry = NULL;
57118+#endif
57119+ return;
57120+}
57121+
57122+int
57123+gr_handle_chroot_unix(struct pid *pid)
57124+{
57125+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
57126+ struct task_struct *p;
57127+
57128+ if (unlikely(!grsec_enable_chroot_unix))
57129+ return 1;
57130+
57131+ if (likely(!proc_is_chrooted(current)))
57132+ return 1;
57133+
57134+ rcu_read_lock();
57135+ read_lock(&tasklist_lock);
57136+ p = pid_task(pid, PIDTYPE_PID);
57137+ if (unlikely(p && !have_same_root(current, p))) {
57138+ read_unlock(&tasklist_lock);
57139+ rcu_read_unlock();
57140+ gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
57141+ return 0;
57142+ }
57143+ read_unlock(&tasklist_lock);
57144+ rcu_read_unlock();
57145+#endif
57146+ return 1;
57147+}
57148+
57149+int
57150+gr_handle_chroot_nice(void)
57151+{
57152+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57153+ if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
57154+ gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
57155+ return -EPERM;
57156+ }
57157+#endif
57158+ return 0;
57159+}
57160+
57161+int
57162+gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
57163+{
57164+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57165+ if (grsec_enable_chroot_nice && (niceval < task_nice(p))
57166+ && proc_is_chrooted(current)) {
57167+ gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
57168+ return -EACCES;
57169+ }
57170+#endif
57171+ return 0;
57172+}
57173+
57174+int
57175+gr_handle_chroot_rawio(const struct inode *inode)
57176+{
57177+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57178+ if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
57179+ inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
57180+ return 1;
57181+#endif
57182+ return 0;
57183+}
57184+
57185+int
57186+gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
57187+{
57188+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57189+ struct task_struct *p;
57190+ int ret = 0;
57191+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
57192+ return ret;
57193+
57194+ read_lock(&tasklist_lock);
57195+ do_each_pid_task(pid, type, p) {
57196+ if (!have_same_root(current, p)) {
57197+ ret = 1;
57198+ goto out;
57199+ }
57200+ } while_each_pid_task(pid, type, p);
57201+out:
57202+ read_unlock(&tasklist_lock);
57203+ return ret;
57204+#endif
57205+ return 0;
57206+}
57207+
57208+int
57209+gr_pid_is_chrooted(struct task_struct *p)
57210+{
57211+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57212+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
57213+ return 0;
57214+
57215+ if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
57216+ !have_same_root(current, p)) {
57217+ return 1;
57218+ }
57219+#endif
57220+ return 0;
57221+}
57222+
57223+EXPORT_SYMBOL(gr_pid_is_chrooted);
57224+
57225+#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
57226+int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
57227+{
57228+ struct path path, currentroot;
57229+ int ret = 0;
57230+
57231+ path.dentry = (struct dentry *)u_dentry;
57232+ path.mnt = (struct vfsmount *)u_mnt;
57233+ get_fs_root(current->fs, &currentroot);
57234+ if (path_is_under(&path, &currentroot))
57235+ ret = 1;
57236+ path_put(&currentroot);
57237+
57238+ return ret;
57239+}
57240+#endif
57241+
57242+int
57243+gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
57244+{
57245+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
57246+ if (!grsec_enable_chroot_fchdir)
57247+ return 1;
57248+
57249+ if (!proc_is_chrooted(current))
57250+ return 1;
57251+ else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
57252+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
57253+ return 0;
57254+ }
57255+#endif
57256+ return 1;
57257+}
57258+
57259+int
57260+gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57261+ const time_t shm_createtime)
57262+{
57263+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
57264+ struct pid *pid = NULL;
57265+ time_t starttime;
57266+
57267+ if (unlikely(!grsec_enable_chroot_shmat))
57268+ return 1;
57269+
57270+ if (likely(!proc_is_chrooted(current)))
57271+ return 1;
57272+
57273+ rcu_read_lock();
57274+ read_lock(&tasklist_lock);
57275+
57276+ pid = find_vpid(shm_cprid);
57277+ if (pid) {
57278+ struct task_struct *p;
57279+ p = pid_task(pid, PIDTYPE_PID);
57280+ if (p == NULL)
57281+ goto unlock;
57282+ starttime = p->start_time.tv_sec;
57283+ if (unlikely(!have_same_root(current, p) &&
57284+ time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime))) {
57285+ read_unlock(&tasklist_lock);
57286+ rcu_read_unlock();
57287+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
57288+ return 0;
57289+ }
57290+ } else {
57291+ pid = find_vpid(shm_lapid);
57292+ if (pid) {
57293+ struct task_struct *p;
57294+ p = pid_task(pid, PIDTYPE_PID);
57295+ if (p == NULL)
57296+ goto unlock;
57297+ if (unlikely(!have_same_root(current, p))) {
57298+ read_unlock(&tasklist_lock);
57299+ rcu_read_unlock();
57300+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
57301+ return 0;
57302+ }
57303+ }
57304+ }
57305+unlock:
57306+ read_unlock(&tasklist_lock);
57307+ rcu_read_unlock();
57308+#endif
57309+ return 1;
57310+}
57311+
57312+void
57313+gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
57314+{
57315+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
57316+ if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
57317+ gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
57318+#endif
57319+ return;
57320+}
57321+
57322+int
57323+gr_handle_chroot_mknod(const struct dentry *dentry,
57324+ const struct vfsmount *mnt, const int mode)
57325+{
57326+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
57327+ if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
57328+ proc_is_chrooted(current)) {
57329+ gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
57330+ return -EPERM;
57331+ }
57332+#endif
57333+ return 0;
57334+}
57335+
57336+int
57337+gr_handle_chroot_mount(const struct dentry *dentry,
57338+ const struct vfsmount *mnt, const char *dev_name)
57339+{
57340+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
57341+ if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
57342+ gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name, dentry, mnt);
57343+ return -EPERM;
57344+ }
57345+#endif
57346+ return 0;
57347+}
57348+
57349+int
57350+gr_handle_chroot_pivot(void)
57351+{
57352+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
57353+ if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
57354+ gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
57355+ return -EPERM;
57356+ }
57357+#endif
57358+ return 0;
57359+}
57360+
57361+int
57362+gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
57363+{
57364+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
57365+ if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
57366+ !gr_is_outside_chroot(dentry, mnt)) {
57367+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
57368+ return -EPERM;
57369+ }
57370+#endif
57371+ return 0;
57372+}
57373+
57374+int
57375+gr_handle_chroot_caps(struct path *path)
57376+{
57377+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57378+ if (grsec_enable_chroot_caps && current->pid > 1 && current->fs != NULL &&
57379+ (init_task.fs->root.dentry != path->dentry) &&
57380+ (current->nsproxy->mnt_ns->root->mnt_root != path->dentry)) {
57381+
57382+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
57383+ const struct cred *old = current_cred();
57384+ struct cred *new = prepare_creds();
57385+ if (new == NULL)
57386+ return 1;
57387+
57388+ new->cap_permitted = cap_drop(old->cap_permitted,
57389+ chroot_caps);
57390+ new->cap_inheritable = cap_drop(old->cap_inheritable,
57391+ chroot_caps);
57392+ new->cap_effective = cap_drop(old->cap_effective,
57393+ chroot_caps);
57394+
57395+ commit_creds(new);
57396+
57397+ return 0;
57398+ }
57399+#endif
57400+ return 0;
57401+}
57402+
57403+int
57404+gr_handle_chroot_sysctl(const int op)
57405+{
57406+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
57407+ if (grsec_enable_chroot_sysctl && (op & MAY_WRITE) &&
57408+ proc_is_chrooted(current))
57409+ return -EACCES;
57410+#endif
57411+ return 0;
57412+}
57413+
57414+void
57415+gr_handle_chroot_chdir(struct path *path)
57416+{
57417+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
57418+ if (grsec_enable_chroot_chdir)
57419+ set_fs_pwd(current->fs, path);
57420+#endif
57421+ return;
57422+}
57423+
57424+int
57425+gr_handle_chroot_chmod(const struct dentry *dentry,
57426+ const struct vfsmount *mnt, const int mode)
57427+{
57428+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
57429+ /* allow chmod +s on directories, but not files */
57430+ if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
57431+ ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
57432+ proc_is_chrooted(current)) {
57433+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
57434+ return -EPERM;
57435+ }
57436+#endif
57437+ return 0;
57438+}
57439+
57440+#ifdef CONFIG_SECURITY
57441+EXPORT_SYMBOL(gr_handle_chroot_caps);
57442+#endif
57443diff -urNp linux-2.6.39.1/grsecurity/grsec_disabled.c linux-2.6.39.1/grsecurity/grsec_disabled.c
57444--- linux-2.6.39.1/grsecurity/grsec_disabled.c 1969-12-31 19:00:00.000000000 -0500
57445+++ linux-2.6.39.1/grsecurity/grsec_disabled.c 2011-05-22 19:41:42.000000000 -0400
57446@@ -0,0 +1,447 @@
57447+#include <linux/kernel.h>
57448+#include <linux/module.h>
57449+#include <linux/sched.h>
57450+#include <linux/file.h>
57451+#include <linux/fs.h>
57452+#include <linux/kdev_t.h>
57453+#include <linux/net.h>
57454+#include <linux/in.h>
57455+#include <linux/ip.h>
57456+#include <linux/skbuff.h>
57457+#include <linux/sysctl.h>
57458+
57459+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
57460+void
57461+pax_set_initial_flags(struct linux_binprm *bprm)
57462+{
57463+ return;
57464+}
57465+#endif
57466+
57467+#ifdef CONFIG_SYSCTL
57468+__u32
57469+gr_handle_sysctl(const struct ctl_table * table, const int op)
57470+{
57471+ return 0;
57472+}
57473+#endif
57474+
57475+#ifdef CONFIG_TASKSTATS
57476+int gr_is_taskstats_denied(int pid)
57477+{
57478+ return 0;
57479+}
57480+#endif
57481+
57482+int
57483+gr_acl_is_enabled(void)
57484+{
57485+ return 0;
57486+}
57487+
57488+int
57489+gr_handle_rawio(const struct inode *inode)
57490+{
57491+ return 0;
57492+}
57493+
57494+void
57495+gr_acl_handle_psacct(struct task_struct *task, const long code)
57496+{
57497+ return;
57498+}
57499+
57500+int
57501+gr_handle_ptrace(struct task_struct *task, const long request)
57502+{
57503+ return 0;
57504+}
57505+
57506+int
57507+gr_handle_proc_ptrace(struct task_struct *task)
57508+{
57509+ return 0;
57510+}
57511+
57512+void
57513+gr_learn_resource(const struct task_struct *task,
57514+ const int res, const unsigned long wanted, const int gt)
57515+{
57516+ return;
57517+}
57518+
57519+int
57520+gr_set_acls(const int type)
57521+{
57522+ return 0;
57523+}
57524+
57525+int
57526+gr_check_hidden_task(const struct task_struct *tsk)
57527+{
57528+ return 0;
57529+}
57530+
57531+int
57532+gr_check_protected_task(const struct task_struct *task)
57533+{
57534+ return 0;
57535+}
57536+
57537+int
57538+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
57539+{
57540+ return 0;
57541+}
57542+
57543+void
57544+gr_copy_label(struct task_struct *tsk)
57545+{
57546+ return;
57547+}
57548+
57549+void
57550+gr_set_pax_flags(struct task_struct *task)
57551+{
57552+ return;
57553+}
57554+
57555+int
57556+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
57557+ const int unsafe_share)
57558+{
57559+ return 0;
57560+}
57561+
57562+void
57563+gr_handle_delete(const ino_t ino, const dev_t dev)
57564+{
57565+ return;
57566+}
57567+
57568+void
57569+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
57570+{
57571+ return;
57572+}
57573+
57574+void
57575+gr_handle_crash(struct task_struct *task, const int sig)
57576+{
57577+ return;
57578+}
57579+
57580+int
57581+gr_check_crash_exec(const struct file *filp)
57582+{
57583+ return 0;
57584+}
57585+
57586+int
57587+gr_check_crash_uid(const uid_t uid)
57588+{
57589+ return 0;
57590+}
57591+
57592+void
57593+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
57594+ struct dentry *old_dentry,
57595+ struct dentry *new_dentry,
57596+ struct vfsmount *mnt, const __u8 replace)
57597+{
57598+ return;
57599+}
57600+
57601+int
57602+gr_search_socket(const int family, const int type, const int protocol)
57603+{
57604+ return 1;
57605+}
57606+
57607+int
57608+gr_search_connectbind(const int mode, const struct socket *sock,
57609+ const struct sockaddr_in *addr)
57610+{
57611+ return 0;
57612+}
57613+
57614+int
57615+gr_is_capable(const int cap)
57616+{
57617+ return 1;
57618+}
57619+
57620+int
57621+gr_is_capable_nolog(const int cap)
57622+{
57623+ return 1;
57624+}
57625+
57626+void
57627+gr_handle_alertkill(struct task_struct *task)
57628+{
57629+ return;
57630+}
57631+
57632+__u32
57633+gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
57634+{
57635+ return 1;
57636+}
57637+
57638+__u32
57639+gr_acl_handle_hidden_file(const struct dentry * dentry,
57640+ const struct vfsmount * mnt)
57641+{
57642+ return 1;
57643+}
57644+
57645+__u32
57646+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
57647+ const int fmode)
57648+{
57649+ return 1;
57650+}
57651+
57652+__u32
57653+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
57654+{
57655+ return 1;
57656+}
57657+
57658+__u32
57659+gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
57660+{
57661+ return 1;
57662+}
57663+
57664+int
57665+gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
57666+ unsigned int *vm_flags)
57667+{
57668+ return 1;
57669+}
57670+
57671+__u32
57672+gr_acl_handle_truncate(const struct dentry * dentry,
57673+ const struct vfsmount * mnt)
57674+{
57675+ return 1;
57676+}
57677+
57678+__u32
57679+gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
57680+{
57681+ return 1;
57682+}
57683+
57684+__u32
57685+gr_acl_handle_access(const struct dentry * dentry,
57686+ const struct vfsmount * mnt, const int fmode)
57687+{
57688+ return 1;
57689+}
57690+
57691+__u32
57692+gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
57693+ mode_t mode)
57694+{
57695+ return 1;
57696+}
57697+
57698+__u32
57699+gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
57700+ mode_t mode)
57701+{
57702+ return 1;
57703+}
57704+
57705+__u32
57706+gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
57707+{
57708+ return 1;
57709+}
57710+
57711+__u32
57712+gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
57713+{
57714+ return 1;
57715+}
57716+
57717+void
57718+grsecurity_init(void)
57719+{
57720+ return;
57721+}
57722+
57723+__u32
57724+gr_acl_handle_mknod(const struct dentry * new_dentry,
57725+ const struct dentry * parent_dentry,
57726+ const struct vfsmount * parent_mnt,
57727+ const int mode)
57728+{
57729+ return 1;
57730+}
57731+
57732+__u32
57733+gr_acl_handle_mkdir(const struct dentry * new_dentry,
57734+ const struct dentry * parent_dentry,
57735+ const struct vfsmount * parent_mnt)
57736+{
57737+ return 1;
57738+}
57739+
57740+__u32
57741+gr_acl_handle_symlink(const struct dentry * new_dentry,
57742+ const struct dentry * parent_dentry,
57743+ const struct vfsmount * parent_mnt, const char *from)
57744+{
57745+ return 1;
57746+}
57747+
57748+__u32
57749+gr_acl_handle_link(const struct dentry * new_dentry,
57750+ const struct dentry * parent_dentry,
57751+ const struct vfsmount * parent_mnt,
57752+ const struct dentry * old_dentry,
57753+ const struct vfsmount * old_mnt, const char *to)
57754+{
57755+ return 1;
57756+}
57757+
57758+int
57759+gr_acl_handle_rename(const struct dentry *new_dentry,
57760+ const struct dentry *parent_dentry,
57761+ const struct vfsmount *parent_mnt,
57762+ const struct dentry *old_dentry,
57763+ const struct inode *old_parent_inode,
57764+ const struct vfsmount *old_mnt, const char *newname)
57765+{
57766+ return 0;
57767+}
57768+
57769+int
57770+gr_acl_handle_filldir(const struct file *file, const char *name,
57771+ const int namelen, const ino_t ino)
57772+{
57773+ return 1;
57774+}
57775+
57776+int
57777+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57778+ const time_t shm_createtime, const uid_t cuid, const int shmid)
57779+{
57780+ return 1;
57781+}
57782+
57783+int
57784+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
57785+{
57786+ return 0;
57787+}
57788+
57789+int
57790+gr_search_accept(const struct socket *sock)
57791+{
57792+ return 0;
57793+}
57794+
57795+int
57796+gr_search_listen(const struct socket *sock)
57797+{
57798+ return 0;
57799+}
57800+
57801+int
57802+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
57803+{
57804+ return 0;
57805+}
57806+
57807+__u32
57808+gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
57809+{
57810+ return 1;
57811+}
57812+
57813+__u32
57814+gr_acl_handle_creat(const struct dentry * dentry,
57815+ const struct dentry * p_dentry,
57816+ const struct vfsmount * p_mnt, const int fmode,
57817+ const int imode)
57818+{
57819+ return 1;
57820+}
57821+
57822+void
57823+gr_acl_handle_exit(void)
57824+{
57825+ return;
57826+}
57827+
57828+int
57829+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
57830+{
57831+ return 1;
57832+}
57833+
57834+void
57835+gr_set_role_label(const uid_t uid, const gid_t gid)
57836+{
57837+ return;
57838+}
57839+
57840+int
57841+gr_acl_handle_procpidmem(const struct task_struct *task)
57842+{
57843+ return 0;
57844+}
57845+
57846+int
57847+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
57848+{
57849+ return 0;
57850+}
57851+
57852+int
57853+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
57854+{
57855+ return 0;
57856+}
57857+
57858+void
57859+gr_set_kernel_label(struct task_struct *task)
57860+{
57861+ return;
57862+}
57863+
57864+int
57865+gr_check_user_change(int real, int effective, int fs)
57866+{
57867+ return 0;
57868+}
57869+
57870+int
57871+gr_check_group_change(int real, int effective, int fs)
57872+{
57873+ return 0;
57874+}
57875+
57876+int gr_acl_enable_at_secure(void)
57877+{
57878+ return 0;
57879+}
57880+
57881+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
57882+{
57883+ return dentry->d_inode->i_sb->s_dev;
57884+}
57885+
57886+EXPORT_SYMBOL(gr_is_capable);
57887+EXPORT_SYMBOL(gr_is_capable_nolog);
57888+EXPORT_SYMBOL(gr_learn_resource);
57889+EXPORT_SYMBOL(gr_set_kernel_label);
57890+#ifdef CONFIG_SECURITY
57891+EXPORT_SYMBOL(gr_check_user_change);
57892+EXPORT_SYMBOL(gr_check_group_change);
57893+#endif
57894diff -urNp linux-2.6.39.1/grsecurity/grsec_exec.c linux-2.6.39.1/grsecurity/grsec_exec.c
57895--- linux-2.6.39.1/grsecurity/grsec_exec.c 1969-12-31 19:00:00.000000000 -0500
57896+++ linux-2.6.39.1/grsecurity/grsec_exec.c 2011-05-22 22:41:29.000000000 -0400
57897@@ -0,0 +1,146 @@
57898+#include <linux/kernel.h>
57899+#include <linux/sched.h>
57900+#include <linux/file.h>
57901+#include <linux/binfmts.h>
57902+#include <linux/fs.h>
57903+#include <linux/types.h>
57904+#include <linux/grdefs.h>
57905+#include <linux/grinternal.h>
57906+#include <linux/capability.h>
57907+#include <linux/compat.h>
57908+
57909+#include <asm/uaccess.h>
57910+
57911+#ifdef CONFIG_GRKERNSEC_EXECLOG
57912+static char gr_exec_arg_buf[132];
57913+static DEFINE_MUTEX(gr_exec_arg_mutex);
57914+#endif
57915+
57916+int
57917+gr_handle_nproc(void)
57918+{
57919+#ifdef CONFIG_GRKERNSEC_EXECVE
57920+ const struct cred *cred = current_cred();
57921+ if (grsec_enable_execve && cred->user &&
57922+ (atomic_read(&cred->user->processes) > rlimit(RLIMIT_NPROC)) &&
57923+ !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE)) {
57924+ gr_log_noargs(GR_DONT_AUDIT, GR_NPROC_MSG);
57925+ return -EAGAIN;
57926+ }
57927+#endif
57928+ return 0;
57929+}
57930+
57931+void
57932+gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv)
57933+{
57934+#ifdef CONFIG_GRKERNSEC_EXECLOG
57935+ char *grarg = gr_exec_arg_buf;
57936+ unsigned int i, x, execlen = 0;
57937+ char c;
57938+
57939+ if (!((grsec_enable_execlog && grsec_enable_group &&
57940+ in_group_p(grsec_audit_gid))
57941+ || (grsec_enable_execlog && !grsec_enable_group)))
57942+ return;
57943+
57944+ mutex_lock(&gr_exec_arg_mutex);
57945+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
57946+
57947+ if (unlikely(argv == NULL))
57948+ goto log;
57949+
57950+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
57951+ const char __user *p;
57952+ unsigned int len;
57953+
57954+ if (copy_from_user(&p, argv + i, sizeof(p)))
57955+ goto log;
57956+ if (!p)
57957+ goto log;
57958+ len = strnlen_user(p, 128 - execlen);
57959+ if (len > 128 - execlen)
57960+ len = 128 - execlen;
57961+ else if (len > 0)
57962+ len--;
57963+ if (copy_from_user(grarg + execlen, p, len))
57964+ goto log;
57965+
57966+ /* rewrite unprintable characters */
57967+ for (x = 0; x < len; x++) {
57968+ c = *(grarg + execlen + x);
57969+ if (c < 32 || c > 126)
57970+ *(grarg + execlen + x) = ' ';
57971+ }
57972+
57973+ execlen += len;
57974+ *(grarg + execlen) = ' ';
57975+ *(grarg + execlen + 1) = '\0';
57976+ execlen++;
57977+ }
57978+
57979+ log:
57980+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
57981+ bprm->file->f_path.mnt, grarg);
57982+ mutex_unlock(&gr_exec_arg_mutex);
57983+#endif
57984+ return;
57985+}
57986+
57987+#ifdef CONFIG_COMPAT
57988+void
57989+gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv)
57990+{
57991+#ifdef CONFIG_GRKERNSEC_EXECLOG
57992+ char *grarg = gr_exec_arg_buf;
57993+ unsigned int i, x, execlen = 0;
57994+ char c;
57995+
57996+ if (!((grsec_enable_execlog && grsec_enable_group &&
57997+ in_group_p(grsec_audit_gid))
57998+ || (grsec_enable_execlog && !grsec_enable_group)))
57999+ return;
58000+
58001+ mutex_lock(&gr_exec_arg_mutex);
58002+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
58003+
58004+ if (unlikely(argv == NULL))
58005+ goto log;
58006+
58007+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
58008+ compat_uptr_t p;
58009+ unsigned int len;
58010+
58011+ if (get_user(p, argv + i))
58012+ goto log;
58013+ len = strnlen_user(compat_ptr(p), 128 - execlen);
58014+ if (len > 128 - execlen)
58015+ len = 128 - execlen;
58016+ else if (len > 0)
58017+ len--;
58018+ else
58019+ goto log;
58020+ if (copy_from_user(grarg + execlen, compat_ptr(p), len))
58021+ goto log;
58022+
58023+ /* rewrite unprintable characters */
58024+ for (x = 0; x < len; x++) {
58025+ c = *(grarg + execlen + x);
58026+ if (c < 32 || c > 126)
58027+ *(grarg + execlen + x) = ' ';
58028+ }
58029+
58030+ execlen += len;
58031+ *(grarg + execlen) = ' ';
58032+ *(grarg + execlen + 1) = '\0';
58033+ execlen++;
58034+ }
58035+
58036+ log:
58037+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
58038+ bprm->file->f_path.mnt, grarg);
58039+ mutex_unlock(&gr_exec_arg_mutex);
58040+#endif
58041+ return;
58042+}
58043+#endif
58044diff -urNp linux-2.6.39.1/grsecurity/grsec_fifo.c linux-2.6.39.1/grsecurity/grsec_fifo.c
58045--- linux-2.6.39.1/grsecurity/grsec_fifo.c 1969-12-31 19:00:00.000000000 -0500
58046+++ linux-2.6.39.1/grsecurity/grsec_fifo.c 2011-05-22 19:41:42.000000000 -0400
58047@@ -0,0 +1,24 @@
58048+#include <linux/kernel.h>
58049+#include <linux/sched.h>
58050+#include <linux/fs.h>
58051+#include <linux/file.h>
58052+#include <linux/grinternal.h>
58053+
58054+int
58055+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
58056+ const struct dentry *dir, const int flag, const int acc_mode)
58057+{
58058+#ifdef CONFIG_GRKERNSEC_FIFO
58059+ const struct cred *cred = current_cred();
58060+
58061+ if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
58062+ !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
58063+ (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
58064+ (cred->fsuid != dentry->d_inode->i_uid)) {
58065+ if (!inode_permission(dentry->d_inode, acc_mode))
58066+ gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
58067+ return -EACCES;
58068+ }
58069+#endif
58070+ return 0;
58071+}
58072diff -urNp linux-2.6.39.1/grsecurity/grsec_fork.c linux-2.6.39.1/grsecurity/grsec_fork.c
58073--- linux-2.6.39.1/grsecurity/grsec_fork.c 1969-12-31 19:00:00.000000000 -0500
58074+++ linux-2.6.39.1/grsecurity/grsec_fork.c 2011-05-22 19:41:42.000000000 -0400
58075@@ -0,0 +1,23 @@
58076+#include <linux/kernel.h>
58077+#include <linux/sched.h>
58078+#include <linux/grsecurity.h>
58079+#include <linux/grinternal.h>
58080+#include <linux/errno.h>
58081+
58082+void
58083+gr_log_forkfail(const int retval)
58084+{
58085+#ifdef CONFIG_GRKERNSEC_FORKFAIL
58086+ if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
58087+ switch (retval) {
58088+ case -EAGAIN:
58089+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
58090+ break;
58091+ case -ENOMEM:
58092+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
58093+ break;
58094+ }
58095+ }
58096+#endif
58097+ return;
58098+}
58099diff -urNp linux-2.6.39.1/grsecurity/grsec_init.c linux-2.6.39.1/grsecurity/grsec_init.c
58100--- linux-2.6.39.1/grsecurity/grsec_init.c 1969-12-31 19:00:00.000000000 -0500
58101+++ linux-2.6.39.1/grsecurity/grsec_init.c 2011-05-22 22:47:15.000000000 -0400
58102@@ -0,0 +1,269 @@
58103+#include <linux/kernel.h>
58104+#include <linux/sched.h>
58105+#include <linux/mm.h>
58106+#include <linux/gracl.h>
58107+#include <linux/slab.h>
58108+#include <linux/vmalloc.h>
58109+#include <linux/percpu.h>
58110+#include <linux/module.h>
58111+
58112+int grsec_enable_link;
58113+int grsec_enable_dmesg;
58114+int grsec_enable_harden_ptrace;
58115+int grsec_enable_fifo;
58116+int grsec_enable_execve;
58117+int grsec_enable_execlog;
58118+int grsec_enable_signal;
58119+int grsec_enable_forkfail;
58120+int grsec_enable_audit_ptrace;
58121+int grsec_enable_time;
58122+int grsec_enable_audit_textrel;
58123+int grsec_enable_group;
58124+int grsec_audit_gid;
58125+int grsec_enable_chdir;
58126+int grsec_enable_mount;
58127+int grsec_enable_rofs;
58128+int grsec_enable_chroot_findtask;
58129+int grsec_enable_chroot_mount;
58130+int grsec_enable_chroot_shmat;
58131+int grsec_enable_chroot_fchdir;
58132+int grsec_enable_chroot_double;
58133+int grsec_enable_chroot_pivot;
58134+int grsec_enable_chroot_chdir;
58135+int grsec_enable_chroot_chmod;
58136+int grsec_enable_chroot_mknod;
58137+int grsec_enable_chroot_nice;
58138+int grsec_enable_chroot_execlog;
58139+int grsec_enable_chroot_caps;
58140+int grsec_enable_chroot_sysctl;
58141+int grsec_enable_chroot_unix;
58142+int grsec_enable_tpe;
58143+int grsec_tpe_gid;
58144+int grsec_enable_blackhole;
58145+#ifdef CONFIG_IPV6_MODULE
58146+EXPORT_SYMBOL(grsec_enable_blackhole);
58147+#endif
58148+int grsec_lastack_retries;
58149+int grsec_enable_tpe_all;
58150+int grsec_enable_tpe_invert;
58151+int grsec_enable_socket_all;
58152+int grsec_socket_all_gid;
58153+int grsec_enable_socket_client;
58154+int grsec_socket_client_gid;
58155+int grsec_enable_socket_server;
58156+int grsec_socket_server_gid;
58157+int grsec_resource_logging;
58158+int grsec_disable_privio;
58159+int grsec_enable_log_rwxmaps;
58160+int grsec_lock;
58161+
58162+DEFINE_SPINLOCK(grsec_alert_lock);
58163+unsigned long grsec_alert_wtime = 0;
58164+unsigned long grsec_alert_fyet = 0;
58165+
58166+DEFINE_SPINLOCK(grsec_audit_lock);
58167+
58168+DEFINE_RWLOCK(grsec_exec_file_lock);
58169+
58170+char *gr_shared_page[4];
58171+
58172+char *gr_alert_log_fmt;
58173+char *gr_audit_log_fmt;
58174+char *gr_alert_log_buf;
58175+char *gr_audit_log_buf;
58176+
58177+extern struct gr_arg *gr_usermode;
58178+extern unsigned char *gr_system_salt;
58179+extern unsigned char *gr_system_sum;
58180+
58181+void __init
58182+grsecurity_init(void)
58183+{
58184+ int j;
58185+ /* create the per-cpu shared pages */
58186+
58187+#ifdef CONFIG_X86
58188+ memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
58189+#endif
58190+
58191+ for (j = 0; j < 4; j++) {
58192+ gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
58193+ if (gr_shared_page[j] == NULL) {
58194+ panic("Unable to allocate grsecurity shared page");
58195+ return;
58196+ }
58197+ }
58198+
58199+ /* allocate log buffers */
58200+ gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
58201+ if (!gr_alert_log_fmt) {
58202+ panic("Unable to allocate grsecurity alert log format buffer");
58203+ return;
58204+ }
58205+ gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
58206+ if (!gr_audit_log_fmt) {
58207+ panic("Unable to allocate grsecurity audit log format buffer");
58208+ return;
58209+ }
58210+ gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
58211+ if (!gr_alert_log_buf) {
58212+ panic("Unable to allocate grsecurity alert log buffer");
58213+ return;
58214+ }
58215+ gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
58216+ if (!gr_audit_log_buf) {
58217+ panic("Unable to allocate grsecurity audit log buffer");
58218+ return;
58219+ }
58220+
58221+ /* allocate memory for authentication structure */
58222+ gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
58223+ gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
58224+ gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
58225+
58226+ if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
58227+ panic("Unable to allocate grsecurity authentication structure");
58228+ return;
58229+ }
58230+
58231+
58232+#ifdef CONFIG_GRKERNSEC_IO
58233+#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
58234+ grsec_disable_privio = 1;
58235+#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
58236+ grsec_disable_privio = 1;
58237+#else
58238+ grsec_disable_privio = 0;
58239+#endif
58240+#endif
58241+
58242+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
58243+ /* for backward compatibility, tpe_invert always defaults to on if
58244+ enabled in the kernel
58245+ */
58246+ grsec_enable_tpe_invert = 1;
58247+#endif
58248+
58249+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
58250+#ifndef CONFIG_GRKERNSEC_SYSCTL
58251+ grsec_lock = 1;
58252+#endif
58253+
58254+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
58255+ grsec_enable_audit_textrel = 1;
58256+#endif
58257+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58258+ grsec_enable_log_rwxmaps = 1;
58259+#endif
58260+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
58261+ grsec_enable_group = 1;
58262+ grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
58263+#endif
58264+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
58265+ grsec_enable_chdir = 1;
58266+#endif
58267+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
58268+ grsec_enable_harden_ptrace = 1;
58269+#endif
58270+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58271+ grsec_enable_mount = 1;
58272+#endif
58273+#ifdef CONFIG_GRKERNSEC_LINK
58274+ grsec_enable_link = 1;
58275+#endif
58276+#ifdef CONFIG_GRKERNSEC_DMESG
58277+ grsec_enable_dmesg = 1;
58278+#endif
58279+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
58280+ grsec_enable_blackhole = 1;
58281+ grsec_lastack_retries = 4;
58282+#endif
58283+#ifdef CONFIG_GRKERNSEC_FIFO
58284+ grsec_enable_fifo = 1;
58285+#endif
58286+#ifdef CONFIG_GRKERNSEC_EXECVE
58287+ grsec_enable_execve = 1;
58288+#endif
58289+#ifdef CONFIG_GRKERNSEC_EXECLOG
58290+ grsec_enable_execlog = 1;
58291+#endif
58292+#ifdef CONFIG_GRKERNSEC_SIGNAL
58293+ grsec_enable_signal = 1;
58294+#endif
58295+#ifdef CONFIG_GRKERNSEC_FORKFAIL
58296+ grsec_enable_forkfail = 1;
58297+#endif
58298+#ifdef CONFIG_GRKERNSEC_TIME
58299+ grsec_enable_time = 1;
58300+#endif
58301+#ifdef CONFIG_GRKERNSEC_RESLOG
58302+ grsec_resource_logging = 1;
58303+#endif
58304+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
58305+ grsec_enable_chroot_findtask = 1;
58306+#endif
58307+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
58308+ grsec_enable_chroot_unix = 1;
58309+#endif
58310+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
58311+ grsec_enable_chroot_mount = 1;
58312+#endif
58313+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
58314+ grsec_enable_chroot_fchdir = 1;
58315+#endif
58316+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
58317+ grsec_enable_chroot_shmat = 1;
58318+#endif
58319+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
58320+ grsec_enable_audit_ptrace = 1;
58321+#endif
58322+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
58323+ grsec_enable_chroot_double = 1;
58324+#endif
58325+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
58326+ grsec_enable_chroot_pivot = 1;
58327+#endif
58328+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
58329+ grsec_enable_chroot_chdir = 1;
58330+#endif
58331+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
58332+ grsec_enable_chroot_chmod = 1;
58333+#endif
58334+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
58335+ grsec_enable_chroot_mknod = 1;
58336+#endif
58337+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
58338+ grsec_enable_chroot_nice = 1;
58339+#endif
58340+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
58341+ grsec_enable_chroot_execlog = 1;
58342+#endif
58343+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
58344+ grsec_enable_chroot_caps = 1;
58345+#endif
58346+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
58347+ grsec_enable_chroot_sysctl = 1;
58348+#endif
58349+#ifdef CONFIG_GRKERNSEC_TPE
58350+ grsec_enable_tpe = 1;
58351+ grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
58352+#ifdef CONFIG_GRKERNSEC_TPE_ALL
58353+ grsec_enable_tpe_all = 1;
58354+#endif
58355+#endif
58356+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
58357+ grsec_enable_socket_all = 1;
58358+ grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
58359+#endif
58360+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
58361+ grsec_enable_socket_client = 1;
58362+ grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
58363+#endif
58364+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
58365+ grsec_enable_socket_server = 1;
58366+ grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
58367+#endif
58368+#endif
58369+
58370+ return;
58371+}
58372diff -urNp linux-2.6.39.1/grsecurity/grsec_link.c linux-2.6.39.1/grsecurity/grsec_link.c
58373--- linux-2.6.39.1/grsecurity/grsec_link.c 1969-12-31 19:00:00.000000000 -0500
58374+++ linux-2.6.39.1/grsecurity/grsec_link.c 2011-05-22 19:41:42.000000000 -0400
58375@@ -0,0 +1,43 @@
58376+#include <linux/kernel.h>
58377+#include <linux/sched.h>
58378+#include <linux/fs.h>
58379+#include <linux/file.h>
58380+#include <linux/grinternal.h>
58381+
58382+int
58383+gr_handle_follow_link(const struct inode *parent,
58384+ const struct inode *inode,
58385+ const struct dentry *dentry, const struct vfsmount *mnt)
58386+{
58387+#ifdef CONFIG_GRKERNSEC_LINK
58388+ const struct cred *cred = current_cred();
58389+
58390+ if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
58391+ (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
58392+ (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
58393+ gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
58394+ return -EACCES;
58395+ }
58396+#endif
58397+ return 0;
58398+}
58399+
58400+int
58401+gr_handle_hardlink(const struct dentry *dentry,
58402+ const struct vfsmount *mnt,
58403+ struct inode *inode, const int mode, const char *to)
58404+{
58405+#ifdef CONFIG_GRKERNSEC_LINK
58406+ const struct cred *cred = current_cred();
58407+
58408+ if (grsec_enable_link && cred->fsuid != inode->i_uid &&
58409+ (!S_ISREG(mode) || (mode & S_ISUID) ||
58410+ ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
58411+ (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
58412+ !capable(CAP_FOWNER) && cred->uid) {
58413+ gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
58414+ return -EPERM;
58415+ }
58416+#endif
58417+ return 0;
58418+}
58419diff -urNp linux-2.6.39.1/grsecurity/grsec_log.c linux-2.6.39.1/grsecurity/grsec_log.c
58420--- linux-2.6.39.1/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500
58421+++ linux-2.6.39.1/grsecurity/grsec_log.c 2011-05-22 19:41:42.000000000 -0400
58422@@ -0,0 +1,310 @@
58423+#include <linux/kernel.h>
58424+#include <linux/sched.h>
58425+#include <linux/file.h>
58426+#include <linux/tty.h>
58427+#include <linux/fs.h>
58428+#include <linux/grinternal.h>
58429+
58430+#ifdef CONFIG_TREE_PREEMPT_RCU
58431+#define DISABLE_PREEMPT() preempt_disable()
58432+#define ENABLE_PREEMPT() preempt_enable()
58433+#else
58434+#define DISABLE_PREEMPT()
58435+#define ENABLE_PREEMPT()
58436+#endif
58437+
58438+#define BEGIN_LOCKS(x) \
58439+ DISABLE_PREEMPT(); \
58440+ rcu_read_lock(); \
58441+ read_lock(&tasklist_lock); \
58442+ read_lock(&grsec_exec_file_lock); \
58443+ if (x != GR_DO_AUDIT) \
58444+ spin_lock(&grsec_alert_lock); \
58445+ else \
58446+ spin_lock(&grsec_audit_lock)
58447+
58448+#define END_LOCKS(x) \
58449+ if (x != GR_DO_AUDIT) \
58450+ spin_unlock(&grsec_alert_lock); \
58451+ else \
58452+ spin_unlock(&grsec_audit_lock); \
58453+ read_unlock(&grsec_exec_file_lock); \
58454+ read_unlock(&tasklist_lock); \
58455+ rcu_read_unlock(); \
58456+ ENABLE_PREEMPT(); \
58457+ if (x == GR_DONT_AUDIT) \
58458+ gr_handle_alertkill(current)
58459+
58460+enum {
58461+ FLOODING,
58462+ NO_FLOODING
58463+};
58464+
58465+extern char *gr_alert_log_fmt;
58466+extern char *gr_audit_log_fmt;
58467+extern char *gr_alert_log_buf;
58468+extern char *gr_audit_log_buf;
58469+
58470+static int gr_log_start(int audit)
58471+{
58472+ char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
58473+ char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
58474+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58475+
58476+ if (audit == GR_DO_AUDIT)
58477+ goto set_fmt;
58478+
58479+ if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) {
58480+ grsec_alert_wtime = jiffies;
58481+ grsec_alert_fyet = 0;
58482+ } else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
58483+ grsec_alert_fyet++;
58484+ } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
58485+ grsec_alert_wtime = jiffies;
58486+ grsec_alert_fyet++;
58487+ printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
58488+ return FLOODING;
58489+ } else return FLOODING;
58490+
58491+set_fmt:
58492+ memset(buf, 0, PAGE_SIZE);
58493+ if (current->signal->curr_ip && gr_acl_is_enabled()) {
58494+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
58495+ snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58496+ } else if (current->signal->curr_ip) {
58497+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
58498+ snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
58499+ } else if (gr_acl_is_enabled()) {
58500+ sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
58501+ snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58502+ } else {
58503+ sprintf(fmt, "%s%s", loglevel, "grsec: ");
58504+ strcpy(buf, fmt);
58505+ }
58506+
58507+ return NO_FLOODING;
58508+}
58509+
58510+static void gr_log_middle(int audit, const char *msg, va_list ap)
58511+ __attribute__ ((format (printf, 2, 0)));
58512+
58513+static void gr_log_middle(int audit, const char *msg, va_list ap)
58514+{
58515+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58516+ unsigned int len = strlen(buf);
58517+
58518+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58519+
58520+ return;
58521+}
58522+
58523+static void gr_log_middle_varargs(int audit, const char *msg, ...)
58524+ __attribute__ ((format (printf, 2, 3)));
58525+
58526+static void gr_log_middle_varargs(int audit, const char *msg, ...)
58527+{
58528+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58529+ unsigned int len = strlen(buf);
58530+ va_list ap;
58531+
58532+ va_start(ap, msg);
58533+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58534+ va_end(ap);
58535+
58536+ return;
58537+}
58538+
58539+static void gr_log_end(int audit)
58540+{
58541+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58542+ unsigned int len = strlen(buf);
58543+
58544+ snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
58545+ printk("%s\n", buf);
58546+
58547+ return;
58548+}
58549+
58550+void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
58551+{
58552+ int logtype;
58553+ char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
58554+ char *str1 = NULL, *str2 = NULL, *str3 = NULL;
58555+ void *voidptr = NULL;
58556+ int num1 = 0, num2 = 0;
58557+ unsigned long ulong1 = 0, ulong2 = 0;
58558+ struct dentry *dentry = NULL;
58559+ struct vfsmount *mnt = NULL;
58560+ struct file *file = NULL;
58561+ struct task_struct *task = NULL;
58562+ const struct cred *cred, *pcred;
58563+ va_list ap;
58564+
58565+ BEGIN_LOCKS(audit);
58566+ logtype = gr_log_start(audit);
58567+ if (logtype == FLOODING) {
58568+ END_LOCKS(audit);
58569+ return;
58570+ }
58571+ va_start(ap, argtypes);
58572+ switch (argtypes) {
58573+ case GR_TTYSNIFF:
58574+ task = va_arg(ap, struct task_struct *);
58575+ gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
58576+ break;
58577+ case GR_SYSCTL_HIDDEN:
58578+ str1 = va_arg(ap, char *);
58579+ gr_log_middle_varargs(audit, msg, result, str1);
58580+ break;
58581+ case GR_RBAC:
58582+ dentry = va_arg(ap, struct dentry *);
58583+ mnt = va_arg(ap, struct vfsmount *);
58584+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
58585+ break;
58586+ case GR_RBAC_STR:
58587+ dentry = va_arg(ap, struct dentry *);
58588+ mnt = va_arg(ap, struct vfsmount *);
58589+ str1 = va_arg(ap, char *);
58590+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
58591+ break;
58592+ case GR_STR_RBAC:
58593+ str1 = va_arg(ap, char *);
58594+ dentry = va_arg(ap, struct dentry *);
58595+ mnt = va_arg(ap, struct vfsmount *);
58596+ gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
58597+ break;
58598+ case GR_RBAC_MODE2:
58599+ dentry = va_arg(ap, struct dentry *);
58600+ mnt = va_arg(ap, struct vfsmount *);
58601+ str1 = va_arg(ap, char *);
58602+ str2 = va_arg(ap, char *);
58603+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
58604+ break;
58605+ case GR_RBAC_MODE3:
58606+ dentry = va_arg(ap, struct dentry *);
58607+ mnt = va_arg(ap, struct vfsmount *);
58608+ str1 = va_arg(ap, char *);
58609+ str2 = va_arg(ap, char *);
58610+ str3 = va_arg(ap, char *);
58611+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
58612+ break;
58613+ case GR_FILENAME:
58614+ dentry = va_arg(ap, struct dentry *);
58615+ mnt = va_arg(ap, struct vfsmount *);
58616+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
58617+ break;
58618+ case GR_STR_FILENAME:
58619+ str1 = va_arg(ap, char *);
58620+ dentry = va_arg(ap, struct dentry *);
58621+ mnt = va_arg(ap, struct vfsmount *);
58622+ gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
58623+ break;
58624+ case GR_FILENAME_STR:
58625+ dentry = va_arg(ap, struct dentry *);
58626+ mnt = va_arg(ap, struct vfsmount *);
58627+ str1 = va_arg(ap, char *);
58628+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
58629+ break;
58630+ case GR_FILENAME_TWO_INT:
58631+ dentry = va_arg(ap, struct dentry *);
58632+ mnt = va_arg(ap, struct vfsmount *);
58633+ num1 = va_arg(ap, int);
58634+ num2 = va_arg(ap, int);
58635+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
58636+ break;
58637+ case GR_FILENAME_TWO_INT_STR:
58638+ dentry = va_arg(ap, struct dentry *);
58639+ mnt = va_arg(ap, struct vfsmount *);
58640+ num1 = va_arg(ap, int);
58641+ num2 = va_arg(ap, int);
58642+ str1 = va_arg(ap, char *);
58643+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
58644+ break;
58645+ case GR_TEXTREL:
58646+ file = va_arg(ap, struct file *);
58647+ ulong1 = va_arg(ap, unsigned long);
58648+ ulong2 = va_arg(ap, unsigned long);
58649+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
58650+ break;
58651+ case GR_PTRACE:
58652+ task = va_arg(ap, struct task_struct *);
58653+ gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
58654+ break;
58655+ case GR_RESOURCE:
58656+ task = va_arg(ap, struct task_struct *);
58657+ cred = __task_cred(task);
58658+ pcred = __task_cred(task->real_parent);
58659+ ulong1 = va_arg(ap, unsigned long);
58660+ str1 = va_arg(ap, char *);
58661+ ulong2 = va_arg(ap, unsigned long);
58662+ gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58663+ break;
58664+ case GR_CAP:
58665+ task = va_arg(ap, struct task_struct *);
58666+ cred = __task_cred(task);
58667+ pcred = __task_cred(task->real_parent);
58668+ str1 = va_arg(ap, char *);
58669+ gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58670+ break;
58671+ case GR_SIG:
58672+ str1 = va_arg(ap, char *);
58673+ voidptr = va_arg(ap, void *);
58674+ gr_log_middle_varargs(audit, msg, str1, voidptr);
58675+ break;
58676+ case GR_SIG2:
58677+ task = va_arg(ap, struct task_struct *);
58678+ cred = __task_cred(task);
58679+ pcred = __task_cred(task->real_parent);
58680+ num1 = va_arg(ap, int);
58681+ gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58682+ break;
58683+ case GR_CRASH1:
58684+ task = va_arg(ap, struct task_struct *);
58685+ cred = __task_cred(task);
58686+ pcred = __task_cred(task->real_parent);
58687+ ulong1 = va_arg(ap, unsigned long);
58688+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
58689+ break;
58690+ case GR_CRASH2:
58691+ task = va_arg(ap, struct task_struct *);
58692+ cred = __task_cred(task);
58693+ pcred = __task_cred(task->real_parent);
58694+ ulong1 = va_arg(ap, unsigned long);
58695+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
58696+ break;
58697+ case GR_RWXMAP:
58698+ file = va_arg(ap, struct file *);
58699+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
58700+ break;
58701+ case GR_PSACCT:
58702+ {
58703+ unsigned int wday, cday;
58704+ __u8 whr, chr;
58705+ __u8 wmin, cmin;
58706+ __u8 wsec, csec;
58707+ char cur_tty[64] = { 0 };
58708+ char parent_tty[64] = { 0 };
58709+
58710+ task = va_arg(ap, struct task_struct *);
58711+ wday = va_arg(ap, unsigned int);
58712+ cday = va_arg(ap, unsigned int);
58713+ whr = va_arg(ap, int);
58714+ chr = va_arg(ap, int);
58715+ wmin = va_arg(ap, int);
58716+ cmin = va_arg(ap, int);
58717+ wsec = va_arg(ap, int);
58718+ csec = va_arg(ap, int);
58719+ ulong1 = va_arg(ap, unsigned long);
58720+ cred = __task_cred(task);
58721+ pcred = __task_cred(task->real_parent);
58722+
58723+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58724+ }
58725+ break;
58726+ default:
58727+ gr_log_middle(audit, msg, ap);
58728+ }
58729+ va_end(ap);
58730+ gr_log_end(audit);
58731+ END_LOCKS(audit);
58732+}
58733diff -urNp linux-2.6.39.1/grsecurity/grsec_mem.c linux-2.6.39.1/grsecurity/grsec_mem.c
58734--- linux-2.6.39.1/grsecurity/grsec_mem.c 1969-12-31 19:00:00.000000000 -0500
58735+++ linux-2.6.39.1/grsecurity/grsec_mem.c 2011-05-22 19:41:42.000000000 -0400
58736@@ -0,0 +1,33 @@
58737+#include <linux/kernel.h>
58738+#include <linux/sched.h>
58739+#include <linux/mm.h>
58740+#include <linux/mman.h>
58741+#include <linux/grinternal.h>
58742+
58743+void
58744+gr_handle_ioperm(void)
58745+{
58746+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
58747+ return;
58748+}
58749+
58750+void
58751+gr_handle_iopl(void)
58752+{
58753+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
58754+ return;
58755+}
58756+
58757+void
58758+gr_handle_mem_readwrite(u64 from, u64 to)
58759+{
58760+ gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
58761+ return;
58762+}
58763+
58764+void
58765+gr_handle_vm86(void)
58766+{
58767+ gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
58768+ return;
58769+}
58770diff -urNp linux-2.6.39.1/grsecurity/grsec_mount.c linux-2.6.39.1/grsecurity/grsec_mount.c
58771--- linux-2.6.39.1/grsecurity/grsec_mount.c 1969-12-31 19:00:00.000000000 -0500
58772+++ linux-2.6.39.1/grsecurity/grsec_mount.c 2011-05-22 19:41:42.000000000 -0400
58773@@ -0,0 +1,62 @@
58774+#include <linux/kernel.h>
58775+#include <linux/sched.h>
58776+#include <linux/mount.h>
58777+#include <linux/grsecurity.h>
58778+#include <linux/grinternal.h>
58779+
58780+void
58781+gr_log_remount(const char *devname, const int retval)
58782+{
58783+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58784+ if (grsec_enable_mount && (retval >= 0))
58785+ gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
58786+#endif
58787+ return;
58788+}
58789+
58790+void
58791+gr_log_unmount(const char *devname, const int retval)
58792+{
58793+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58794+ if (grsec_enable_mount && (retval >= 0))
58795+ gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
58796+#endif
58797+ return;
58798+}
58799+
58800+void
58801+gr_log_mount(const char *from, const char *to, const int retval)
58802+{
58803+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58804+ if (grsec_enable_mount && (retval >= 0))
58805+ gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from, to);
58806+#endif
58807+ return;
58808+}
58809+
58810+int
58811+gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
58812+{
58813+#ifdef CONFIG_GRKERNSEC_ROFS
58814+ if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
58815+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
58816+ return -EPERM;
58817+ } else
58818+ return 0;
58819+#endif
58820+ return 0;
58821+}
58822+
58823+int
58824+gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
58825+{
58826+#ifdef CONFIG_GRKERNSEC_ROFS
58827+ if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
58828+ dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
58829+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
58830+ return -EPERM;
58831+ } else
58832+ return 0;
58833+#endif
58834+ return 0;
58835+}
58836diff -urNp linux-2.6.39.1/grsecurity/grsec_pax.c linux-2.6.39.1/grsecurity/grsec_pax.c
58837--- linux-2.6.39.1/grsecurity/grsec_pax.c 1969-12-31 19:00:00.000000000 -0500
58838+++ linux-2.6.39.1/grsecurity/grsec_pax.c 2011-05-22 19:41:42.000000000 -0400
58839@@ -0,0 +1,36 @@
58840+#include <linux/kernel.h>
58841+#include <linux/sched.h>
58842+#include <linux/mm.h>
58843+#include <linux/file.h>
58844+#include <linux/grinternal.h>
58845+#include <linux/grsecurity.h>
58846+
58847+void
58848+gr_log_textrel(struct vm_area_struct * vma)
58849+{
58850+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
58851+ if (grsec_enable_audit_textrel)
58852+ gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
58853+#endif
58854+ return;
58855+}
58856+
58857+void
58858+gr_log_rwxmmap(struct file *file)
58859+{
58860+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58861+ if (grsec_enable_log_rwxmaps)
58862+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
58863+#endif
58864+ return;
58865+}
58866+
58867+void
58868+gr_log_rwxmprotect(struct file *file)
58869+{
58870+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58871+ if (grsec_enable_log_rwxmaps)
58872+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
58873+#endif
58874+ return;
58875+}
58876diff -urNp linux-2.6.39.1/grsecurity/grsec_ptrace.c linux-2.6.39.1/grsecurity/grsec_ptrace.c
58877--- linux-2.6.39.1/grsecurity/grsec_ptrace.c 1969-12-31 19:00:00.000000000 -0500
58878+++ linux-2.6.39.1/grsecurity/grsec_ptrace.c 2011-05-22 19:41:42.000000000 -0400
58879@@ -0,0 +1,14 @@
58880+#include <linux/kernel.h>
58881+#include <linux/sched.h>
58882+#include <linux/grinternal.h>
58883+#include <linux/grsecurity.h>
58884+
58885+void
58886+gr_audit_ptrace(struct task_struct *task)
58887+{
58888+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
58889+ if (grsec_enable_audit_ptrace)
58890+ gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
58891+#endif
58892+ return;
58893+}
58894diff -urNp linux-2.6.39.1/grsecurity/grsec_sig.c linux-2.6.39.1/grsecurity/grsec_sig.c
58895--- linux-2.6.39.1/grsecurity/grsec_sig.c 1969-12-31 19:00:00.000000000 -0500
58896+++ linux-2.6.39.1/grsecurity/grsec_sig.c 2011-05-22 19:41:42.000000000 -0400
58897@@ -0,0 +1,203 @@
58898+#include <linux/kernel.h>
58899+#include <linux/sched.h>
58900+#include <linux/delay.h>
58901+#include <linux/grsecurity.h>
58902+#include <linux/grinternal.h>
58903+#include <linux/hardirq.h>
58904+
58905+char *signames[] = {
58906+ [SIGSEGV] = "Segmentation fault",
58907+ [SIGILL] = "Illegal instruction",
58908+ [SIGABRT] = "Abort",
58909+ [SIGBUS] = "Invalid alignment/Bus error"
58910+};
58911+
58912+void
58913+gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
58914+{
58915+#ifdef CONFIG_GRKERNSEC_SIGNAL
58916+ if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
58917+ (sig == SIGABRT) || (sig == SIGBUS))) {
58918+ if (t->pid == current->pid) {
58919+ gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
58920+ } else {
58921+ gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
58922+ }
58923+ }
58924+#endif
58925+ return;
58926+}
58927+
58928+int
58929+gr_handle_signal(const struct task_struct *p, const int sig)
58930+{
58931+#ifdef CONFIG_GRKERNSEC
58932+ if (current->pid > 1 && gr_check_protected_task(p)) {
58933+ gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
58934+ return -EPERM;
58935+ } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
58936+ return -EPERM;
58937+ }
58938+#endif
58939+ return 0;
58940+}
58941+
58942+#ifdef CONFIG_GRKERNSEC
58943+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
58944+
58945+int gr_fake_force_sig(int sig, struct task_struct *t)
58946+{
58947+ unsigned long int flags;
58948+ int ret, blocked, ignored;
58949+ struct k_sigaction *action;
58950+
58951+ spin_lock_irqsave(&t->sighand->siglock, flags);
58952+ action = &t->sighand->action[sig-1];
58953+ ignored = action->sa.sa_handler == SIG_IGN;
58954+ blocked = sigismember(&t->blocked, sig);
58955+ if (blocked || ignored) {
58956+ action->sa.sa_handler = SIG_DFL;
58957+ if (blocked) {
58958+ sigdelset(&t->blocked, sig);
58959+ recalc_sigpending_and_wake(t);
58960+ }
58961+ }
58962+ if (action->sa.sa_handler == SIG_DFL)
58963+ t->signal->flags &= ~SIGNAL_UNKILLABLE;
58964+ ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
58965+
58966+ spin_unlock_irqrestore(&t->sighand->siglock, flags);
58967+
58968+ return ret;
58969+}
58970+#endif
58971+
58972+#ifdef CONFIG_GRKERNSEC_BRUTE
58973+#define GR_USER_BAN_TIME (15 * 60)
58974+
58975+static int __get_dumpable(unsigned long mm_flags)
58976+{
58977+ int ret;
58978+
58979+ ret = mm_flags & MMF_DUMPABLE_MASK;
58980+ return (ret >= 2) ? 2 : ret;
58981+}
58982+#endif
58983+
58984+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
58985+{
58986+#ifdef CONFIG_GRKERNSEC_BRUTE
58987+ uid_t uid = 0;
58988+
58989+ rcu_read_lock();
58990+ read_lock(&tasklist_lock);
58991+ read_lock(&grsec_exec_file_lock);
58992+ if (p->real_parent && p->real_parent->exec_file == p->exec_file)
58993+ p->real_parent->brute = 1;
58994+ else {
58995+ const struct cred *cred = __task_cred(p), *cred2;
58996+ struct task_struct *tsk, *tsk2;
58997+
58998+ if (!__get_dumpable(mm_flags) && cred->uid) {
58999+ struct user_struct *user;
59000+
59001+ uid = cred->uid;
59002+
59003+ /* this is put upon execution past expiration */
59004+ user = find_user(uid);
59005+ if (user == NULL)
59006+ goto unlock;
59007+ user->banned = 1;
59008+ user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
59009+ if (user->ban_expires == ~0UL)
59010+ user->ban_expires--;
59011+
59012+ do_each_thread(tsk2, tsk) {
59013+ cred2 = __task_cred(tsk);
59014+ if (tsk != p && cred2->uid == uid)
59015+ gr_fake_force_sig(SIGKILL, tsk);
59016+ } while_each_thread(tsk2, tsk);
59017+ }
59018+ }
59019+unlock:
59020+ read_unlock(&grsec_exec_file_lock);
59021+ read_unlock(&tasklist_lock);
59022+ rcu_read_unlock();
59023+
59024+ if (uid)
59025+ printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
59026+
59027+#endif
59028+ return;
59029+}
59030+
59031+void gr_handle_brute_check(void)
59032+{
59033+#ifdef CONFIG_GRKERNSEC_BRUTE
59034+ if (current->brute)
59035+ msleep(30 * 1000);
59036+#endif
59037+ return;
59038+}
59039+
59040+void gr_handle_kernel_exploit(void)
59041+{
59042+#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
59043+ const struct cred *cred;
59044+ struct task_struct *tsk, *tsk2;
59045+ struct user_struct *user;
59046+ uid_t uid;
59047+
59048+ if (in_irq() || in_serving_softirq() || in_nmi())
59049+ panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
59050+
59051+ uid = current_uid();
59052+
59053+ if (uid == 0)
59054+ panic("grsec: halting the system due to suspicious kernel crash caused by root");
59055+ else {
59056+ /* kill all the processes of this user, hold a reference
59057+ to their creds struct, and prevent them from creating
59058+ another process until system reset
59059+ */
59060+ printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
59061+ /* we intentionally leak this ref */
59062+ user = get_uid(current->cred->user);
59063+ if (user) {
59064+ user->banned = 1;
59065+ user->ban_expires = ~0UL;
59066+ }
59067+
59068+ read_lock(&tasklist_lock);
59069+ do_each_thread(tsk2, tsk) {
59070+ cred = __task_cred(tsk);
59071+ if (cred->uid == uid)
59072+ gr_fake_force_sig(SIGKILL, tsk);
59073+ } while_each_thread(tsk2, tsk);
59074+ read_unlock(&tasklist_lock);
59075+ }
59076+#endif
59077+}
59078+
59079+int __gr_process_user_ban(struct user_struct *user)
59080+{
59081+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
59082+ if (unlikely(user->banned)) {
59083+ if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
59084+ user->banned = 0;
59085+ user->ban_expires = 0;
59086+ free_uid(user);
59087+ } else
59088+ return -EPERM;
59089+ }
59090+#endif
59091+ return 0;
59092+}
59093+
59094+int gr_process_user_ban(void)
59095+{
59096+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
59097+ return __gr_process_user_ban(current->cred->user);
59098+#endif
59099+ return 0;
59100+}
59101diff -urNp linux-2.6.39.1/grsecurity/grsec_sock.c linux-2.6.39.1/grsecurity/grsec_sock.c
59102--- linux-2.6.39.1/grsecurity/grsec_sock.c 1969-12-31 19:00:00.000000000 -0500
59103+++ linux-2.6.39.1/grsecurity/grsec_sock.c 2011-05-22 20:29:21.000000000 -0400
59104@@ -0,0 +1,244 @@
59105+#include <linux/kernel.h>
59106+#include <linux/module.h>
59107+#include <linux/sched.h>
59108+#include <linux/file.h>
59109+#include <linux/net.h>
59110+#include <linux/in.h>
59111+#include <linux/ip.h>
59112+#include <net/sock.h>
59113+#include <net/inet_sock.h>
59114+#include <linux/grsecurity.h>
59115+#include <linux/grinternal.h>
59116+#include <linux/gracl.h>
59117+
59118+extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
59119+extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
59120+
59121+EXPORT_SYMBOL(gr_search_udp_recvmsg);
59122+EXPORT_SYMBOL(gr_search_udp_sendmsg);
59123+
59124+#ifdef CONFIG_UNIX_MODULE
59125+EXPORT_SYMBOL(gr_acl_handle_unix);
59126+EXPORT_SYMBOL(gr_acl_handle_mknod);
59127+EXPORT_SYMBOL(gr_handle_chroot_unix);
59128+EXPORT_SYMBOL(gr_handle_create);
59129+#endif
59130+
59131+#ifdef CONFIG_GRKERNSEC
59132+#define gr_conn_table_size 32749
59133+struct conn_table_entry {
59134+ struct conn_table_entry *next;
59135+ struct signal_struct *sig;
59136+};
59137+
59138+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
59139+DEFINE_SPINLOCK(gr_conn_table_lock);
59140+
59141+extern const char * gr_socktype_to_name(unsigned char type);
59142+extern const char * gr_proto_to_name(unsigned char proto);
59143+extern const char * gr_sockfamily_to_name(unsigned char family);
59144+
59145+static __inline__ int
59146+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
59147+{
59148+ return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
59149+}
59150+
59151+static __inline__ int
59152+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
59153+ __u16 sport, __u16 dport)
59154+{
59155+ if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
59156+ sig->gr_sport == sport && sig->gr_dport == dport))
59157+ return 1;
59158+ else
59159+ return 0;
59160+}
59161+
59162+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
59163+{
59164+ struct conn_table_entry **match;
59165+ unsigned int index;
59166+
59167+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
59168+ sig->gr_sport, sig->gr_dport,
59169+ gr_conn_table_size);
59170+
59171+ newent->sig = sig;
59172+
59173+ match = &gr_conn_table[index];
59174+ newent->next = *match;
59175+ *match = newent;
59176+
59177+ return;
59178+}
59179+
59180+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
59181+{
59182+ struct conn_table_entry *match, *last = NULL;
59183+ unsigned int index;
59184+
59185+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
59186+ sig->gr_sport, sig->gr_dport,
59187+ gr_conn_table_size);
59188+
59189+ match = gr_conn_table[index];
59190+ while (match && !conn_match(match->sig,
59191+ sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
59192+ sig->gr_dport)) {
59193+ last = match;
59194+ match = match->next;
59195+ }
59196+
59197+ if (match) {
59198+ if (last)
59199+ last->next = match->next;
59200+ else
59201+ gr_conn_table[index] = NULL;
59202+ kfree(match);
59203+ }
59204+
59205+ return;
59206+}
59207+
59208+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
59209+ __u16 sport, __u16 dport)
59210+{
59211+ struct conn_table_entry *match;
59212+ unsigned int index;
59213+
59214+ index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
59215+
59216+ match = gr_conn_table[index];
59217+ while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
59218+ match = match->next;
59219+
59220+ if (match)
59221+ return match->sig;
59222+ else
59223+ return NULL;
59224+}
59225+
59226+#endif
59227+
59228+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
59229+{
59230+#ifdef CONFIG_GRKERNSEC
59231+ struct signal_struct *sig = task->signal;
59232+ struct conn_table_entry *newent;
59233+
59234+ newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
59235+ if (newent == NULL)
59236+ return;
59237+ /* no bh lock needed since we are called with bh disabled */
59238+ spin_lock(&gr_conn_table_lock);
59239+ gr_del_task_from_ip_table_nolock(sig);
59240+ sig->gr_saddr = inet->inet_rcv_saddr;
59241+ sig->gr_daddr = inet->inet_daddr;
59242+ sig->gr_sport = inet->inet_sport;
59243+ sig->gr_dport = inet->inet_dport;
59244+ gr_add_to_task_ip_table_nolock(sig, newent);
59245+ spin_unlock(&gr_conn_table_lock);
59246+#endif
59247+ return;
59248+}
59249+
59250+void gr_del_task_from_ip_table(struct task_struct *task)
59251+{
59252+#ifdef CONFIG_GRKERNSEC
59253+ spin_lock_bh(&gr_conn_table_lock);
59254+ gr_del_task_from_ip_table_nolock(task->signal);
59255+ spin_unlock_bh(&gr_conn_table_lock);
59256+#endif
59257+ return;
59258+}
59259+
59260+void
59261+gr_attach_curr_ip(const struct sock *sk)
59262+{
59263+#ifdef CONFIG_GRKERNSEC
59264+ struct signal_struct *p, *set;
59265+ const struct inet_sock *inet = inet_sk(sk);
59266+
59267+ if (unlikely(sk->sk_protocol != IPPROTO_TCP))
59268+ return;
59269+
59270+ set = current->signal;
59271+
59272+ spin_lock_bh(&gr_conn_table_lock);
59273+ p = gr_lookup_task_ip_table(inet->inet_daddr, inet->inet_rcv_saddr,
59274+ inet->inet_dport, inet->inet_sport);
59275+ if (unlikely(p != NULL)) {
59276+ set->curr_ip = p->curr_ip;
59277+ set->used_accept = 1;
59278+ gr_del_task_from_ip_table_nolock(p);
59279+ spin_unlock_bh(&gr_conn_table_lock);
59280+ return;
59281+ }
59282+ spin_unlock_bh(&gr_conn_table_lock);
59283+
59284+ set->curr_ip = inet->inet_daddr;
59285+ set->used_accept = 1;
59286+#endif
59287+ return;
59288+}
59289+
59290+int
59291+gr_handle_sock_all(const int family, const int type, const int protocol)
59292+{
59293+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59294+ if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
59295+ (family != AF_UNIX)) {
59296+ if (family == AF_INET)
59297+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
59298+ else
59299+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
59300+ return -EACCES;
59301+ }
59302+#endif
59303+ return 0;
59304+}
59305+
59306+int
59307+gr_handle_sock_server(const struct sockaddr *sck)
59308+{
59309+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59310+ if (grsec_enable_socket_server &&
59311+ in_group_p(grsec_socket_server_gid) &&
59312+ sck && (sck->sa_family != AF_UNIX) &&
59313+ (sck->sa_family != AF_LOCAL)) {
59314+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
59315+ return -EACCES;
59316+ }
59317+#endif
59318+ return 0;
59319+}
59320+
59321+int
59322+gr_handle_sock_server_other(const struct sock *sck)
59323+{
59324+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59325+ if (grsec_enable_socket_server &&
59326+ in_group_p(grsec_socket_server_gid) &&
59327+ sck && (sck->sk_family != AF_UNIX) &&
59328+ (sck->sk_family != AF_LOCAL)) {
59329+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
59330+ return -EACCES;
59331+ }
59332+#endif
59333+ return 0;
59334+}
59335+
59336+int
59337+gr_handle_sock_client(const struct sockaddr *sck)
59338+{
59339+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59340+ if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
59341+ sck && (sck->sa_family != AF_UNIX) &&
59342+ (sck->sa_family != AF_LOCAL)) {
59343+ gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
59344+ return -EACCES;
59345+ }
59346+#endif
59347+ return 0;
59348+}
59349diff -urNp linux-2.6.39.1/grsecurity/grsec_sysctl.c linux-2.6.39.1/grsecurity/grsec_sysctl.c
59350--- linux-2.6.39.1/grsecurity/grsec_sysctl.c 1969-12-31 19:00:00.000000000 -0500
59351+++ linux-2.6.39.1/grsecurity/grsec_sysctl.c 2011-05-22 19:41:42.000000000 -0400
59352@@ -0,0 +1,433 @@
59353+#include <linux/kernel.h>
59354+#include <linux/sched.h>
59355+#include <linux/sysctl.h>
59356+#include <linux/grsecurity.h>
59357+#include <linux/grinternal.h>
59358+
59359+int
59360+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
59361+{
59362+#ifdef CONFIG_GRKERNSEC_SYSCTL
59363+ if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
59364+ gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
59365+ return -EACCES;
59366+ }
59367+#endif
59368+ return 0;
59369+}
59370+
59371+#ifdef CONFIG_GRKERNSEC_ROFS
59372+static int __maybe_unused one = 1;
59373+#endif
59374+
59375+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
59376+struct ctl_table grsecurity_table[] = {
59377+#ifdef CONFIG_GRKERNSEC_SYSCTL
59378+#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
59379+#ifdef CONFIG_GRKERNSEC_IO
59380+ {
59381+ .procname = "disable_priv_io",
59382+ .data = &grsec_disable_privio,
59383+ .maxlen = sizeof(int),
59384+ .mode = 0600,
59385+ .proc_handler = &proc_dointvec,
59386+ },
59387+#endif
59388+#endif
59389+#ifdef CONFIG_GRKERNSEC_LINK
59390+ {
59391+ .procname = "linking_restrictions",
59392+ .data = &grsec_enable_link,
59393+ .maxlen = sizeof(int),
59394+ .mode = 0600,
59395+ .proc_handler = &proc_dointvec,
59396+ },
59397+#endif
59398+#ifdef CONFIG_GRKERNSEC_FIFO
59399+ {
59400+ .procname = "fifo_restrictions",
59401+ .data = &grsec_enable_fifo,
59402+ .maxlen = sizeof(int),
59403+ .mode = 0600,
59404+ .proc_handler = &proc_dointvec,
59405+ },
59406+#endif
59407+#ifdef CONFIG_GRKERNSEC_EXECVE
59408+ {
59409+ .procname = "execve_limiting",
59410+ .data = &grsec_enable_execve,
59411+ .maxlen = sizeof(int),
59412+ .mode = 0600,
59413+ .proc_handler = &proc_dointvec,
59414+ },
59415+#endif
59416+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
59417+ {
59418+ .procname = "ip_blackhole",
59419+ .data = &grsec_enable_blackhole,
59420+ .maxlen = sizeof(int),
59421+ .mode = 0600,
59422+ .proc_handler = &proc_dointvec,
59423+ },
59424+ {
59425+ .procname = "lastack_retries",
59426+ .data = &grsec_lastack_retries,
59427+ .maxlen = sizeof(int),
59428+ .mode = 0600,
59429+ .proc_handler = &proc_dointvec,
59430+ },
59431+#endif
59432+#ifdef CONFIG_GRKERNSEC_EXECLOG
59433+ {
59434+ .procname = "exec_logging",
59435+ .data = &grsec_enable_execlog,
59436+ .maxlen = sizeof(int),
59437+ .mode = 0600,
59438+ .proc_handler = &proc_dointvec,
59439+ },
59440+#endif
59441+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
59442+ {
59443+ .procname = "rwxmap_logging",
59444+ .data = &grsec_enable_log_rwxmaps,
59445+ .maxlen = sizeof(int),
59446+ .mode = 0600,
59447+ .proc_handler = &proc_dointvec,
59448+ },
59449+#endif
59450+#ifdef CONFIG_GRKERNSEC_SIGNAL
59451+ {
59452+ .procname = "signal_logging",
59453+ .data = &grsec_enable_signal,
59454+ .maxlen = sizeof(int),
59455+ .mode = 0600,
59456+ .proc_handler = &proc_dointvec,
59457+ },
59458+#endif
59459+#ifdef CONFIG_GRKERNSEC_FORKFAIL
59460+ {
59461+ .procname = "forkfail_logging",
59462+ .data = &grsec_enable_forkfail,
59463+ .maxlen = sizeof(int),
59464+ .mode = 0600,
59465+ .proc_handler = &proc_dointvec,
59466+ },
59467+#endif
59468+#ifdef CONFIG_GRKERNSEC_TIME
59469+ {
59470+ .procname = "timechange_logging",
59471+ .data = &grsec_enable_time,
59472+ .maxlen = sizeof(int),
59473+ .mode = 0600,
59474+ .proc_handler = &proc_dointvec,
59475+ },
59476+#endif
59477+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
59478+ {
59479+ .procname = "chroot_deny_shmat",
59480+ .data = &grsec_enable_chroot_shmat,
59481+ .maxlen = sizeof(int),
59482+ .mode = 0600,
59483+ .proc_handler = &proc_dointvec,
59484+ },
59485+#endif
59486+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
59487+ {
59488+ .procname = "chroot_deny_unix",
59489+ .data = &grsec_enable_chroot_unix,
59490+ .maxlen = sizeof(int),
59491+ .mode = 0600,
59492+ .proc_handler = &proc_dointvec,
59493+ },
59494+#endif
59495+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
59496+ {
59497+ .procname = "chroot_deny_mount",
59498+ .data = &grsec_enable_chroot_mount,
59499+ .maxlen = sizeof(int),
59500+ .mode = 0600,
59501+ .proc_handler = &proc_dointvec,
59502+ },
59503+#endif
59504+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
59505+ {
59506+ .procname = "chroot_deny_fchdir",
59507+ .data = &grsec_enable_chroot_fchdir,
59508+ .maxlen = sizeof(int),
59509+ .mode = 0600,
59510+ .proc_handler = &proc_dointvec,
59511+ },
59512+#endif
59513+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
59514+ {
59515+ .procname = "chroot_deny_chroot",
59516+ .data = &grsec_enable_chroot_double,
59517+ .maxlen = sizeof(int),
59518+ .mode = 0600,
59519+ .proc_handler = &proc_dointvec,
59520+ },
59521+#endif
59522+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
59523+ {
59524+ .procname = "chroot_deny_pivot",
59525+ .data = &grsec_enable_chroot_pivot,
59526+ .maxlen = sizeof(int),
59527+ .mode = 0600,
59528+ .proc_handler = &proc_dointvec,
59529+ },
59530+#endif
59531+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
59532+ {
59533+ .procname = "chroot_enforce_chdir",
59534+ .data = &grsec_enable_chroot_chdir,
59535+ .maxlen = sizeof(int),
59536+ .mode = 0600,
59537+ .proc_handler = &proc_dointvec,
59538+ },
59539+#endif
59540+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
59541+ {
59542+ .procname = "chroot_deny_chmod",
59543+ .data = &grsec_enable_chroot_chmod,
59544+ .maxlen = sizeof(int),
59545+ .mode = 0600,
59546+ .proc_handler = &proc_dointvec,
59547+ },
59548+#endif
59549+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
59550+ {
59551+ .procname = "chroot_deny_mknod",
59552+ .data = &grsec_enable_chroot_mknod,
59553+ .maxlen = sizeof(int),
59554+ .mode = 0600,
59555+ .proc_handler = &proc_dointvec,
59556+ },
59557+#endif
59558+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
59559+ {
59560+ .procname = "chroot_restrict_nice",
59561+ .data = &grsec_enable_chroot_nice,
59562+ .maxlen = sizeof(int),
59563+ .mode = 0600,
59564+ .proc_handler = &proc_dointvec,
59565+ },
59566+#endif
59567+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
59568+ {
59569+ .procname = "chroot_execlog",
59570+ .data = &grsec_enable_chroot_execlog,
59571+ .maxlen = sizeof(int),
59572+ .mode = 0600,
59573+ .proc_handler = &proc_dointvec,
59574+ },
59575+#endif
59576+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
59577+ {
59578+ .procname = "chroot_caps",
59579+ .data = &grsec_enable_chroot_caps,
59580+ .maxlen = sizeof(int),
59581+ .mode = 0600,
59582+ .proc_handler = &proc_dointvec,
59583+ },
59584+#endif
59585+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
59586+ {
59587+ .procname = "chroot_deny_sysctl",
59588+ .data = &grsec_enable_chroot_sysctl,
59589+ .maxlen = sizeof(int),
59590+ .mode = 0600,
59591+ .proc_handler = &proc_dointvec,
59592+ },
59593+#endif
59594+#ifdef CONFIG_GRKERNSEC_TPE
59595+ {
59596+ .procname = "tpe",
59597+ .data = &grsec_enable_tpe,
59598+ .maxlen = sizeof(int),
59599+ .mode = 0600,
59600+ .proc_handler = &proc_dointvec,
59601+ },
59602+ {
59603+ .procname = "tpe_gid",
59604+ .data = &grsec_tpe_gid,
59605+ .maxlen = sizeof(int),
59606+ .mode = 0600,
59607+ .proc_handler = &proc_dointvec,
59608+ },
59609+#endif
59610+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59611+ {
59612+ .procname = "tpe_invert",
59613+ .data = &grsec_enable_tpe_invert,
59614+ .maxlen = sizeof(int),
59615+ .mode = 0600,
59616+ .proc_handler = &proc_dointvec,
59617+ },
59618+#endif
59619+#ifdef CONFIG_GRKERNSEC_TPE_ALL
59620+ {
59621+ .procname = "tpe_restrict_all",
59622+ .data = &grsec_enable_tpe_all,
59623+ .maxlen = sizeof(int),
59624+ .mode = 0600,
59625+ .proc_handler = &proc_dointvec,
59626+ },
59627+#endif
59628+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59629+ {
59630+ .procname = "socket_all",
59631+ .data = &grsec_enable_socket_all,
59632+ .maxlen = sizeof(int),
59633+ .mode = 0600,
59634+ .proc_handler = &proc_dointvec,
59635+ },
59636+ {
59637+ .procname = "socket_all_gid",
59638+ .data = &grsec_socket_all_gid,
59639+ .maxlen = sizeof(int),
59640+ .mode = 0600,
59641+ .proc_handler = &proc_dointvec,
59642+ },
59643+#endif
59644+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59645+ {
59646+ .procname = "socket_client",
59647+ .data = &grsec_enable_socket_client,
59648+ .maxlen = sizeof(int),
59649+ .mode = 0600,
59650+ .proc_handler = &proc_dointvec,
59651+ },
59652+ {
59653+ .procname = "socket_client_gid",
59654+ .data = &grsec_socket_client_gid,
59655+ .maxlen = sizeof(int),
59656+ .mode = 0600,
59657+ .proc_handler = &proc_dointvec,
59658+ },
59659+#endif
59660+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59661+ {
59662+ .procname = "socket_server",
59663+ .data = &grsec_enable_socket_server,
59664+ .maxlen = sizeof(int),
59665+ .mode = 0600,
59666+ .proc_handler = &proc_dointvec,
59667+ },
59668+ {
59669+ .procname = "socket_server_gid",
59670+ .data = &grsec_socket_server_gid,
59671+ .maxlen = sizeof(int),
59672+ .mode = 0600,
59673+ .proc_handler = &proc_dointvec,
59674+ },
59675+#endif
59676+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
59677+ {
59678+ .procname = "audit_group",
59679+ .data = &grsec_enable_group,
59680+ .maxlen = sizeof(int),
59681+ .mode = 0600,
59682+ .proc_handler = &proc_dointvec,
59683+ },
59684+ {
59685+ .procname = "audit_gid",
59686+ .data = &grsec_audit_gid,
59687+ .maxlen = sizeof(int),
59688+ .mode = 0600,
59689+ .proc_handler = &proc_dointvec,
59690+ },
59691+#endif
59692+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
59693+ {
59694+ .procname = "audit_chdir",
59695+ .data = &grsec_enable_chdir,
59696+ .maxlen = sizeof(int),
59697+ .mode = 0600,
59698+ .proc_handler = &proc_dointvec,
59699+ },
59700+#endif
59701+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59702+ {
59703+ .procname = "audit_mount",
59704+ .data = &grsec_enable_mount,
59705+ .maxlen = sizeof(int),
59706+ .mode = 0600,
59707+ .proc_handler = &proc_dointvec,
59708+ },
59709+#endif
59710+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
59711+ {
59712+ .procname = "audit_textrel",
59713+ .data = &grsec_enable_audit_textrel,
59714+ .maxlen = sizeof(int),
59715+ .mode = 0600,
59716+ .proc_handler = &proc_dointvec,
59717+ },
59718+#endif
59719+#ifdef CONFIG_GRKERNSEC_DMESG
59720+ {
59721+ .procname = "dmesg",
59722+ .data = &grsec_enable_dmesg,
59723+ .maxlen = sizeof(int),
59724+ .mode = 0600,
59725+ .proc_handler = &proc_dointvec,
59726+ },
59727+#endif
59728+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
59729+ {
59730+ .procname = "chroot_findtask",
59731+ .data = &grsec_enable_chroot_findtask,
59732+ .maxlen = sizeof(int),
59733+ .mode = 0600,
59734+ .proc_handler = &proc_dointvec,
59735+ },
59736+#endif
59737+#ifdef CONFIG_GRKERNSEC_RESLOG
59738+ {
59739+ .procname = "resource_logging",
59740+ .data = &grsec_resource_logging,
59741+ .maxlen = sizeof(int),
59742+ .mode = 0600,
59743+ .proc_handler = &proc_dointvec,
59744+ },
59745+#endif
59746+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
59747+ {
59748+ .procname = "audit_ptrace",
59749+ .data = &grsec_enable_audit_ptrace,
59750+ .maxlen = sizeof(int),
59751+ .mode = 0600,
59752+ .proc_handler = &proc_dointvec,
59753+ },
59754+#endif
59755+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
59756+ {
59757+ .procname = "harden_ptrace",
59758+ .data = &grsec_enable_harden_ptrace,
59759+ .maxlen = sizeof(int),
59760+ .mode = 0600,
59761+ .proc_handler = &proc_dointvec,
59762+ },
59763+#endif
59764+ {
59765+ .procname = "grsec_lock",
59766+ .data = &grsec_lock,
59767+ .maxlen = sizeof(int),
59768+ .mode = 0600,
59769+ .proc_handler = &proc_dointvec,
59770+ },
59771+#endif
59772+#ifdef CONFIG_GRKERNSEC_ROFS
59773+ {
59774+ .procname = "romount_protect",
59775+ .data = &grsec_enable_rofs,
59776+ .maxlen = sizeof(int),
59777+ .mode = 0600,
59778+ .proc_handler = &proc_dointvec_minmax,
59779+ .extra1 = &one,
59780+ .extra2 = &one,
59781+ },
59782+#endif
59783+ { }
59784+};
59785+#endif
59786diff -urNp linux-2.6.39.1/grsecurity/grsec_time.c linux-2.6.39.1/grsecurity/grsec_time.c
59787--- linux-2.6.39.1/grsecurity/grsec_time.c 1969-12-31 19:00:00.000000000 -0500
59788+++ linux-2.6.39.1/grsecurity/grsec_time.c 2011-05-22 19:41:42.000000000 -0400
59789@@ -0,0 +1,16 @@
59790+#include <linux/kernel.h>
59791+#include <linux/sched.h>
59792+#include <linux/grinternal.h>
59793+#include <linux/module.h>
59794+
59795+void
59796+gr_log_timechange(void)
59797+{
59798+#ifdef CONFIG_GRKERNSEC_TIME
59799+ if (grsec_enable_time)
59800+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
59801+#endif
59802+ return;
59803+}
59804+
59805+EXPORT_SYMBOL(gr_log_timechange);
59806diff -urNp linux-2.6.39.1/grsecurity/grsec_tpe.c linux-2.6.39.1/grsecurity/grsec_tpe.c
59807--- linux-2.6.39.1/grsecurity/grsec_tpe.c 1969-12-31 19:00:00.000000000 -0500
59808+++ linux-2.6.39.1/grsecurity/grsec_tpe.c 2011-05-22 19:41:42.000000000 -0400
59809@@ -0,0 +1,39 @@
59810+#include <linux/kernel.h>
59811+#include <linux/sched.h>
59812+#include <linux/file.h>
59813+#include <linux/fs.h>
59814+#include <linux/grinternal.h>
59815+
59816+extern int gr_acl_tpe_check(void);
59817+
59818+int
59819+gr_tpe_allow(const struct file *file)
59820+{
59821+#ifdef CONFIG_GRKERNSEC
59822+ struct inode *inode = file->f_path.dentry->d_parent->d_inode;
59823+ const struct cred *cred = current_cred();
59824+
59825+ if (cred->uid && ((grsec_enable_tpe &&
59826+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59827+ ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) ||
59828+ (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid)))
59829+#else
59830+ in_group_p(grsec_tpe_gid)
59831+#endif
59832+ ) || gr_acl_tpe_check()) &&
59833+ (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
59834+ (inode->i_mode & S_IWOTH))))) {
59835+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
59836+ return 0;
59837+ }
59838+#ifdef CONFIG_GRKERNSEC_TPE_ALL
59839+ if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
59840+ ((inode->i_uid && (inode->i_uid != cred->uid)) ||
59841+ (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
59842+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
59843+ return 0;
59844+ }
59845+#endif
59846+#endif
59847+ return 1;
59848+}
59849diff -urNp linux-2.6.39.1/grsecurity/grsum.c linux-2.6.39.1/grsecurity/grsum.c
59850--- linux-2.6.39.1/grsecurity/grsum.c 1969-12-31 19:00:00.000000000 -0500
59851+++ linux-2.6.39.1/grsecurity/grsum.c 2011-05-22 19:41:42.000000000 -0400
59852@@ -0,0 +1,61 @@
59853+#include <linux/err.h>
59854+#include <linux/kernel.h>
59855+#include <linux/sched.h>
59856+#include <linux/mm.h>
59857+#include <linux/scatterlist.h>
59858+#include <linux/crypto.h>
59859+#include <linux/gracl.h>
59860+
59861+
59862+#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
59863+#error "crypto and sha256 must be built into the kernel"
59864+#endif
59865+
59866+int
59867+chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
59868+{
59869+ char *p;
59870+ struct crypto_hash *tfm;
59871+ struct hash_desc desc;
59872+ struct scatterlist sg;
59873+ unsigned char temp_sum[GR_SHA_LEN];
59874+ volatile int retval = 0;
59875+ volatile int dummy = 0;
59876+ unsigned int i;
59877+
59878+ sg_init_table(&sg, 1);
59879+
59880+ tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
59881+ if (IS_ERR(tfm)) {
59882+ /* should never happen, since sha256 should be built in */
59883+ return 1;
59884+ }
59885+
59886+ desc.tfm = tfm;
59887+ desc.flags = 0;
59888+
59889+ crypto_hash_init(&desc);
59890+
59891+ p = salt;
59892+ sg_set_buf(&sg, p, GR_SALT_LEN);
59893+ crypto_hash_update(&desc, &sg, sg.length);
59894+
59895+ p = entry->pw;
59896+ sg_set_buf(&sg, p, strlen(p));
59897+
59898+ crypto_hash_update(&desc, &sg, sg.length);
59899+
59900+ crypto_hash_final(&desc, temp_sum);
59901+
59902+ memset(entry->pw, 0, GR_PW_LEN);
59903+
59904+ for (i = 0; i < GR_SHA_LEN; i++)
59905+ if (sum[i] != temp_sum[i])
59906+ retval = 1;
59907+ else
59908+ dummy = 1; // waste a cycle
59909+
59910+ crypto_free_hash(tfm);
59911+
59912+ return retval;
59913+}
59914diff -urNp linux-2.6.39.1/grsecurity/Kconfig linux-2.6.39.1/grsecurity/Kconfig
59915--- linux-2.6.39.1/grsecurity/Kconfig 1969-12-31 19:00:00.000000000 -0500
59916+++ linux-2.6.39.1/grsecurity/Kconfig 2011-05-22 19:41:42.000000000 -0400
59917@@ -0,0 +1,1045 @@
59918+#
59919+# grecurity configuration
59920+#
59921+
59922+menu "Grsecurity"
59923+
59924+config GRKERNSEC
59925+ bool "Grsecurity"
59926+ select CRYPTO
59927+ select CRYPTO_SHA256
59928+ help
59929+ If you say Y here, you will be able to configure many features
59930+ that will enhance the security of your system. It is highly
59931+ recommended that you say Y here and read through the help
59932+ for each option so that you fully understand the features and
59933+ can evaluate their usefulness for your machine.
59934+
59935+choice
59936+ prompt "Security Level"
59937+ depends on GRKERNSEC
59938+ default GRKERNSEC_CUSTOM
59939+
59940+config GRKERNSEC_LOW
59941+ bool "Low"
59942+ select GRKERNSEC_LINK
59943+ select GRKERNSEC_FIFO
59944+ select GRKERNSEC_EXECVE
59945+ select GRKERNSEC_RANDNET
59946+ select GRKERNSEC_DMESG
59947+ select GRKERNSEC_CHROOT
59948+ select GRKERNSEC_CHROOT_CHDIR
59949+
59950+ help
59951+ If you choose this option, several of the grsecurity options will
59952+ be enabled that will give you greater protection against a number
59953+ of attacks, while assuring that none of your software will have any
59954+ conflicts with the additional security measures. If you run a lot
59955+ of unusual software, or you are having problems with the higher
59956+ security levels, you should say Y here. With this option, the
59957+ following features are enabled:
59958+
59959+ - Linking restrictions
59960+ - FIFO restrictions
59961+ - Enforcing RLIMIT_NPROC on execve
59962+ - Restricted dmesg
59963+ - Enforced chdir("/") on chroot
59964+ - Runtime module disabling
59965+
59966+config GRKERNSEC_MEDIUM
59967+ bool "Medium"
59968+ select PAX
59969+ select PAX_EI_PAX
59970+ select PAX_PT_PAX_FLAGS
59971+ select PAX_HAVE_ACL_FLAGS
59972+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
59973+ select GRKERNSEC_CHROOT
59974+ select GRKERNSEC_CHROOT_SYSCTL
59975+ select GRKERNSEC_LINK
59976+ select GRKERNSEC_FIFO
59977+ select GRKERNSEC_EXECVE
59978+ select GRKERNSEC_DMESG
59979+ select GRKERNSEC_RANDNET
59980+ select GRKERNSEC_FORKFAIL
59981+ select GRKERNSEC_TIME
59982+ select GRKERNSEC_SIGNAL
59983+ select GRKERNSEC_CHROOT
59984+ select GRKERNSEC_CHROOT_UNIX
59985+ select GRKERNSEC_CHROOT_MOUNT
59986+ select GRKERNSEC_CHROOT_PIVOT
59987+ select GRKERNSEC_CHROOT_DOUBLE
59988+ select GRKERNSEC_CHROOT_CHDIR
59989+ select GRKERNSEC_CHROOT_MKNOD
59990+ select GRKERNSEC_PROC
59991+ select GRKERNSEC_PROC_USERGROUP
59992+ select PAX_RANDUSTACK
59993+ select PAX_ASLR
59994+ select PAX_RANDMMAP
59995+ select PAX_REFCOUNT if (X86 || SPARC64)
59996+ select PAX_USERCOPY if ((X86 || SPARC32 || SPARC64 || PPC) && (SLAB || SLUB || SLOB))
59997+
59998+ help
59999+ If you say Y here, several features in addition to those included
60000+ in the low additional security level will be enabled. These
60001+ features provide even more security to your system, though in rare
60002+ cases they may be incompatible with very old or poorly written
60003+ software. If you enable this option, make sure that your auth
60004+ service (identd) is running as gid 1001. With this option,
60005+ the following features (in addition to those provided in the
60006+ low additional security level) will be enabled:
60007+
60008+ - Failed fork logging
60009+ - Time change logging
60010+ - Signal logging
60011+ - Deny mounts in chroot
60012+ - Deny double chrooting
60013+ - Deny sysctl writes in chroot
60014+ - Deny mknod in chroot
60015+ - Deny access to abstract AF_UNIX sockets out of chroot
60016+ - Deny pivot_root in chroot
60017+ - Denied writes of /dev/kmem, /dev/mem, and /dev/port
60018+ - /proc restrictions with special GID set to 10 (usually wheel)
60019+ - Address Space Layout Randomization (ASLR)
60020+ - Prevent exploitation of most refcount overflows
60021+ - Bounds checking of copying between the kernel and userland
60022+
60023+config GRKERNSEC_HIGH
60024+ bool "High"
60025+ select GRKERNSEC_LINK
60026+ select GRKERNSEC_FIFO
60027+ select GRKERNSEC_EXECVE
60028+ select GRKERNSEC_DMESG
60029+ select GRKERNSEC_FORKFAIL
60030+ select GRKERNSEC_TIME
60031+ select GRKERNSEC_SIGNAL
60032+ select GRKERNSEC_CHROOT
60033+ select GRKERNSEC_CHROOT_SHMAT
60034+ select GRKERNSEC_CHROOT_UNIX
60035+ select GRKERNSEC_CHROOT_MOUNT
60036+ select GRKERNSEC_CHROOT_FCHDIR
60037+ select GRKERNSEC_CHROOT_PIVOT
60038+ select GRKERNSEC_CHROOT_DOUBLE
60039+ select GRKERNSEC_CHROOT_CHDIR
60040+ select GRKERNSEC_CHROOT_MKNOD
60041+ select GRKERNSEC_CHROOT_CAPS
60042+ select GRKERNSEC_CHROOT_SYSCTL
60043+ select GRKERNSEC_CHROOT_FINDTASK
60044+ select GRKERNSEC_SYSFS_RESTRICT
60045+ select GRKERNSEC_PROC
60046+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
60047+ select GRKERNSEC_HIDESYM
60048+ select GRKERNSEC_BRUTE
60049+ select GRKERNSEC_PROC_USERGROUP
60050+ select GRKERNSEC_KMEM
60051+ select GRKERNSEC_RESLOG
60052+ select GRKERNSEC_RANDNET
60053+ select GRKERNSEC_PROC_ADD
60054+ select GRKERNSEC_CHROOT_CHMOD
60055+ select GRKERNSEC_CHROOT_NICE
60056+ select GRKERNSEC_AUDIT_MOUNT
60057+ select GRKERNSEC_MODHARDEN if (MODULES)
60058+ select GRKERNSEC_HARDEN_PTRACE
60059+ select GRKERNSEC_VM86 if (X86_32)
60060+ select GRKERNSEC_KERN_LOCKOUT if (X86)
60061+ select PAX
60062+ select PAX_RANDUSTACK
60063+ select PAX_ASLR
60064+ select PAX_RANDMMAP
60065+ select PAX_NOEXEC
60066+ select PAX_MPROTECT
60067+ select PAX_EI_PAX
60068+ select PAX_PT_PAX_FLAGS
60069+ select PAX_HAVE_ACL_FLAGS
60070+ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
60071+ select PAX_MEMORY_UDEREF if (X86 && !XEN)
60072+ select PAX_RANDKSTACK if (X86_TSC && X86)
60073+ select PAX_SEGMEXEC if (X86_32)
60074+ select PAX_PAGEEXEC
60075+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64)
60076+ select PAX_EMUTRAMP if (PARISC)
60077+ select PAX_EMUSIGRT if (PARISC)
60078+ select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
60079+ select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
60080+ select PAX_REFCOUNT if (X86 || SPARC64)
60081+ select PAX_USERCOPY if ((X86 || PPC || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB))
60082+ help
60083+ If you say Y here, many of the features of grsecurity will be
60084+ enabled, which will protect you against many kinds of attacks
60085+ against your system. The heightened security comes at a cost
60086+ of an increased chance of incompatibilities with rare software
60087+ on your machine. Since this security level enables PaX, you should
60088+ view <http://pax.grsecurity.net> and read about the PaX
60089+ project. While you are there, download chpax and run it on
60090+ binaries that cause problems with PaX. Also remember that
60091+ since the /proc restrictions are enabled, you must run your
60092+ identd as gid 1001. This security level enables the following
60093+ features in addition to those listed in the low and medium
60094+ security levels:
60095+
60096+ - Additional /proc restrictions
60097+ - Chmod restrictions in chroot
60098+ - No signals, ptrace, or viewing of processes outside of chroot
60099+ - Capability restrictions in chroot
60100+ - Deny fchdir out of chroot
60101+ - Priority restrictions in chroot
60102+ - Segmentation-based implementation of PaX
60103+ - Mprotect restrictions
60104+ - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
60105+ - Kernel stack randomization
60106+ - Mount/unmount/remount logging
60107+ - Kernel symbol hiding
60108+ - Prevention of memory exhaustion-based exploits
60109+ - Hardening of module auto-loading
60110+ - Ptrace restrictions
60111+ - Restricted vm86 mode
60112+ - Restricted sysfs/debugfs
60113+ - Active kernel exploit response
60114+
60115+config GRKERNSEC_CUSTOM
60116+ bool "Custom"
60117+ help
60118+ If you say Y here, you will be able to configure every grsecurity
60119+ option, which allows you to enable many more features that aren't
60120+ covered in the basic security levels. These additional features
60121+ include TPE, socket restrictions, and the sysctl system for
60122+ grsecurity. It is advised that you read through the help for
60123+ each option to determine its usefulness in your situation.
60124+
60125+endchoice
60126+
60127+menu "Address Space Protection"
60128+depends on GRKERNSEC
60129+
60130+config GRKERNSEC_KMEM
60131+ bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
60132+ select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
60133+ help
60134+ If you say Y here, /dev/kmem and /dev/mem won't be allowed to
60135+ be written to via mmap or otherwise to modify the running kernel.
60136+ /dev/port will also not be allowed to be opened. If you have module
60137+ support disabled, enabling this will close up four ways that are
60138+ currently used to insert malicious code into the running kernel.
60139+ Even with all these features enabled, we still highly recommend that
60140+ you use the RBAC system, as it is still possible for an attacker to
60141+ modify the running kernel through privileged I/O granted by ioperm/iopl.
60142+ If you are not using XFree86, you may be able to stop this additional
60143+ case by enabling the 'Disable privileged I/O' option. Though nothing
60144+ legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
60145+ but only to video memory, which is the only writing we allow in this
60146+ case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
60147+ not be allowed to mprotect it with PROT_WRITE later.
60148+ It is highly recommended that you say Y here if you meet all the
60149+ conditions above.
60150+
60151+config GRKERNSEC_VM86
60152+ bool "Restrict VM86 mode"
60153+ depends on X86_32
60154+
60155+ help
60156+ If you say Y here, only processes with CAP_SYS_RAWIO will be able to
60157+ make use of a special execution mode on 32bit x86 processors called
60158+ Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
60159+ video cards and will still work with this option enabled. The purpose
60160+ of the option is to prevent exploitation of emulation errors in
60161+ virtualization of vm86 mode like the one discovered in VMWare in 2009.
60162+ Nearly all users should be able to enable this option.
60163+
60164+config GRKERNSEC_IO
60165+ bool "Disable privileged I/O"
60166+ depends on X86
60167+ select RTC_CLASS
60168+ select RTC_INTF_DEV
60169+ select RTC_DRV_CMOS
60170+
60171+ help
60172+ If you say Y here, all ioperm and iopl calls will return an error.
60173+ Ioperm and iopl can be used to modify the running kernel.
60174+ Unfortunately, some programs need this access to operate properly,
60175+ the most notable of which are XFree86 and hwclock. hwclock can be
60176+ remedied by having RTC support in the kernel, so real-time
60177+ clock support is enabled if this option is enabled, to ensure
60178+ that hwclock operates correctly. XFree86 still will not
60179+ operate correctly with this option enabled, so DO NOT CHOOSE Y
60180+ IF YOU USE XFree86. If you use XFree86 and you still want to
60181+ protect your kernel against modification, use the RBAC system.
60182+
60183+config GRKERNSEC_PROC_MEMMAP
60184+ bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
60185+ default y if (PAX_NOEXEC || PAX_ASLR)
60186+ depends on PAX_NOEXEC || PAX_ASLR
60187+ help
60188+ If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
60189+ give no information about the addresses of its mappings if
60190+ PaX features that rely on random addresses are enabled on the task.
60191+ If you use PaX it is greatly recommended that you say Y here as it
60192+ closes up a hole that makes the full ASLR useless for suid
60193+ binaries.
60194+
60195+config GRKERNSEC_BRUTE
60196+ bool "Deter exploit bruteforcing"
60197+ help
60198+ If you say Y here, attempts to bruteforce exploits against forking
60199+ daemons such as apache or sshd, as well as against suid/sgid binaries
60200+ will be deterred. When a child of a forking daemon is killed by PaX
60201+ or crashes due to an illegal instruction or other suspicious signal,
60202+ the parent process will be delayed 30 seconds upon every subsequent
60203+ fork until the administrator is able to assess the situation and
60204+ restart the daemon.
60205+ In the suid/sgid case, the attempt is logged, the user has all their
60206+ processes terminated, and they are prevented from executing any further
60207+ processes for 15 minutes.
60208+ It is recommended that you also enable signal logging in the auditing
60209+ section so that logs are generated when a process triggers a suspicious
60210+ signal.
60211+
60212+config GRKERNSEC_MODHARDEN
60213+ bool "Harden module auto-loading"
60214+ depends on MODULES
60215+ help
60216+ If you say Y here, module auto-loading in response to use of some
60217+ feature implemented by an unloaded module will be restricted to
60218+ root users. Enabling this option helps defend against attacks
60219+ by unprivileged users who abuse the auto-loading behavior to
60220+ cause a vulnerable module to load that is then exploited.
60221+
60222+ If this option prevents a legitimate use of auto-loading for a
60223+ non-root user, the administrator can execute modprobe manually
60224+ with the exact name of the module mentioned in the alert log.
60225+ Alternatively, the administrator can add the module to the list
60226+ of modules loaded at boot by modifying init scripts.
60227+
60228+ Modification of init scripts will most likely be needed on
60229+ Ubuntu servers with encrypted home directory support enabled,
60230+ as the first non-root user logging in will cause the ecb(aes),
60231+ ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
60232+
60233+config GRKERNSEC_HIDESYM
60234+ bool "Hide kernel symbols"
60235+ help
60236+ If you say Y here, getting information on loaded modules, and
60237+ displaying all kernel symbols through a syscall will be restricted
60238+ to users with CAP_SYS_MODULE. For software compatibility reasons,
60239+ /proc/kallsyms will be restricted to the root user. The RBAC
60240+ system can hide that entry even from root.
60241+
60242+ This option also prevents leaking of kernel addresses through
60243+ several /proc entries.
60244+
60245+ Note that this option is only effective provided the following
60246+ conditions are met:
60247+ 1) The kernel using grsecurity is not precompiled by some distribution
60248+ 2) You have also enabled GRKERNSEC_DMESG
60249+ 3) You are using the RBAC system and hiding other files such as your
60250+ kernel image and System.map. Alternatively, enabling this option
60251+ causes the permissions on /boot, /lib/modules, and the kernel
60252+ source directory to change at compile time to prevent
60253+ reading by non-root users.
60254+ If the above conditions are met, this option will aid in providing a
60255+ useful protection against local kernel exploitation of overflows
60256+ and arbitrary read/write vulnerabilities.
60257+
60258+config GRKERNSEC_KERN_LOCKOUT
60259+ bool "Active kernel exploit response"
60260+ depends on X86
60261+ help
60262+ If you say Y here, when a PaX alert is triggered due to suspicious
60263+ activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
60264+ or an OOPs occurs due to bad memory accesses, instead of just
60265+ terminating the offending process (and potentially allowing
60266+ a subsequent exploit from the same user), we will take one of two
60267+ actions:
60268+ If the user was root, we will panic the system
60269+ If the user was non-root, we will log the attempt, terminate
60270+ all processes owned by the user, then prevent them from creating
60271+ any new processes until the system is restarted
60272+ This deters repeated kernel exploitation/bruteforcing attempts
60273+ and is useful for later forensics.
60274+
60275+endmenu
60276+menu "Role Based Access Control Options"
60277+depends on GRKERNSEC
60278+
60279+config GRKERNSEC_RBAC_DEBUG
60280+ bool
60281+
60282+config GRKERNSEC_NO_RBAC
60283+ bool "Disable RBAC system"
60284+ help
60285+ If you say Y here, the /dev/grsec device will be removed from the kernel,
60286+ preventing the RBAC system from being enabled. You should only say Y
60287+ here if you have no intention of using the RBAC system, so as to prevent
60288+ an attacker with root access from misusing the RBAC system to hide files
60289+ and processes when loadable module support and /dev/[k]mem have been
60290+ locked down.
60291+
60292+config GRKERNSEC_ACL_HIDEKERN
60293+ bool "Hide kernel processes"
60294+ help
60295+ If you say Y here, all kernel threads will be hidden to all
60296+ processes but those whose subject has the "view hidden processes"
60297+ flag.
60298+
60299+config GRKERNSEC_ACL_MAXTRIES
60300+ int "Maximum tries before password lockout"
60301+ default 3
60302+ help
60303+ This option enforces the maximum number of times a user can attempt
60304+ to authorize themselves with the grsecurity RBAC system before being
60305+ denied the ability to attempt authorization again for a specified time.
60306+ The lower the number, the harder it will be to brute-force a password.
60307+
60308+config GRKERNSEC_ACL_TIMEOUT
60309+ int "Time to wait after max password tries, in seconds"
60310+ default 30
60311+ help
60312+ This option specifies the time the user must wait after attempting to
60313+ authorize to the RBAC system with the maximum number of invalid
60314+ passwords. The higher the number, the harder it will be to brute-force
60315+ a password.
60316+
60317+endmenu
60318+menu "Filesystem Protections"
60319+depends on GRKERNSEC
60320+
60321+config GRKERNSEC_PROC
60322+ bool "Proc restrictions"
60323+ help
60324+ If you say Y here, the permissions of the /proc filesystem
60325+ will be altered to enhance system security and privacy. You MUST
60326+ choose either a user only restriction or a user and group restriction.
60327+ Depending upon the option you choose, you can either restrict users to
60328+ see only the processes they themselves run, or choose a group that can
60329+ view all processes and files normally restricted to root if you choose
60330+ the "restrict to user only" option. NOTE: If you're running identd as
60331+ a non-root user, you will have to run it as the group you specify here.
60332+
60333+config GRKERNSEC_PROC_USER
60334+ bool "Restrict /proc to user only"
60335+ depends on GRKERNSEC_PROC
60336+ help
60337+ If you say Y here, non-root users will only be able to view their own
60338+ processes, and restricts them from viewing network-related information,
60339+ and viewing kernel symbol and module information.
60340+
60341+config GRKERNSEC_PROC_USERGROUP
60342+ bool "Allow special group"
60343+ depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
60344+ help
60345+ If you say Y here, you will be able to select a group that will be
60346+ able to view all processes and network-related information. If you've
60347+ enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
60348+ remain hidden. This option is useful if you want to run identd as
60349+ a non-root user.
60350+
60351+config GRKERNSEC_PROC_GID
60352+ int "GID for special group"
60353+ depends on GRKERNSEC_PROC_USERGROUP
60354+ default 1001
60355+
60356+config GRKERNSEC_PROC_ADD
60357+ bool "Additional restrictions"
60358+ depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
60359+ help
60360+ If you say Y here, additional restrictions will be placed on
60361+ /proc that keep normal users from viewing device information and
60362+ slabinfo information that could be useful for exploits.
60363+
60364+config GRKERNSEC_LINK
60365+ bool "Linking restrictions"
60366+ help
60367+ If you say Y here, /tmp race exploits will be prevented, since users
60368+ will no longer be able to follow symlinks owned by other users in
60369+ world-writable +t directories (e.g. /tmp), unless the owner of the
60370+ symlink is the owner of the directory. users will also not be
60371+ able to hardlink to files they do not own. If the sysctl option is
60372+ enabled, a sysctl option with name "linking_restrictions" is created.
60373+
60374+config GRKERNSEC_FIFO
60375+ bool "FIFO restrictions"
60376+ help
60377+ If you say Y here, users will not be able to write to FIFOs they don't
60378+ own in world-writable +t directories (e.g. /tmp), unless the owner of
60379+ the FIFO is the same owner of the directory it's held in. If the sysctl
60380+ option is enabled, a sysctl option with name "fifo_restrictions" is
60381+ created.
60382+
60383+config GRKERNSEC_SYSFS_RESTRICT
60384+ bool "Sysfs/debugfs restriction"
60385+ depends on SYSFS
60386+ help
60387+ If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
60388+ any filesystem normally mounted under it (e.g. debugfs) will only
60389+ be accessible by root. These filesystems generally provide access
60390+ to hardware and debug information that isn't appropriate for unprivileged
60391+ users of the system. Sysfs and debugfs have also become a large source
60392+ of new vulnerabilities, ranging from infoleaks to local compromise.
60393+ There has been very little oversight with an eye toward security involved
60394+ in adding new exporters of information to these filesystems, so their
60395+ use is discouraged.
60396+ This option is equivalent to a chmod 0700 of the mount paths.
60397+
60398+config GRKERNSEC_ROFS
60399+ bool "Runtime read-only mount protection"
60400+ help
60401+ If you say Y here, a sysctl option with name "romount_protect" will
60402+ be created. By setting this option to 1 at runtime, filesystems
60403+ will be protected in the following ways:
60404+ * No new writable mounts will be allowed
60405+ * Existing read-only mounts won't be able to be remounted read/write
60406+ * Write operations will be denied on all block devices
60407+ This option acts independently of grsec_lock: once it is set to 1,
60408+ it cannot be turned off. Therefore, please be mindful of the resulting
60409+ behavior if this option is enabled in an init script on a read-only
60410+ filesystem. This feature is mainly intended for secure embedded systems.
60411+
60412+config GRKERNSEC_CHROOT
60413+ bool "Chroot jail restrictions"
60414+ help
60415+ If you say Y here, you will be able to choose several options that will
60416+ make breaking out of a chrooted jail much more difficult. If you
60417+ encounter no software incompatibilities with the following options, it
60418+ is recommended that you enable each one.
60419+
60420+config GRKERNSEC_CHROOT_MOUNT
60421+ bool "Deny mounts"
60422+ depends on GRKERNSEC_CHROOT
60423+ help
60424+ If you say Y here, processes inside a chroot will not be able to
60425+ mount or remount filesystems. If the sysctl option is enabled, a
60426+ sysctl option with name "chroot_deny_mount" is created.
60427+
60428+config GRKERNSEC_CHROOT_DOUBLE
60429+ bool "Deny double-chroots"
60430+ depends on GRKERNSEC_CHROOT
60431+ help
60432+ If you say Y here, processes inside a chroot will not be able to chroot
60433+ again outside the chroot. This is a widely used method of breaking
60434+ out of a chroot jail and should not be allowed. If the sysctl
60435+ option is enabled, a sysctl option with name
60436+ "chroot_deny_chroot" is created.
60437+
60438+config GRKERNSEC_CHROOT_PIVOT
60439+ bool "Deny pivot_root in chroot"
60440+ depends on GRKERNSEC_CHROOT
60441+ help
60442+ If you say Y here, processes inside a chroot will not be able to use
60443+ a function called pivot_root() that was introduced in Linux 2.3.41. It
60444+ works similar to chroot in that it changes the root filesystem. This
60445+ function could be misused in a chrooted process to attempt to break out
60446+ of the chroot, and therefore should not be allowed. If the sysctl
60447+ option is enabled, a sysctl option with name "chroot_deny_pivot" is
60448+ created.
60449+
60450+config GRKERNSEC_CHROOT_CHDIR
60451+ bool "Enforce chdir(\"/\") on all chroots"
60452+ depends on GRKERNSEC_CHROOT
60453+ help
60454+ If you say Y here, the current working directory of all newly-chrooted
60455+ applications will be set to the the root directory of the chroot.
60456+ The man page on chroot(2) states:
60457+ Note that this call does not change the current working
60458+ directory, so that `.' can be outside the tree rooted at
60459+ `/'. In particular, the super-user can escape from a
60460+ `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
60461+
60462+ It is recommended that you say Y here, since it's not known to break
60463+ any software. If the sysctl option is enabled, a sysctl option with
60464+ name "chroot_enforce_chdir" is created.
60465+
60466+config GRKERNSEC_CHROOT_CHMOD
60467+ bool "Deny (f)chmod +s"
60468+ depends on GRKERNSEC_CHROOT
60469+ help
60470+ If you say Y here, processes inside a chroot will not be able to chmod
60471+ or fchmod files to make them have suid or sgid bits. This protects
60472+ against another published method of breaking a chroot. If the sysctl
60473+ option is enabled, a sysctl option with name "chroot_deny_chmod" is
60474+ created.
60475+
60476+config GRKERNSEC_CHROOT_FCHDIR
60477+ bool "Deny fchdir out of chroot"
60478+ depends on GRKERNSEC_CHROOT
60479+ help
60480+ If you say Y here, a well-known method of breaking chroots by fchdir'ing
60481+ to a file descriptor of the chrooting process that points to a directory
60482+ outside the filesystem will be stopped. If the sysctl option
60483+ is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
60484+
60485+config GRKERNSEC_CHROOT_MKNOD
60486+ bool "Deny mknod"
60487+ depends on GRKERNSEC_CHROOT
60488+ help
60489+ If you say Y here, processes inside a chroot will not be allowed to
60490+ mknod. The problem with using mknod inside a chroot is that it
60491+ would allow an attacker to create a device entry that is the same
60492+ as one on the physical root of your system, which could range from
60493+ anything from the console device to a device for your harddrive (which
60494+ they could then use to wipe the drive or steal data). It is recommended
60495+ that you say Y here, unless you run into software incompatibilities.
60496+ If the sysctl option is enabled, a sysctl option with name
60497+ "chroot_deny_mknod" is created.
60498+
60499+config GRKERNSEC_CHROOT_SHMAT
60500+ bool "Deny shmat() out of chroot"
60501+ depends on GRKERNSEC_CHROOT
60502+ help
60503+ If you say Y here, processes inside a chroot will not be able to attach
60504+ to shared memory segments that were created outside of the chroot jail.
60505+ It is recommended that you say Y here. If the sysctl option is enabled,
60506+ a sysctl option with name "chroot_deny_shmat" is created.
60507+
60508+config GRKERNSEC_CHROOT_UNIX
60509+ bool "Deny access to abstract AF_UNIX sockets out of chroot"
60510+ depends on GRKERNSEC_CHROOT
60511+ help
60512+ If you say Y here, processes inside a chroot will not be able to
60513+ connect to abstract (meaning not belonging to a filesystem) Unix
60514+ domain sockets that were bound outside of a chroot. It is recommended
60515+ that you say Y here. If the sysctl option is enabled, a sysctl option
60516+ with name "chroot_deny_unix" is created.
60517+
60518+config GRKERNSEC_CHROOT_FINDTASK
60519+ bool "Protect outside processes"
60520+ depends on GRKERNSEC_CHROOT
60521+ help
60522+ If you say Y here, processes inside a chroot will not be able to
60523+ kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
60524+ getsid, or view any process outside of the chroot. If the sysctl
60525+ option is enabled, a sysctl option with name "chroot_findtask" is
60526+ created.
60527+
60528+config GRKERNSEC_CHROOT_NICE
60529+ bool "Restrict priority changes"
60530+ depends on GRKERNSEC_CHROOT
60531+ help
60532+ If you say Y here, processes inside a chroot will not be able to raise
60533+ the priority of processes in the chroot, or alter the priority of
60534+ processes outside the chroot. This provides more security than simply
60535+ removing CAP_SYS_NICE from the process' capability set. If the
60536+ sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
60537+ is created.
60538+
60539+config GRKERNSEC_CHROOT_SYSCTL
60540+ bool "Deny sysctl writes"
60541+ depends on GRKERNSEC_CHROOT
60542+ help
60543+ If you say Y here, an attacker in a chroot will not be able to
60544+ write to sysctl entries, either by sysctl(2) or through a /proc
60545+ interface. It is strongly recommended that you say Y here. If the
60546+ sysctl option is enabled, a sysctl option with name
60547+ "chroot_deny_sysctl" is created.
60548+
60549+config GRKERNSEC_CHROOT_CAPS
60550+ bool "Capability restrictions"
60551+ depends on GRKERNSEC_CHROOT
60552+ help
60553+ If you say Y here, the capabilities on all root processes within a
60554+ chroot jail will be lowered to stop module insertion, raw i/o,
60555+ system and net admin tasks, rebooting the system, modifying immutable
60556+ files, modifying IPC owned by another, and changing the system time.
60557+ This is left an option because it can break some apps. Disable this
60558+ if your chrooted apps are having problems performing those kinds of
60559+ tasks. If the sysctl option is enabled, a sysctl option with
60560+ name "chroot_caps" is created.
60561+
60562+endmenu
60563+menu "Kernel Auditing"
60564+depends on GRKERNSEC
60565+
60566+config GRKERNSEC_AUDIT_GROUP
60567+ bool "Single group for auditing"
60568+ help
60569+ If you say Y here, the exec, chdir, and (un)mount logging features
60570+ will only operate on a group you specify. This option is recommended
60571+ if you only want to watch certain users instead of having a large
60572+ amount of logs from the entire system. If the sysctl option is enabled,
60573+ a sysctl option with name "audit_group" is created.
60574+
60575+config GRKERNSEC_AUDIT_GID
60576+ int "GID for auditing"
60577+ depends on GRKERNSEC_AUDIT_GROUP
60578+ default 1007
60579+
60580+config GRKERNSEC_EXECLOG
60581+ bool "Exec logging"
60582+ help
60583+ If you say Y here, all execve() calls will be logged (since the
60584+ other exec*() calls are frontends to execve(), all execution
60585+ will be logged). Useful for shell-servers that like to keep track
60586+ of their users. If the sysctl option is enabled, a sysctl option with
60587+ name "exec_logging" is created.
60588+ WARNING: This option when enabled will produce a LOT of logs, especially
60589+ on an active system.
60590+
60591+config GRKERNSEC_RESLOG
60592+ bool "Resource logging"
60593+ help
60594+ If you say Y here, all attempts to overstep resource limits will
60595+ be logged with the resource name, the requested size, and the current
60596+ limit. It is highly recommended that you say Y here. If the sysctl
60597+ option is enabled, a sysctl option with name "resource_logging" is
60598+ created. If the RBAC system is enabled, the sysctl value is ignored.
60599+
60600+config GRKERNSEC_CHROOT_EXECLOG
60601+ bool "Log execs within chroot"
60602+ help
60603+ If you say Y here, all executions inside a chroot jail will be logged
60604+ to syslog. This can cause a large amount of logs if certain
60605+ applications (eg. djb's daemontools) are installed on the system, and
60606+ is therefore left as an option. If the sysctl option is enabled, a
60607+ sysctl option with name "chroot_execlog" is created.
60608+
60609+config GRKERNSEC_AUDIT_PTRACE
60610+ bool "Ptrace logging"
60611+ help
60612+ If you say Y here, all attempts to attach to a process via ptrace
60613+ will be logged. If the sysctl option is enabled, a sysctl option
60614+ with name "audit_ptrace" is created.
60615+
60616+config GRKERNSEC_AUDIT_CHDIR
60617+ bool "Chdir logging"
60618+ help
60619+ If you say Y here, all chdir() calls will be logged. If the sysctl
60620+ option is enabled, a sysctl option with name "audit_chdir" is created.
60621+
60622+config GRKERNSEC_AUDIT_MOUNT
60623+ bool "(Un)Mount logging"
60624+ help
60625+ If you say Y here, all mounts and unmounts will be logged. If the
60626+ sysctl option is enabled, a sysctl option with name "audit_mount" is
60627+ created.
60628+
60629+config GRKERNSEC_SIGNAL
60630+ bool "Signal logging"
60631+ help
60632+ If you say Y here, certain important signals will be logged, such as
60633+ SIGSEGV, which will as a result inform you of when a error in a program
60634+ occurred, which in some cases could mean a possible exploit attempt.
60635+ If the sysctl option is enabled, a sysctl option with name
60636+ "signal_logging" is created.
60637+
60638+config GRKERNSEC_FORKFAIL
60639+ bool "Fork failure logging"
60640+ help
60641+ If you say Y here, all failed fork() attempts will be logged.
60642+ This could suggest a fork bomb, or someone attempting to overstep
60643+ their process limit. If the sysctl option is enabled, a sysctl option
60644+ with name "forkfail_logging" is created.
60645+
60646+config GRKERNSEC_TIME
60647+ bool "Time change logging"
60648+ help
60649+ If you say Y here, any changes of the system clock will be logged.
60650+ If the sysctl option is enabled, a sysctl option with name
60651+ "timechange_logging" is created.
60652+
60653+config GRKERNSEC_PROC_IPADDR
60654+ bool "/proc/<pid>/ipaddr support"
60655+ help
60656+ If you say Y here, a new entry will be added to each /proc/<pid>
60657+ directory that contains the IP address of the person using the task.
60658+ The IP is carried across local TCP and AF_UNIX stream sockets.
60659+ This information can be useful for IDS/IPSes to perform remote response
60660+ to a local attack. The entry is readable by only the owner of the
60661+ process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
60662+ the RBAC system), and thus does not create privacy concerns.
60663+
60664+config GRKERNSEC_RWXMAP_LOG
60665+ bool 'Denied RWX mmap/mprotect logging'
60666+ depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
60667+ help
60668+ If you say Y here, calls to mmap() and mprotect() with explicit
60669+ usage of PROT_WRITE and PROT_EXEC together will be logged when
60670+ denied by the PAX_MPROTECT feature. If the sysctl option is
60671+ enabled, a sysctl option with name "rwxmap_logging" is created.
60672+
60673+config GRKERNSEC_AUDIT_TEXTREL
60674+ bool 'ELF text relocations logging (READ HELP)'
60675+ depends on PAX_MPROTECT
60676+ help
60677+ If you say Y here, text relocations will be logged with the filename
60678+ of the offending library or binary. The purpose of the feature is
60679+ to help Linux distribution developers get rid of libraries and
60680+ binaries that need text relocations which hinder the future progress
60681+ of PaX. Only Linux distribution developers should say Y here, and
60682+ never on a production machine, as this option creates an information
60683+ leak that could aid an attacker in defeating the randomization of
60684+ a single memory region. If the sysctl option is enabled, a sysctl
60685+ option with name "audit_textrel" is created.
60686+
60687+endmenu
60688+
60689+menu "Executable Protections"
60690+depends on GRKERNSEC
60691+
60692+config GRKERNSEC_EXECVE
60693+ bool "Enforce RLIMIT_NPROC on execs"
60694+ help
60695+ If you say Y here, users with a resource limit on processes will
60696+ have the value checked during execve() calls. The current system
60697+ only checks the system limit during fork() calls. If the sysctl option
60698+ is enabled, a sysctl option with name "execve_limiting" is created.
60699+
60700+config GRKERNSEC_DMESG
60701+ bool "Dmesg(8) restriction"
60702+ help
60703+ If you say Y here, non-root users will not be able to use dmesg(8)
60704+ to view up to the last 4kb of messages in the kernel's log buffer.
60705+ The kernel's log buffer often contains kernel addresses and other
60706+ identifying information useful to an attacker in fingerprinting a
60707+ system for a targeted exploit.
60708+ If the sysctl option is enabled, a sysctl option with name "dmesg" is
60709+ created.
60710+
60711+config GRKERNSEC_HARDEN_PTRACE
60712+ bool "Deter ptrace-based process snooping"
60713+ help
60714+ If you say Y here, TTY sniffers and other malicious monitoring
60715+ programs implemented through ptrace will be defeated. If you
60716+ have been using the RBAC system, this option has already been
60717+ enabled for several years for all users, with the ability to make
60718+ fine-grained exceptions.
60719+
60720+ This option only affects the ability of non-root users to ptrace
60721+ processes that are not a descendent of the ptracing process.
60722+ This means that strace ./binary and gdb ./binary will still work,
60723+ but attaching to arbitrary processes will not. If the sysctl
60724+ option is enabled, a sysctl option with name "harden_ptrace" is
60725+ created.
60726+
60727+config GRKERNSEC_TPE
60728+ bool "Trusted Path Execution (TPE)"
60729+ help
60730+ If you say Y here, you will be able to choose a gid to add to the
60731+ supplementary groups of users you want to mark as "untrusted."
60732+ These users will not be able to execute any files that are not in
60733+ root-owned directories writable only by root. If the sysctl option
60734+ is enabled, a sysctl option with name "tpe" is created.
60735+
60736+config GRKERNSEC_TPE_ALL
60737+ bool "Partially restrict all non-root users"
60738+ depends on GRKERNSEC_TPE
60739+ help
60740+ If you say Y here, all non-root users will be covered under
60741+ a weaker TPE restriction. This is separate from, and in addition to,
60742+ the main TPE options that you have selected elsewhere. Thus, if a
60743+ "trusted" GID is chosen, this restriction applies to even that GID.
60744+ Under this restriction, all non-root users will only be allowed to
60745+ execute files in directories they own that are not group or
60746+ world-writable, or in directories owned by root and writable only by
60747+ root. If the sysctl option is enabled, a sysctl option with name
60748+ "tpe_restrict_all" is created.
60749+
60750+config GRKERNSEC_TPE_INVERT
60751+ bool "Invert GID option"
60752+ depends on GRKERNSEC_TPE
60753+ help
60754+ If you say Y here, the group you specify in the TPE configuration will
60755+ decide what group TPE restrictions will be *disabled* for. This
60756+ option is useful if you want TPE restrictions to be applied to most
60757+ users on the system. If the sysctl option is enabled, a sysctl option
60758+ with name "tpe_invert" is created. Unlike other sysctl options, this
60759+ entry will default to on for backward-compatibility.
60760+
60761+config GRKERNSEC_TPE_GID
60762+ int "GID for untrusted users"
60763+ depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
60764+ default 1005
60765+ help
60766+ Setting this GID determines what group TPE restrictions will be
60767+ *enabled* for. If the sysctl option is enabled, a sysctl option
60768+ with name "tpe_gid" is created.
60769+
60770+config GRKERNSEC_TPE_GID
60771+ int "GID for trusted users"
60772+ depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
60773+ default 1005
60774+ help
60775+ Setting this GID determines what group TPE restrictions will be
60776+ *disabled* for. If the sysctl option is enabled, a sysctl option
60777+ with name "tpe_gid" is created.
60778+
60779+endmenu
60780+menu "Network Protections"
60781+depends on GRKERNSEC
60782+
60783+config GRKERNSEC_RANDNET
60784+ bool "Larger entropy pools"
60785+ help
60786+ If you say Y here, the entropy pools used for many features of Linux
60787+ and grsecurity will be doubled in size. Since several grsecurity
60788+ features use additional randomness, it is recommended that you say Y
60789+ here. Saying Y here has a similar effect as modifying
60790+ /proc/sys/kernel/random/poolsize.
60791+
60792+config GRKERNSEC_BLACKHOLE
60793+ bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
60794+ help
60795+ If you say Y here, neither TCP resets nor ICMP
60796+ destination-unreachable packets will be sent in response to packets
60797+ sent to ports for which no associated listening process exists.
60798+ This feature supports both IPV4 and IPV6 and exempts the
60799+ loopback interface from blackholing. Enabling this feature
60800+ makes a host more resilient to DoS attacks and reduces network
60801+ visibility against scanners.
60802+
60803+ The blackhole feature as-implemented is equivalent to the FreeBSD
60804+ blackhole feature, as it prevents RST responses to all packets, not
60805+ just SYNs. Under most application behavior this causes no
60806+ problems, but applications (like haproxy) may not close certain
60807+ connections in a way that cleanly terminates them on the remote
60808+ end, leaving the remote host in LAST_ACK state. Because of this
60809+ side-effect and to prevent intentional LAST_ACK DoSes, this
60810+ feature also adds automatic mitigation against such attacks.
60811+ The mitigation drastically reduces the amount of time a socket
60812+ can spend in LAST_ACK state. If you're using haproxy and not
60813+ all servers it connects to have this option enabled, consider
60814+ disabling this feature on the haproxy host.
60815+
60816+ If the sysctl option is enabled, two sysctl options with names
60817+ "ip_blackhole" and "lastack_retries" will be created.
60818+ While "ip_blackhole" takes the standard zero/non-zero on/off
60819+ toggle, "lastack_retries" uses the same kinds of values as
60820+ "tcp_retries1" and "tcp_retries2". The default value of 4
60821+ prevents a socket from lasting more than 45 seconds in LAST_ACK
60822+ state.
60823+
60824+config GRKERNSEC_SOCKET
60825+ bool "Socket restrictions"
60826+ help
60827+ If you say Y here, you will be able to choose from several options.
60828+ If you assign a GID on your system and add it to the supplementary
60829+ groups of users you want to restrict socket access to, this patch
60830+ will perform up to three things, based on the option(s) you choose.
60831+
60832+config GRKERNSEC_SOCKET_ALL
60833+ bool "Deny any sockets to group"
60834+ depends on GRKERNSEC_SOCKET
60835+ help
60836+ If you say Y here, you will be able to choose a GID of whose users will
60837+ be unable to connect to other hosts from your machine or run server
60838+ applications from your machine. If the sysctl option is enabled, a
60839+ sysctl option with name "socket_all" is created.
60840+
60841+config GRKERNSEC_SOCKET_ALL_GID
60842+ int "GID to deny all sockets for"
60843+ depends on GRKERNSEC_SOCKET_ALL
60844+ default 1004
60845+ help
60846+ Here you can choose the GID to disable socket access for. Remember to
60847+ add the users you want socket access disabled for to the GID
60848+ specified here. If the sysctl option is enabled, a sysctl option
60849+ with name "socket_all_gid" is created.
60850+
60851+config GRKERNSEC_SOCKET_CLIENT
60852+ bool "Deny client sockets to group"
60853+ depends on GRKERNSEC_SOCKET
60854+ help
60855+ If you say Y here, you will be able to choose a GID of whose users will
60856+ be unable to connect to other hosts from your machine, but will be
60857+ able to run servers. If this option is enabled, all users in the group
60858+ you specify will have to use passive mode when initiating ftp transfers
60859+ from the shell on your machine. If the sysctl option is enabled, a
60860+ sysctl option with name "socket_client" is created.
60861+
60862+config GRKERNSEC_SOCKET_CLIENT_GID
60863+ int "GID to deny client sockets for"
60864+ depends on GRKERNSEC_SOCKET_CLIENT
60865+ default 1003
60866+ help
60867+ Here you can choose the GID to disable client socket access for.
60868+ Remember to add the users you want client socket access disabled for to
60869+ the GID specified here. If the sysctl option is enabled, a sysctl
60870+ option with name "socket_client_gid" is created.
60871+
60872+config GRKERNSEC_SOCKET_SERVER
60873+ bool "Deny server sockets to group"
60874+ depends on GRKERNSEC_SOCKET
60875+ help
60876+ If you say Y here, you will be able to choose a GID of whose users will
60877+ be unable to run server applications from your machine. If the sysctl
60878+ option is enabled, a sysctl option with name "socket_server" is created.
60879+
60880+config GRKERNSEC_SOCKET_SERVER_GID
60881+ int "GID to deny server sockets for"
60882+ depends on GRKERNSEC_SOCKET_SERVER
60883+ default 1002
60884+ help
60885+ Here you can choose the GID to disable server socket access for.
60886+ Remember to add the users you want server socket access disabled for to
60887+ the GID specified here. If the sysctl option is enabled, a sysctl
60888+ option with name "socket_server_gid" is created.
60889+
60890+endmenu
60891+menu "Sysctl support"
60892+depends on GRKERNSEC && SYSCTL
60893+
60894+config GRKERNSEC_SYSCTL
60895+ bool "Sysctl support"
60896+ help
60897+ If you say Y here, you will be able to change the options that
60898+ grsecurity runs with at bootup, without having to recompile your
60899+ kernel. You can echo values to files in /proc/sys/kernel/grsecurity
60900+ to enable (1) or disable (0) various features. All the sysctl entries
60901+ are mutable until the "grsec_lock" entry is set to a non-zero value.
60902+ All features enabled in the kernel configuration are disabled at boot
60903+ if you do not say Y to the "Turn on features by default" option.
60904+ All options should be set at startup, and the grsec_lock entry should
60905+ be set to a non-zero value after all the options are set.
60906+ *THIS IS EXTREMELY IMPORTANT*
60907+
60908+config GRKERNSEC_SYSCTL_DISTRO
60909+ bool "Extra sysctl support for distro makers (READ HELP)"
60910+ depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
60911+ help
60912+ If you say Y here, additional sysctl options will be created
60913+ for features that affect processes running as root. Therefore,
60914+ it is critical when using this option that the grsec_lock entry be
60915+ enabled after boot. Only distros with prebuilt kernel packages
60916+ with this option enabled that can ensure grsec_lock is enabled
60917+ after boot should use this option.
60918+ *Failure to set grsec_lock after boot makes all grsec features
60919+ this option covers useless*
60920+
60921+ Currently this option creates the following sysctl entries:
60922+ "Disable Privileged I/O": "disable_priv_io"
60923+
60924+config GRKERNSEC_SYSCTL_ON
60925+ bool "Turn on features by default"
60926+ depends on GRKERNSEC_SYSCTL
60927+ help
60928+ If you say Y here, instead of having all features enabled in the
60929+ kernel configuration disabled at boot time, the features will be
60930+ enabled at boot time. It is recommended you say Y here unless
60931+ there is some reason you would want all sysctl-tunable features to
60932+ be disabled by default. As mentioned elsewhere, it is important
60933+ to enable the grsec_lock entry once you have finished modifying
60934+ the sysctl entries.
60935+
60936+endmenu
60937+menu "Logging Options"
60938+depends on GRKERNSEC
60939+
60940+config GRKERNSEC_FLOODTIME
60941+ int "Seconds in between log messages (minimum)"
60942+ default 10
60943+ help
60944+ This option allows you to enforce the number of seconds between
60945+ grsecurity log messages. The default should be suitable for most
60946+ people, however, if you choose to change it, choose a value small enough
60947+ to allow informative logs to be produced, but large enough to
60948+ prevent flooding.
60949+
60950+config GRKERNSEC_FLOODBURST
60951+ int "Number of messages in a burst (maximum)"
60952+ default 4
60953+ help
60954+ This option allows you to choose the maximum number of messages allowed
60955+ within the flood time interval you chose in a separate option. The
60956+ default should be suitable for most people, however if you find that
60957+ many of your logs are being interpreted as flooding, you may want to
60958+ raise this value.
60959+
60960+endmenu
60961+
60962+endmenu
60963diff -urNp linux-2.6.39.1/grsecurity/Makefile linux-2.6.39.1/grsecurity/Makefile
60964--- linux-2.6.39.1/grsecurity/Makefile 1969-12-31 19:00:00.000000000 -0500
60965+++ linux-2.6.39.1/grsecurity/Makefile 2011-05-24 20:26:54.000000000 -0400
60966@@ -0,0 +1,33 @@
60967+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
60968+# during 2001-2009 it has been completely redesigned by Brad Spengler
60969+# into an RBAC system
60970+#
60971+# All code in this directory and various hooks inserted throughout the kernel
60972+# are copyright Brad Spengler - Open Source Security, Inc., and released
60973+# under the GPL v2 or higher
60974+
60975+obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
60976+ grsec_mount.o grsec_sig.o grsec_sock.o grsec_sysctl.o \
60977+ grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
60978+
60979+obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
60980+ gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
60981+ gracl_learn.o grsec_log.o
60982+obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
60983+
60984+ifdef CONFIG_NET
60985+obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
60986+endif
60987+
60988+ifndef CONFIG_GRKERNSEC
60989+obj-y += grsec_disabled.o
60990+endif
60991+
60992+ifdef CONFIG_GRKERNSEC_HIDESYM
60993+extra-y := grsec_hidesym.o
60994+$(obj)/grsec_hidesym.o:
60995+ @-chmod -f 500 /boot
60996+ @-chmod -f 500 /lib/modules
60997+ @-chmod -f 700 .
60998+ @echo ' grsec: protected kernel image paths'
60999+endif
61000diff -urNp linux-2.6.39.1/include/acpi/acpi_drivers.h linux-2.6.39.1/include/acpi/acpi_drivers.h
61001--- linux-2.6.39.1/include/acpi/acpi_drivers.h 2011-05-19 00:06:34.000000000 -0400
61002+++ linux-2.6.39.1/include/acpi/acpi_drivers.h 2011-05-22 19:36:32.000000000 -0400
61003@@ -119,8 +119,8 @@ void pci_acpi_crs_quirks(void);
61004 Dock Station
61005 -------------------------------------------------------------------------- */
61006 struct acpi_dock_ops {
61007- acpi_notify_handler handler;
61008- acpi_notify_handler uevent;
61009+ const acpi_notify_handler handler;
61010+ const acpi_notify_handler uevent;
61011 };
61012
61013 #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
61014@@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle ha
61015 extern int register_dock_notifier(struct notifier_block *nb);
61016 extern void unregister_dock_notifier(struct notifier_block *nb);
61017 extern int register_hotplug_dock_device(acpi_handle handle,
61018- struct acpi_dock_ops *ops,
61019+ const struct acpi_dock_ops *ops,
61020 void *context);
61021 extern void unregister_hotplug_dock_device(acpi_handle handle);
61022 #else
61023@@ -144,7 +144,7 @@ static inline void unregister_dock_notif
61024 {
61025 }
61026 static inline int register_hotplug_dock_device(acpi_handle handle,
61027- struct acpi_dock_ops *ops,
61028+ const struct acpi_dock_ops *ops,
61029 void *context)
61030 {
61031 return -ENODEV;
61032diff -urNp linux-2.6.39.1/include/acpi/processor.h linux-2.6.39.1/include/acpi/processor.h
61033--- linux-2.6.39.1/include/acpi/processor.h 2011-05-19 00:06:34.000000000 -0400
61034+++ linux-2.6.39.1/include/acpi/processor.h 2011-05-22 19:36:32.000000000 -0400
61035@@ -344,7 +344,7 @@ extern struct cpuidle_driver acpi_idle_d
61036
61037 /* in processor_thermal.c */
61038 int acpi_processor_get_limit_info(struct acpi_processor *pr);
61039-extern struct thermal_cooling_device_ops processor_cooling_ops;
61040+extern const struct thermal_cooling_device_ops processor_cooling_ops;
61041 #ifdef CONFIG_CPU_FREQ
61042 void acpi_thermal_cpufreq_init(void);
61043 void acpi_thermal_cpufreq_exit(void);
61044diff -urNp linux-2.6.39.1/include/asm-generic/atomic-long.h linux-2.6.39.1/include/asm-generic/atomic-long.h
61045--- linux-2.6.39.1/include/asm-generic/atomic-long.h 2011-05-19 00:06:34.000000000 -0400
61046+++ linux-2.6.39.1/include/asm-generic/atomic-long.h 2011-05-22 19:36:32.000000000 -0400
61047@@ -22,6 +22,12 @@
61048
61049 typedef atomic64_t atomic_long_t;
61050
61051+#ifdef CONFIG_PAX_REFCOUNT
61052+typedef atomic64_unchecked_t atomic_long_unchecked_t;
61053+#else
61054+typedef atomic64_t atomic_long_unchecked_t;
61055+#endif
61056+
61057 #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
61058
61059 static inline long atomic_long_read(atomic_long_t *l)
61060@@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
61061 return (long)atomic64_read(v);
61062 }
61063
61064+#ifdef CONFIG_PAX_REFCOUNT
61065+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
61066+{
61067+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61068+
61069+ return (long)atomic64_read_unchecked(v);
61070+}
61071+#endif
61072+
61073 static inline void atomic_long_set(atomic_long_t *l, long i)
61074 {
61075 atomic64_t *v = (atomic64_t *)l;
61076@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
61077 atomic64_set(v, i);
61078 }
61079
61080+#ifdef CONFIG_PAX_REFCOUNT
61081+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
61082+{
61083+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61084+
61085+ atomic64_set_unchecked(v, i);
61086+}
61087+#endif
61088+
61089 static inline void atomic_long_inc(atomic_long_t *l)
61090 {
61091 atomic64_t *v = (atomic64_t *)l;
61092@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
61093 atomic64_inc(v);
61094 }
61095
61096+#ifdef CONFIG_PAX_REFCOUNT
61097+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
61098+{
61099+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61100+
61101+ atomic64_inc_unchecked(v);
61102+}
61103+#endif
61104+
61105 static inline void atomic_long_dec(atomic_long_t *l)
61106 {
61107 atomic64_t *v = (atomic64_t *)l;
61108@@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomi
61109 atomic64_dec(v);
61110 }
61111
61112+#ifdef CONFIG_PAX_REFCOUNT
61113+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
61114+{
61115+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61116+
61117+ atomic64_dec_unchecked(v);
61118+}
61119+#endif
61120+
61121 static inline void atomic_long_add(long i, atomic_long_t *l)
61122 {
61123 atomic64_t *v = (atomic64_t *)l;
61124@@ -59,6 +101,15 @@ static inline void atomic_long_add(long
61125 atomic64_add(i, v);
61126 }
61127
61128+#ifdef CONFIG_PAX_REFCOUNT
61129+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
61130+{
61131+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61132+
61133+ atomic64_add_unchecked(i, v);
61134+}
61135+#endif
61136+
61137 static inline void atomic_long_sub(long i, atomic_long_t *l)
61138 {
61139 atomic64_t *v = (atomic64_t *)l;
61140@@ -66,6 +117,15 @@ static inline void atomic_long_sub(long
61141 atomic64_sub(i, v);
61142 }
61143
61144+#ifdef CONFIG_PAX_REFCOUNT
61145+static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
61146+{
61147+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61148+
61149+ atomic64_sub_unchecked(i, v);
61150+}
61151+#endif
61152+
61153 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
61154 {
61155 atomic64_t *v = (atomic64_t *)l;
61156@@ -115,6 +175,15 @@ static inline long atomic_long_inc_retur
61157 return (long)atomic64_inc_return(v);
61158 }
61159
61160+#ifdef CONFIG_PAX_REFCOUNT
61161+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
61162+{
61163+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61164+
61165+ return (long)atomic64_inc_return_unchecked(v);
61166+}
61167+#endif
61168+
61169 static inline long atomic_long_dec_return(atomic_long_t *l)
61170 {
61171 atomic64_t *v = (atomic64_t *)l;
61172@@ -140,6 +209,12 @@ static inline long atomic_long_add_unles
61173
61174 typedef atomic_t atomic_long_t;
61175
61176+#ifdef CONFIG_PAX_REFCOUNT
61177+typedef atomic_unchecked_t atomic_long_unchecked_t;
61178+#else
61179+typedef atomic_t atomic_long_unchecked_t;
61180+#endif
61181+
61182 #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
61183 static inline long atomic_long_read(atomic_long_t *l)
61184 {
61185@@ -148,6 +223,15 @@ static inline long atomic_long_read(atom
61186 return (long)atomic_read(v);
61187 }
61188
61189+#ifdef CONFIG_PAX_REFCOUNT
61190+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
61191+{
61192+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61193+
61194+ return (long)atomic_read_unchecked(v);
61195+}
61196+#endif
61197+
61198 static inline void atomic_long_set(atomic_long_t *l, long i)
61199 {
61200 atomic_t *v = (atomic_t *)l;
61201@@ -155,6 +239,15 @@ static inline void atomic_long_set(atomi
61202 atomic_set(v, i);
61203 }
61204
61205+#ifdef CONFIG_PAX_REFCOUNT
61206+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
61207+{
61208+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61209+
61210+ atomic_set_unchecked(v, i);
61211+}
61212+#endif
61213+
61214 static inline void atomic_long_inc(atomic_long_t *l)
61215 {
61216 atomic_t *v = (atomic_t *)l;
61217@@ -162,6 +255,15 @@ static inline void atomic_long_inc(atomi
61218 atomic_inc(v);
61219 }
61220
61221+#ifdef CONFIG_PAX_REFCOUNT
61222+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
61223+{
61224+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61225+
61226+ atomic_inc_unchecked(v);
61227+}
61228+#endif
61229+
61230 static inline void atomic_long_dec(atomic_long_t *l)
61231 {
61232 atomic_t *v = (atomic_t *)l;
61233@@ -169,6 +271,15 @@ static inline void atomic_long_dec(atomi
61234 atomic_dec(v);
61235 }
61236
61237+#ifdef CONFIG_PAX_REFCOUNT
61238+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
61239+{
61240+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61241+
61242+ atomic_dec_unchecked(v);
61243+}
61244+#endif
61245+
61246 static inline void atomic_long_add(long i, atomic_long_t *l)
61247 {
61248 atomic_t *v = (atomic_t *)l;
61249@@ -176,6 +287,15 @@ static inline void atomic_long_add(long
61250 atomic_add(i, v);
61251 }
61252
61253+#ifdef CONFIG_PAX_REFCOUNT
61254+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
61255+{
61256+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61257+
61258+ atomic_add_unchecked(i, v);
61259+}
61260+#endif
61261+
61262 static inline void atomic_long_sub(long i, atomic_long_t *l)
61263 {
61264 atomic_t *v = (atomic_t *)l;
61265@@ -183,6 +303,15 @@ static inline void atomic_long_sub(long
61266 atomic_sub(i, v);
61267 }
61268
61269+#ifdef CONFIG_PAX_REFCOUNT
61270+static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
61271+{
61272+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61273+
61274+ atomic_sub_unchecked(i, v);
61275+}
61276+#endif
61277+
61278 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
61279 {
61280 atomic_t *v = (atomic_t *)l;
61281@@ -232,6 +361,15 @@ static inline long atomic_long_inc_retur
61282 return (long)atomic_inc_return(v);
61283 }
61284
61285+#ifdef CONFIG_PAX_REFCOUNT
61286+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
61287+{
61288+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61289+
61290+ return (long)atomic_inc_return_unchecked(v);
61291+}
61292+#endif
61293+
61294 static inline long atomic_long_dec_return(atomic_long_t *l)
61295 {
61296 atomic_t *v = (atomic_t *)l;
61297@@ -255,4 +393,49 @@ static inline long atomic_long_add_unles
61298
61299 #endif /* BITS_PER_LONG == 64 */
61300
61301+#ifdef CONFIG_PAX_REFCOUNT
61302+static inline void pax_refcount_needs_these_functions(void)
61303+{
61304+ atomic_read_unchecked((atomic_unchecked_t *)NULL);
61305+ atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
61306+ atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
61307+ atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
61308+ atomic_inc_unchecked((atomic_unchecked_t *)NULL);
61309+ atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
61310+ atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
61311+ atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
61312+ atomic_dec_unchecked((atomic_unchecked_t *)NULL);
61313+ atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
61314+ atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
61315+
61316+ atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
61317+ atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
61318+ atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
61319+ atomic_long_sub_unchecked(0, (atomic_long_unchecked_t *)NULL);
61320+ atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
61321+ atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
61322+ atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
61323+}
61324+#else
61325+#define atomic_read_unchecked(v) atomic_read(v)
61326+#define atomic_set_unchecked(v, i) atomic_set((v), (i))
61327+#define atomic_add_unchecked(i, v) atomic_add((i), (v))
61328+#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
61329+#define atomic_inc_unchecked(v) atomic_inc(v)
61330+#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
61331+#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
61332+#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
61333+#define atomic_dec_unchecked(v) atomic_dec(v)
61334+#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
61335+#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
61336+
61337+#define atomic_long_read_unchecked(v) atomic_long_read(v)
61338+#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
61339+#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
61340+#define atomic_long_sub_unchecked(i, v) atomic_long_sub((i), (v))
61341+#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
61342+#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
61343+#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
61344+#endif
61345+
61346 #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
61347diff -urNp linux-2.6.39.1/include/asm-generic/cache.h linux-2.6.39.1/include/asm-generic/cache.h
61348--- linux-2.6.39.1/include/asm-generic/cache.h 2011-05-19 00:06:34.000000000 -0400
61349+++ linux-2.6.39.1/include/asm-generic/cache.h 2011-05-22 19:36:32.000000000 -0400
61350@@ -6,7 +6,7 @@
61351 * cache lines need to provide their own cache.h.
61352 */
61353
61354-#define L1_CACHE_SHIFT 5
61355-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
61356+#define L1_CACHE_SHIFT 5U
61357+#define L1_CACHE_BYTES (1U << L1_CACHE_SHIFT)
61358
61359 #endif /* __ASM_GENERIC_CACHE_H */
61360diff -urNp linux-2.6.39.1/include/asm-generic/dma-mapping-common.h linux-2.6.39.1/include/asm-generic/dma-mapping-common.h
61361--- linux-2.6.39.1/include/asm-generic/dma-mapping-common.h 2011-05-19 00:06:34.000000000 -0400
61362+++ linux-2.6.39.1/include/asm-generic/dma-mapping-common.h 2011-05-22 19:36:32.000000000 -0400
61363@@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
61364 enum dma_data_direction dir,
61365 struct dma_attrs *attrs)
61366 {
61367- struct dma_map_ops *ops = get_dma_ops(dev);
61368+ const struct dma_map_ops *ops = get_dma_ops(dev);
61369 dma_addr_t addr;
61370
61371 kmemcheck_mark_initialized(ptr, size);
61372@@ -30,7 +30,7 @@ static inline void dma_unmap_single_attr
61373 enum dma_data_direction dir,
61374 struct dma_attrs *attrs)
61375 {
61376- struct dma_map_ops *ops = get_dma_ops(dev);
61377+ const struct dma_map_ops *ops = get_dma_ops(dev);
61378
61379 BUG_ON(!valid_dma_direction(dir));
61380 if (ops->unmap_page)
61381@@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struc
61382 int nents, enum dma_data_direction dir,
61383 struct dma_attrs *attrs)
61384 {
61385- struct dma_map_ops *ops = get_dma_ops(dev);
61386+ const struct dma_map_ops *ops = get_dma_ops(dev);
61387 int i, ents;
61388 struct scatterlist *s;
61389
61390@@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(st
61391 int nents, enum dma_data_direction dir,
61392 struct dma_attrs *attrs)
61393 {
61394- struct dma_map_ops *ops = get_dma_ops(dev);
61395+ const struct dma_map_ops *ops = get_dma_ops(dev);
61396
61397 BUG_ON(!valid_dma_direction(dir));
61398 debug_dma_unmap_sg(dev, sg, nents, dir);
61399@@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(st
61400 size_t offset, size_t size,
61401 enum dma_data_direction dir)
61402 {
61403- struct dma_map_ops *ops = get_dma_ops(dev);
61404+ const struct dma_map_ops *ops = get_dma_ops(dev);
61405 dma_addr_t addr;
61406
61407 kmemcheck_mark_initialized(page_address(page) + offset, size);
61408@@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(st
61409 static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
61410 size_t size, enum dma_data_direction dir)
61411 {
61412- struct dma_map_ops *ops = get_dma_ops(dev);
61413+ const struct dma_map_ops *ops = get_dma_ops(dev);
61414
61415 BUG_ON(!valid_dma_direction(dir));
61416 if (ops->unmap_page)
61417@@ -97,7 +97,7 @@ static inline void dma_sync_single_for_c
61418 size_t size,
61419 enum dma_data_direction dir)
61420 {
61421- struct dma_map_ops *ops = get_dma_ops(dev);
61422+ const struct dma_map_ops *ops = get_dma_ops(dev);
61423
61424 BUG_ON(!valid_dma_direction(dir));
61425 if (ops->sync_single_for_cpu)
61426@@ -109,7 +109,7 @@ static inline void dma_sync_single_for_d
61427 dma_addr_t addr, size_t size,
61428 enum dma_data_direction dir)
61429 {
61430- struct dma_map_ops *ops = get_dma_ops(dev);
61431+ const struct dma_map_ops *ops = get_dma_ops(dev);
61432
61433 BUG_ON(!valid_dma_direction(dir));
61434 if (ops->sync_single_for_device)
61435@@ -139,7 +139,7 @@ static inline void
61436 dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
61437 int nelems, enum dma_data_direction dir)
61438 {
61439- struct dma_map_ops *ops = get_dma_ops(dev);
61440+ const struct dma_map_ops *ops = get_dma_ops(dev);
61441
61442 BUG_ON(!valid_dma_direction(dir));
61443 if (ops->sync_sg_for_cpu)
61444@@ -151,7 +151,7 @@ static inline void
61445 dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
61446 int nelems, enum dma_data_direction dir)
61447 {
61448- struct dma_map_ops *ops = get_dma_ops(dev);
61449+ const struct dma_map_ops *ops = get_dma_ops(dev);
61450
61451 BUG_ON(!valid_dma_direction(dir));
61452 if (ops->sync_sg_for_device)
61453diff -urNp linux-2.6.39.1/include/asm-generic/int-l64.h linux-2.6.39.1/include/asm-generic/int-l64.h
61454--- linux-2.6.39.1/include/asm-generic/int-l64.h 2011-05-19 00:06:34.000000000 -0400
61455+++ linux-2.6.39.1/include/asm-generic/int-l64.h 2011-05-22 19:36:32.000000000 -0400
61456@@ -46,6 +46,8 @@ typedef unsigned int u32;
61457 typedef signed long s64;
61458 typedef unsigned long u64;
61459
61460+typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
61461+
61462 #define S8_C(x) x
61463 #define U8_C(x) x ## U
61464 #define S16_C(x) x
61465diff -urNp linux-2.6.39.1/include/asm-generic/int-ll64.h linux-2.6.39.1/include/asm-generic/int-ll64.h
61466--- linux-2.6.39.1/include/asm-generic/int-ll64.h 2011-05-19 00:06:34.000000000 -0400
61467+++ linux-2.6.39.1/include/asm-generic/int-ll64.h 2011-05-22 19:36:32.000000000 -0400
61468@@ -51,6 +51,8 @@ typedef unsigned int u32;
61469 typedef signed long long s64;
61470 typedef unsigned long long u64;
61471
61472+typedef unsigned long long intoverflow_t;
61473+
61474 #define S8_C(x) x
61475 #define U8_C(x) x ## U
61476 #define S16_C(x) x
61477diff -urNp linux-2.6.39.1/include/asm-generic/kmap_types.h linux-2.6.39.1/include/asm-generic/kmap_types.h
61478--- linux-2.6.39.1/include/asm-generic/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
61479+++ linux-2.6.39.1/include/asm-generic/kmap_types.h 2011-05-22 19:36:32.000000000 -0400
61480@@ -29,10 +29,11 @@ KMAP_D(16) KM_IRQ_PTE,
61481 KMAP_D(17) KM_NMI,
61482 KMAP_D(18) KM_NMI_PTE,
61483 KMAP_D(19) KM_KDB,
61484+KMAP_D(20) KM_CLEARPAGE,
61485 /*
61486 * Remember to update debug_kmap_atomic() when adding new kmap types!
61487 */
61488-KMAP_D(20) KM_TYPE_NR
61489+KMAP_D(21) KM_TYPE_NR
61490 };
61491
61492 #undef KMAP_D
61493diff -urNp linux-2.6.39.1/include/asm-generic/pgtable.h linux-2.6.39.1/include/asm-generic/pgtable.h
61494--- linux-2.6.39.1/include/asm-generic/pgtable.h 2011-05-19 00:06:34.000000000 -0400
61495+++ linux-2.6.39.1/include/asm-generic/pgtable.h 2011-05-22 19:36:32.000000000 -0400
61496@@ -447,6 +447,14 @@ static inline int pmd_write(pmd_t pmd)
61497 #endif /* __HAVE_ARCH_PMD_WRITE */
61498 #endif
61499
61500+#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
61501+static inline unsigned long pax_open_kernel(void) { return 0; }
61502+#endif
61503+
61504+#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
61505+static inline unsigned long pax_close_kernel(void) { return 0; }
61506+#endif
61507+
61508 #endif /* !__ASSEMBLY__ */
61509
61510 #endif /* _ASM_GENERIC_PGTABLE_H */
61511diff -urNp linux-2.6.39.1/include/asm-generic/pgtable-nopmd.h linux-2.6.39.1/include/asm-generic/pgtable-nopmd.h
61512--- linux-2.6.39.1/include/asm-generic/pgtable-nopmd.h 2011-05-19 00:06:34.000000000 -0400
61513+++ linux-2.6.39.1/include/asm-generic/pgtable-nopmd.h 2011-05-22 19:36:32.000000000 -0400
61514@@ -1,14 +1,19 @@
61515 #ifndef _PGTABLE_NOPMD_H
61516 #define _PGTABLE_NOPMD_H
61517
61518-#ifndef __ASSEMBLY__
61519-
61520 #include <asm-generic/pgtable-nopud.h>
61521
61522-struct mm_struct;
61523-
61524 #define __PAGETABLE_PMD_FOLDED
61525
61526+#define PMD_SHIFT PUD_SHIFT
61527+#define PTRS_PER_PMD 1
61528+#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
61529+#define PMD_MASK (~(PMD_SIZE-1))
61530+
61531+#ifndef __ASSEMBLY__
61532+
61533+struct mm_struct;
61534+
61535 /*
61536 * Having the pmd type consist of a pud gets the size right, and allows
61537 * us to conceptually access the pud entry that this pmd is folded into
61538@@ -16,11 +21,6 @@ struct mm_struct;
61539 */
61540 typedef struct { pud_t pud; } pmd_t;
61541
61542-#define PMD_SHIFT PUD_SHIFT
61543-#define PTRS_PER_PMD 1
61544-#define PMD_SIZE (1UL << PMD_SHIFT)
61545-#define PMD_MASK (~(PMD_SIZE-1))
61546-
61547 /*
61548 * The "pud_xxx()" functions here are trivial for a folded two-level
61549 * setup: the pmd is never bad, and a pmd always exists (as it's folded
61550diff -urNp linux-2.6.39.1/include/asm-generic/pgtable-nopud.h linux-2.6.39.1/include/asm-generic/pgtable-nopud.h
61551--- linux-2.6.39.1/include/asm-generic/pgtable-nopud.h 2011-05-19 00:06:34.000000000 -0400
61552+++ linux-2.6.39.1/include/asm-generic/pgtable-nopud.h 2011-05-22 19:36:32.000000000 -0400
61553@@ -1,10 +1,15 @@
61554 #ifndef _PGTABLE_NOPUD_H
61555 #define _PGTABLE_NOPUD_H
61556
61557-#ifndef __ASSEMBLY__
61558-
61559 #define __PAGETABLE_PUD_FOLDED
61560
61561+#define PUD_SHIFT PGDIR_SHIFT
61562+#define PTRS_PER_PUD 1
61563+#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
61564+#define PUD_MASK (~(PUD_SIZE-1))
61565+
61566+#ifndef __ASSEMBLY__
61567+
61568 /*
61569 * Having the pud type consist of a pgd gets the size right, and allows
61570 * us to conceptually access the pgd entry that this pud is folded into
61571@@ -12,11 +17,6 @@
61572 */
61573 typedef struct { pgd_t pgd; } pud_t;
61574
61575-#define PUD_SHIFT PGDIR_SHIFT
61576-#define PTRS_PER_PUD 1
61577-#define PUD_SIZE (1UL << PUD_SHIFT)
61578-#define PUD_MASK (~(PUD_SIZE-1))
61579-
61580 /*
61581 * The "pgd_xxx()" functions here are trivial for a folded two-level
61582 * setup: the pud is never bad, and a pud always exists (as it's folded
61583diff -urNp linux-2.6.39.1/include/asm-generic/vmlinux.lds.h linux-2.6.39.1/include/asm-generic/vmlinux.lds.h
61584--- linux-2.6.39.1/include/asm-generic/vmlinux.lds.h 2011-05-19 00:06:34.000000000 -0400
61585+++ linux-2.6.39.1/include/asm-generic/vmlinux.lds.h 2011-05-22 19:36:32.000000000 -0400
61586@@ -213,6 +213,7 @@
61587 .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
61588 VMLINUX_SYMBOL(__start_rodata) = .; \
61589 *(.rodata) *(.rodata.*) \
61590+ *(.data..read_only) \
61591 *(__vermagic) /* Kernel version magic */ \
61592 . = ALIGN(8); \
61593 VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
61594@@ -707,14 +708,15 @@
61595 * section in the linker script will go there too. @phdr should have
61596 * a leading colon.
61597 *
61598- * Note that this macros defines __per_cpu_load as an absolute symbol.
61599+ * Note that this macros defines per_cpu_load as an absolute symbol.
61600 * If there is no need to put the percpu section at a predetermined
61601 * address, use PERCPU().
61602 */
61603 #define PERCPU_VADDR(cacheline, vaddr, phdr) \
61604- VMLINUX_SYMBOL(__per_cpu_load) = .; \
61605- .data..percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
61606+ per_cpu_load = .; \
61607+ .data..percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
61608 - LOAD_OFFSET) { \
61609+ VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
61610 VMLINUX_SYMBOL(__per_cpu_start) = .; \
61611 *(.data..percpu..first) \
61612 . = ALIGN(PAGE_SIZE); \
61613@@ -726,7 +728,7 @@
61614 *(.data..percpu..shared_aligned) \
61615 VMLINUX_SYMBOL(__per_cpu_end) = .; \
61616 } phdr \
61617- . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data..percpu);
61618+ . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data..percpu);
61619
61620 /**
61621 * PERCPU - define output section for percpu area, simple version
61622diff -urNp linux-2.6.39.1/include/drm/drmP.h linux-2.6.39.1/include/drm/drmP.h
61623--- linux-2.6.39.1/include/drm/drmP.h 2011-05-19 00:06:34.000000000 -0400
61624+++ linux-2.6.39.1/include/drm/drmP.h 2011-05-22 19:41:42.000000000 -0400
61625@@ -73,6 +73,7 @@
61626 #include <linux/workqueue.h>
61627 #include <linux/poll.h>
61628 #include <asm/pgalloc.h>
61629+#include <asm/local.h>
61630 #include "drm.h"
61631
61632 #include <linux/idr.h>
61633@@ -908,7 +909,7 @@ struct drm_driver {
61634 uint32_t handle);
61635
61636 /* Driver private ops for this object */
61637- struct vm_operations_struct *gem_vm_ops;
61638+ const struct vm_operations_struct *gem_vm_ops;
61639
61640 int major;
61641 int minor;
61642@@ -1023,7 +1024,7 @@ struct drm_device {
61643
61644 /** \name Usage Counters */
61645 /*@{ */
61646- int open_count; /**< Outstanding files open */
61647+ local_t open_count; /**< Outstanding files open */
61648 atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
61649 atomic_t vma_count; /**< Outstanding vma areas open */
61650 int buf_use; /**< Buffers in use -- cannot alloc */
61651@@ -1034,7 +1035,7 @@ struct drm_device {
61652 /*@{ */
61653 unsigned long counters;
61654 enum drm_stat_type types[15];
61655- atomic_t counts[15];
61656+ atomic_unchecked_t counts[15];
61657 /*@} */
61658
61659 struct list_head filelist;
61660diff -urNp linux-2.6.39.1/include/linux/a.out.h linux-2.6.39.1/include/linux/a.out.h
61661--- linux-2.6.39.1/include/linux/a.out.h 2011-05-19 00:06:34.000000000 -0400
61662+++ linux-2.6.39.1/include/linux/a.out.h 2011-05-22 19:36:32.000000000 -0400
61663@@ -39,6 +39,14 @@ enum machine_type {
61664 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
61665 };
61666
61667+/* Constants for the N_FLAGS field */
61668+#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
61669+#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
61670+#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
61671+#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
61672+/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
61673+#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
61674+
61675 #if !defined (N_MAGIC)
61676 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
61677 #endif
61678diff -urNp linux-2.6.39.1/include/linux/atmdev.h linux-2.6.39.1/include/linux/atmdev.h
61679--- linux-2.6.39.1/include/linux/atmdev.h 2011-05-19 00:06:34.000000000 -0400
61680+++ linux-2.6.39.1/include/linux/atmdev.h 2011-05-22 19:36:32.000000000 -0400
61681@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
61682 #endif
61683
61684 struct k_atm_aal_stats {
61685-#define __HANDLE_ITEM(i) atomic_t i
61686+#define __HANDLE_ITEM(i) atomic_unchecked_t i
61687 __AAL_STAT_ITEMS
61688 #undef __HANDLE_ITEM
61689 };
61690diff -urNp linux-2.6.39.1/include/linux/binfmts.h linux-2.6.39.1/include/linux/binfmts.h
61691--- linux-2.6.39.1/include/linux/binfmts.h 2011-05-19 00:06:34.000000000 -0400
61692+++ linux-2.6.39.1/include/linux/binfmts.h 2011-05-22 19:36:32.000000000 -0400
61693@@ -92,6 +92,7 @@ struct linux_binfmt {
61694 int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
61695 int (*load_shlib)(struct file *);
61696 int (*core_dump)(struct coredump_params *cprm);
61697+ void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
61698 unsigned long min_coredump; /* minimal dump size */
61699 };
61700
61701diff -urNp linux-2.6.39.1/include/linux/blkdev.h linux-2.6.39.1/include/linux/blkdev.h
61702--- linux-2.6.39.1/include/linux/blkdev.h 2011-06-03 00:04:14.000000000 -0400
61703+++ linux-2.6.39.1/include/linux/blkdev.h 2011-06-03 00:32:08.000000000 -0400
61704@@ -1292,22 +1292,22 @@ queue_max_integrity_segments(struct requ
61705 #endif /* CONFIG_BLK_DEV_INTEGRITY */
61706
61707 struct block_device_operations {
61708- int (*open) (struct block_device *, fmode_t);
61709- int (*release) (struct gendisk *, fmode_t);
61710- int (*ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61711- int (*compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61712- int (*direct_access) (struct block_device *, sector_t,
61713+ int (* const open) (struct block_device *, fmode_t);
61714+ int (* const release) (struct gendisk *, fmode_t);
61715+ int (* const ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61716+ int (* const compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61717+ int (* const direct_access) (struct block_device *, sector_t,
61718 void **, unsigned long *);
61719- unsigned int (*check_events) (struct gendisk *disk,
61720+ unsigned int (* const check_events) (struct gendisk *disk,
61721 unsigned int clearing);
61722 /* ->media_changed() is DEPRECATED, use ->check_events() instead */
61723- int (*media_changed) (struct gendisk *);
61724- void (*unlock_native_capacity) (struct gendisk *);
61725- int (*revalidate_disk) (struct gendisk *);
61726- int (*getgeo)(struct block_device *, struct hd_geometry *);
61727+ int (* const media_changed) (struct gendisk *);
61728+ void (* const unlock_native_capacity) (struct gendisk *);
61729+ int (* const revalidate_disk) (struct gendisk *);
61730+ int (* const getgeo)(struct block_device *, struct hd_geometry *);
61731 /* this callback is with swap_lock and sometimes page table lock held */
61732- void (*swap_slot_free_notify) (struct block_device *, unsigned long);
61733- struct module *owner;
61734+ void (* const swap_slot_free_notify) (struct block_device *, unsigned long);
61735+ struct module * const owner;
61736 };
61737
61738 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
61739diff -urNp linux-2.6.39.1/include/linux/blktrace_api.h linux-2.6.39.1/include/linux/blktrace_api.h
61740--- linux-2.6.39.1/include/linux/blktrace_api.h 2011-05-19 00:06:34.000000000 -0400
61741+++ linux-2.6.39.1/include/linux/blktrace_api.h 2011-05-22 19:36:32.000000000 -0400
61742@@ -161,7 +161,7 @@ struct blk_trace {
61743 struct dentry *dir;
61744 struct dentry *dropped_file;
61745 struct dentry *msg_file;
61746- atomic_t dropped;
61747+ atomic_unchecked_t dropped;
61748 };
61749
61750 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
61751diff -urNp linux-2.6.39.1/include/linux/byteorder/little_endian.h linux-2.6.39.1/include/linux/byteorder/little_endian.h
61752--- linux-2.6.39.1/include/linux/byteorder/little_endian.h 2011-05-19 00:06:34.000000000 -0400
61753+++ linux-2.6.39.1/include/linux/byteorder/little_endian.h 2011-05-22 19:36:32.000000000 -0400
61754@@ -42,51 +42,51 @@
61755
61756 static inline __le64 __cpu_to_le64p(const __u64 *p)
61757 {
61758- return (__force __le64)*p;
61759+ return (__force const __le64)*p;
61760 }
61761 static inline __u64 __le64_to_cpup(const __le64 *p)
61762 {
61763- return (__force __u64)*p;
61764+ return (__force const __u64)*p;
61765 }
61766 static inline __le32 __cpu_to_le32p(const __u32 *p)
61767 {
61768- return (__force __le32)*p;
61769+ return (__force const __le32)*p;
61770 }
61771 static inline __u32 __le32_to_cpup(const __le32 *p)
61772 {
61773- return (__force __u32)*p;
61774+ return (__force const __u32)*p;
61775 }
61776 static inline __le16 __cpu_to_le16p(const __u16 *p)
61777 {
61778- return (__force __le16)*p;
61779+ return (__force const __le16)*p;
61780 }
61781 static inline __u16 __le16_to_cpup(const __le16 *p)
61782 {
61783- return (__force __u16)*p;
61784+ return (__force const __u16)*p;
61785 }
61786 static inline __be64 __cpu_to_be64p(const __u64 *p)
61787 {
61788- return (__force __be64)__swab64p(p);
61789+ return (__force const __be64)__swab64p(p);
61790 }
61791 static inline __u64 __be64_to_cpup(const __be64 *p)
61792 {
61793- return __swab64p((__u64 *)p);
61794+ return __swab64p((const __u64 *)p);
61795 }
61796 static inline __be32 __cpu_to_be32p(const __u32 *p)
61797 {
61798- return (__force __be32)__swab32p(p);
61799+ return (__force const __be32)__swab32p(p);
61800 }
61801 static inline __u32 __be32_to_cpup(const __be32 *p)
61802 {
61803- return __swab32p((__u32 *)p);
61804+ return __swab32p((const __u32 *)p);
61805 }
61806 static inline __be16 __cpu_to_be16p(const __u16 *p)
61807 {
61808- return (__force __be16)__swab16p(p);
61809+ return (__force const __be16)__swab16p(p);
61810 }
61811 static inline __u16 __be16_to_cpup(const __be16 *p)
61812 {
61813- return __swab16p((__u16 *)p);
61814+ return __swab16p((const __u16 *)p);
61815 }
61816 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
61817 #define __le64_to_cpus(x) do { (void)(x); } while (0)
61818diff -urNp linux-2.6.39.1/include/linux/cache.h linux-2.6.39.1/include/linux/cache.h
61819--- linux-2.6.39.1/include/linux/cache.h 2011-05-19 00:06:34.000000000 -0400
61820+++ linux-2.6.39.1/include/linux/cache.h 2011-05-22 19:36:32.000000000 -0400
61821@@ -16,6 +16,10 @@
61822 #define __read_mostly
61823 #endif
61824
61825+#ifndef __read_only
61826+#define __read_only __read_mostly
61827+#endif
61828+
61829 #ifndef ____cacheline_aligned
61830 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
61831 #endif
61832diff -urNp linux-2.6.39.1/include/linux/capability.h linux-2.6.39.1/include/linux/capability.h
61833--- linux-2.6.39.1/include/linux/capability.h 2011-05-19 00:06:34.000000000 -0400
61834+++ linux-2.6.39.1/include/linux/capability.h 2011-05-22 21:02:47.000000000 -0400
61835@@ -547,6 +547,9 @@ extern bool capable(int cap);
61836 extern bool ns_capable(struct user_namespace *ns, int cap);
61837 extern bool task_ns_capable(struct task_struct *t, int cap);
61838 extern bool nsown_capable(int cap);
61839+extern bool task_ns_capable_nolog(struct task_struct *t, int cap);
61840+extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
61841+extern bool capable_nolog(int cap);
61842
61843 /* audit system wants to get cap info from files as well */
61844 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
61845diff -urNp linux-2.6.39.1/include/linux/compiler-gcc4.h linux-2.6.39.1/include/linux/compiler-gcc4.h
61846--- linux-2.6.39.1/include/linux/compiler-gcc4.h 2011-05-19 00:06:34.000000000 -0400
61847+++ linux-2.6.39.1/include/linux/compiler-gcc4.h 2011-05-22 19:36:32.000000000 -0400
61848@@ -46,6 +46,11 @@
61849 #define __noclone __attribute__((__noclone__))
61850
61851 #endif
61852+
61853+#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
61854+#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
61855+#define __bos0(ptr) __bos((ptr), 0)
61856+#define __bos1(ptr) __bos((ptr), 1)
61857 #endif
61858
61859 #if __GNUC_MINOR__ > 0
61860diff -urNp linux-2.6.39.1/include/linux/compiler.h linux-2.6.39.1/include/linux/compiler.h
61861--- linux-2.6.39.1/include/linux/compiler.h 2011-05-19 00:06:34.000000000 -0400
61862+++ linux-2.6.39.1/include/linux/compiler.h 2011-05-22 19:36:32.000000000 -0400
61863@@ -273,6 +273,22 @@ void ftrace_likely_update(struct ftrace_
61864 #define __cold
61865 #endif
61866
61867+#ifndef __alloc_size
61868+#define __alloc_size
61869+#endif
61870+
61871+#ifndef __bos
61872+#define __bos
61873+#endif
61874+
61875+#ifndef __bos0
61876+#define __bos0
61877+#endif
61878+
61879+#ifndef __bos1
61880+#define __bos1
61881+#endif
61882+
61883 /* Simple shorthand for a section definition */
61884 #ifndef __section
61885 # define __section(S) __attribute__ ((__section__(#S)))
61886@@ -306,6 +322,7 @@ void ftrace_likely_update(struct ftrace_
61887 * use is to mediate communication between process-level code and irq/NMI
61888 * handlers, all running on the same CPU.
61889 */
61890-#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
61891+#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
61892+#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
61893
61894 #endif /* __LINUX_COMPILER_H */
61895diff -urNp linux-2.6.39.1/include/linux/concap.h linux-2.6.39.1/include/linux/concap.h
61896--- linux-2.6.39.1/include/linux/concap.h 2011-05-19 00:06:34.000000000 -0400
61897+++ linux-2.6.39.1/include/linux/concap.h 2011-05-22 19:36:32.000000000 -0400
61898@@ -30,7 +30,7 @@ struct concap_device_ops;
61899 struct concap_proto{
61900 struct net_device *net_dev; /* net device using our service */
61901 struct concap_device_ops *dops; /* callbacks provided by device */
61902- struct concap_proto_ops *pops; /* callbacks provided by us */
61903+ const struct concap_proto_ops *pops; /* callbacks provided by us */
61904 spinlock_t lock;
61905 int flags;
61906 void *proto_data; /* protocol specific private data, to
61907diff -urNp linux-2.6.39.1/include/linux/configfs.h linux-2.6.39.1/include/linux/configfs.h
61908--- linux-2.6.39.1/include/linux/configfs.h 2011-05-19 00:06:34.000000000 -0400
61909+++ linux-2.6.39.1/include/linux/configfs.h 2011-05-22 19:36:32.000000000 -0400
61910@@ -82,7 +82,7 @@ extern void config_item_put(struct confi
61911 struct config_item_type {
61912 struct module *ct_owner;
61913 struct configfs_item_operations *ct_item_ops;
61914- struct configfs_group_operations *ct_group_ops;
61915+ const struct configfs_group_operations *ct_group_ops;
61916 struct configfs_attribute **ct_attrs;
61917 };
61918
61919diff -urNp linux-2.6.39.1/include/linux/cpuset.h linux-2.6.39.1/include/linux/cpuset.h
61920--- linux-2.6.39.1/include/linux/cpuset.h 2011-05-19 00:06:34.000000000 -0400
61921+++ linux-2.6.39.1/include/linux/cpuset.h 2011-05-22 19:36:32.000000000 -0400
61922@@ -118,7 +118,7 @@ static inline void put_mems_allowed(void
61923 * nodemask.
61924 */
61925 smp_mb();
61926- --ACCESS_ONCE(current->mems_allowed_change_disable);
61927+ --ACCESS_ONCE_RW(current->mems_allowed_change_disable);
61928 }
61929
61930 static inline void set_mems_allowed(nodemask_t nodemask)
61931diff -urNp linux-2.6.39.1/include/linux/dca.h linux-2.6.39.1/include/linux/dca.h
61932--- linux-2.6.39.1/include/linux/dca.h 2011-05-19 00:06:34.000000000 -0400
61933+++ linux-2.6.39.1/include/linux/dca.h 2011-05-22 19:36:32.000000000 -0400
61934@@ -34,7 +34,7 @@ void dca_unregister_notify(struct notifi
61935
61936 struct dca_provider {
61937 struct list_head node;
61938- struct dca_ops *ops;
61939+ const struct dca_ops *ops;
61940 struct device *cd;
61941 int id;
61942 };
61943@@ -53,7 +53,7 @@ struct dca_ops {
61944 int (*dev_managed) (struct dca_provider *, struct device *);
61945 };
61946
61947-struct dca_provider *alloc_dca_provider(struct dca_ops *ops, int priv_size);
61948+struct dca_provider *alloc_dca_provider(const struct dca_ops *ops, int priv_size);
61949 void free_dca_provider(struct dca_provider *dca);
61950 int register_dca_provider(struct dca_provider *dca, struct device *dev);
61951 void unregister_dca_provider(struct dca_provider *dca, struct device *dev);
61952diff -urNp linux-2.6.39.1/include/linux/decompress/mm.h linux-2.6.39.1/include/linux/decompress/mm.h
61953--- linux-2.6.39.1/include/linux/decompress/mm.h 2011-05-19 00:06:34.000000000 -0400
61954+++ linux-2.6.39.1/include/linux/decompress/mm.h 2011-05-22 19:36:33.000000000 -0400
61955@@ -77,7 +77,7 @@ static void free(void *where)
61956 * warnings when not needed (indeed large_malloc / large_free are not
61957 * needed by inflate */
61958
61959-#define malloc(a) kmalloc(a, GFP_KERNEL)
61960+#define malloc(a) kmalloc((a), GFP_KERNEL)
61961 #define free(a) kfree(a)
61962
61963 #define large_malloc(a) vmalloc(a)
61964diff -urNp linux-2.6.39.1/include/linux/dma-mapping.h linux-2.6.39.1/include/linux/dma-mapping.h
61965--- linux-2.6.39.1/include/linux/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
61966+++ linux-2.6.39.1/include/linux/dma-mapping.h 2011-05-22 19:36:33.000000000 -0400
61967@@ -16,40 +16,40 @@ enum dma_data_direction {
61968 };
61969
61970 struct dma_map_ops {
61971- void* (*alloc_coherent)(struct device *dev, size_t size,
61972+ void* (* const alloc_coherent)(struct device *dev, size_t size,
61973 dma_addr_t *dma_handle, gfp_t gfp);
61974- void (*free_coherent)(struct device *dev, size_t size,
61975+ void (* const free_coherent)(struct device *dev, size_t size,
61976 void *vaddr, dma_addr_t dma_handle);
61977- dma_addr_t (*map_page)(struct device *dev, struct page *page,
61978+ dma_addr_t (* const map_page)(struct device *dev, struct page *page,
61979 unsigned long offset, size_t size,
61980 enum dma_data_direction dir,
61981 struct dma_attrs *attrs);
61982- void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
61983+ void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
61984 size_t size, enum dma_data_direction dir,
61985 struct dma_attrs *attrs);
61986- int (*map_sg)(struct device *dev, struct scatterlist *sg,
61987+ int (* const map_sg)(struct device *dev, struct scatterlist *sg,
61988 int nents, enum dma_data_direction dir,
61989 struct dma_attrs *attrs);
61990- void (*unmap_sg)(struct device *dev,
61991+ void (* const unmap_sg)(struct device *dev,
61992 struct scatterlist *sg, int nents,
61993 enum dma_data_direction dir,
61994 struct dma_attrs *attrs);
61995- void (*sync_single_for_cpu)(struct device *dev,
61996+ void (* const sync_single_for_cpu)(struct device *dev,
61997 dma_addr_t dma_handle, size_t size,
61998 enum dma_data_direction dir);
61999- void (*sync_single_for_device)(struct device *dev,
62000+ void (* const sync_single_for_device)(struct device *dev,
62001 dma_addr_t dma_handle, size_t size,
62002 enum dma_data_direction dir);
62003- void (*sync_sg_for_cpu)(struct device *dev,
62004+ void (* const sync_sg_for_cpu)(struct device *dev,
62005 struct scatterlist *sg, int nents,
62006 enum dma_data_direction dir);
62007- void (*sync_sg_for_device)(struct device *dev,
62008+ void (* const sync_sg_for_device)(struct device *dev,
62009 struct scatterlist *sg, int nents,
62010 enum dma_data_direction dir);
62011- int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
62012- int (*dma_supported)(struct device *dev, u64 mask);
62013- int (*set_dma_mask)(struct device *dev, u64 mask);
62014- int is_phys;
62015+ int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
62016+ int (* const dma_supported)(struct device *dev, u64 mask);
62017+ int (* set_dma_mask)(struct device *dev, u64 mask);
62018+ const int is_phys;
62019 };
62020
62021 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
62022diff -urNp linux-2.6.39.1/include/linux/elf.h linux-2.6.39.1/include/linux/elf.h
62023--- linux-2.6.39.1/include/linux/elf.h 2011-05-19 00:06:34.000000000 -0400
62024+++ linux-2.6.39.1/include/linux/elf.h 2011-05-22 19:36:33.000000000 -0400
62025@@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
62026 #define PT_GNU_EH_FRAME 0x6474e550
62027
62028 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
62029+#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
62030+
62031+#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
62032+
62033+/* Constants for the e_flags field */
62034+#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
62035+#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
62036+#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
62037+#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
62038+/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
62039+#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
62040
62041 /*
62042 * Extended Numbering
62043@@ -106,6 +117,8 @@ typedef __s64 Elf64_Sxword;
62044 #define DT_DEBUG 21
62045 #define DT_TEXTREL 22
62046 #define DT_JMPREL 23
62047+#define DT_FLAGS 30
62048+ #define DF_TEXTREL 0x00000004
62049 #define DT_ENCODING 32
62050 #define OLD_DT_LOOS 0x60000000
62051 #define DT_LOOS 0x6000000d
62052@@ -252,6 +265,19 @@ typedef struct elf64_hdr {
62053 #define PF_W 0x2
62054 #define PF_X 0x1
62055
62056+#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
62057+#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
62058+#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
62059+#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
62060+#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
62061+#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
62062+/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
62063+/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
62064+#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
62065+#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
62066+#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
62067+#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
62068+
62069 typedef struct elf32_phdr{
62070 Elf32_Word p_type;
62071 Elf32_Off p_offset;
62072@@ -344,6 +370,8 @@ typedef struct elf64_shdr {
62073 #define EI_OSABI 7
62074 #define EI_PAD 8
62075
62076+#define EI_PAX 14
62077+
62078 #define ELFMAG0 0x7f /* EI_MAG */
62079 #define ELFMAG1 'E'
62080 #define ELFMAG2 'L'
62081@@ -421,6 +449,7 @@ extern Elf32_Dyn _DYNAMIC [];
62082 #define elf_note elf32_note
62083 #define elf_addr_t Elf32_Off
62084 #define Elf_Half Elf32_Half
62085+#define elf_dyn Elf32_Dyn
62086
62087 #else
62088
62089@@ -431,6 +460,7 @@ extern Elf64_Dyn _DYNAMIC [];
62090 #define elf_note elf64_note
62091 #define elf_addr_t Elf64_Off
62092 #define Elf_Half Elf64_Half
62093+#define elf_dyn Elf64_Dyn
62094
62095 #endif
62096
62097diff -urNp linux-2.6.39.1/include/linux/enclosure.h linux-2.6.39.1/include/linux/enclosure.h
62098--- linux-2.6.39.1/include/linux/enclosure.h 2011-05-19 00:06:34.000000000 -0400
62099+++ linux-2.6.39.1/include/linux/enclosure.h 2011-05-22 19:36:33.000000000 -0400
62100@@ -98,7 +98,7 @@ struct enclosure_device {
62101 void *scratch;
62102 struct list_head node;
62103 struct device edev;
62104- struct enclosure_component_callbacks *cb;
62105+ const struct enclosure_component_callbacks *cb;
62106 int components;
62107 struct enclosure_component component[0];
62108 };
62109diff -urNp linux-2.6.39.1/include/linux/fscache-cache.h linux-2.6.39.1/include/linux/fscache-cache.h
62110--- linux-2.6.39.1/include/linux/fscache-cache.h 2011-05-19 00:06:34.000000000 -0400
62111+++ linux-2.6.39.1/include/linux/fscache-cache.h 2011-05-22 19:36:33.000000000 -0400
62112@@ -113,7 +113,7 @@ struct fscache_operation {
62113 #endif
62114 };
62115
62116-extern atomic_t fscache_op_debug_id;
62117+extern atomic_unchecked_t fscache_op_debug_id;
62118 extern void fscache_op_work_func(struct work_struct *work);
62119
62120 extern void fscache_enqueue_operation(struct fscache_operation *);
62121@@ -133,7 +133,7 @@ static inline void fscache_operation_ini
62122 {
62123 INIT_WORK(&op->work, fscache_op_work_func);
62124 atomic_set(&op->usage, 1);
62125- op->debug_id = atomic_inc_return(&fscache_op_debug_id);
62126+ op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
62127 op->processor = processor;
62128 op->release = release;
62129 INIT_LIST_HEAD(&op->pend_link);
62130diff -urNp linux-2.6.39.1/include/linux/fs.h linux-2.6.39.1/include/linux/fs.h
62131--- linux-2.6.39.1/include/linux/fs.h 2011-05-19 00:06:34.000000000 -0400
62132+++ linux-2.6.39.1/include/linux/fs.h 2011-05-22 19:41:42.000000000 -0400
62133@@ -108,6 +108,11 @@ struct inodes_stat_t {
62134 /* File was opened by fanotify and shouldn't generate fanotify events */
62135 #define FMODE_NONOTIFY ((__force fmode_t)0x1000000)
62136
62137+/* Hack for grsec so as not to require read permission simply to execute
62138+ * a binary
62139+ */
62140+#define FMODE_GREXEC ((__force fmode_t)0x2000000)
62141+
62142 /*
62143 * The below are the various read and write types that we support. Some of
62144 * them include behavioral modifiers that send information down to the
62145@@ -575,41 +580,41 @@ typedef int (*read_actor_t)(read_descrip
62146 unsigned long, unsigned long);
62147
62148 struct address_space_operations {
62149- int (*writepage)(struct page *page, struct writeback_control *wbc);
62150- int (*readpage)(struct file *, struct page *);
62151+ int (* const writepage)(struct page *page, struct writeback_control *wbc);
62152+ int (* const readpage)(struct file *, struct page *);
62153
62154 /* Write back some dirty pages from this mapping. */
62155- int (*writepages)(struct address_space *, struct writeback_control *);
62156+ int (* const writepages)(struct address_space *, struct writeback_control *);
62157
62158 /* Set a page dirty. Return true if this dirtied it */
62159- int (*set_page_dirty)(struct page *page);
62160+ int (* const set_page_dirty)(struct page *page);
62161
62162- int (*readpages)(struct file *filp, struct address_space *mapping,
62163+ int (* const readpages)(struct file *filp, struct address_space *mapping,
62164 struct list_head *pages, unsigned nr_pages);
62165
62166- int (*write_begin)(struct file *, struct address_space *mapping,
62167+ int (* const write_begin)(struct file *, struct address_space *mapping,
62168 loff_t pos, unsigned len, unsigned flags,
62169 struct page **pagep, void **fsdata);
62170- int (*write_end)(struct file *, struct address_space *mapping,
62171+ int (* const write_end)(struct file *, struct address_space *mapping,
62172 loff_t pos, unsigned len, unsigned copied,
62173 struct page *page, void *fsdata);
62174
62175 /* Unfortunately this kludge is needed for FIBMAP. Don't use it */
62176- sector_t (*bmap)(struct address_space *, sector_t);
62177- void (*invalidatepage) (struct page *, unsigned long);
62178- int (*releasepage) (struct page *, gfp_t);
62179- void (*freepage)(struct page *);
62180- ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
62181+ sector_t (* const bmap)(struct address_space *, sector_t);
62182+ void (* const invalidatepage) (struct page *, unsigned long);
62183+ int (* const releasepage) (struct page *, gfp_t);
62184+ void (* const freepage)(struct page *);
62185+ ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
62186 loff_t offset, unsigned long nr_segs);
62187- int (*get_xip_mem)(struct address_space *, pgoff_t, int,
62188+ int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
62189 void **, unsigned long *);
62190 /* migrate the contents of a page to the specified target */
62191- int (*migratepage) (struct address_space *,
62192+ int (* const migratepage) (struct address_space *,
62193 struct page *, struct page *);
62194- int (*launder_page) (struct page *);
62195- int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
62196+ int (* const launder_page) (struct page *);
62197+ int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
62198 unsigned long);
62199- int (*error_remove_page)(struct address_space *, struct page *);
62200+ int (* const error_remove_page)(struct address_space *, struct page *);
62201 };
62202
62203 extern const struct address_space_operations empty_aops;
62204@@ -1060,17 +1065,17 @@ static inline int file_check_writeable(s
62205 typedef struct files_struct *fl_owner_t;
62206
62207 struct file_lock_operations {
62208- void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
62209- void (*fl_release_private)(struct file_lock *);
62210+ void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
62211+ void (* const fl_release_private)(struct file_lock *);
62212 };
62213
62214 struct lock_manager_operations {
62215- int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
62216- void (*fl_notify)(struct file_lock *); /* unblock callback */
62217- int (*fl_grant)(struct file_lock *, struct file_lock *, int);
62218- void (*fl_release_private)(struct file_lock *);
62219- void (*fl_break)(struct file_lock *);
62220- int (*fl_change)(struct file_lock **, int);
62221+ int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
62222+ void (* const fl_notify)(struct file_lock *); /* unblock callback */
62223+ int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
62224+ void (* const fl_release_private)(struct file_lock *);
62225+ void (* const fl_break)(struct file_lock *);
62226+ int (* const fl_change)(struct file_lock **, int);
62227 };
62228
62229 struct lock_manager {
62230@@ -1611,31 +1616,31 @@ extern ssize_t vfs_writev(struct file *,
62231 unsigned long, loff_t *);
62232
62233 struct super_operations {
62234- struct inode *(*alloc_inode)(struct super_block *sb);
62235- void (*destroy_inode)(struct inode *);
62236+ struct inode *(* const alloc_inode)(struct super_block *sb);
62237+ void (* const destroy_inode)(struct inode *);
62238
62239- void (*dirty_inode) (struct inode *);
62240- int (*write_inode) (struct inode *, struct writeback_control *wbc);
62241- int (*drop_inode) (struct inode *);
62242- void (*evict_inode) (struct inode *);
62243- void (*put_super) (struct super_block *);
62244- void (*write_super) (struct super_block *);
62245- int (*sync_fs)(struct super_block *sb, int wait);
62246- int (*freeze_fs) (struct super_block *);
62247- int (*unfreeze_fs) (struct super_block *);
62248- int (*statfs) (struct dentry *, struct kstatfs *);
62249- int (*remount_fs) (struct super_block *, int *, char *);
62250- void (*umount_begin) (struct super_block *);
62251-
62252- int (*show_options)(struct seq_file *, struct vfsmount *);
62253- int (*show_devname)(struct seq_file *, struct vfsmount *);
62254- int (*show_path)(struct seq_file *, struct vfsmount *);
62255- int (*show_stats)(struct seq_file *, struct vfsmount *);
62256+ void (* const dirty_inode) (struct inode *);
62257+ int (* const write_inode) (struct inode *, struct writeback_control *wbc);
62258+ int (* const drop_inode) (struct inode *);
62259+ void (* const evict_inode) (struct inode *);
62260+ void (* const put_super) (struct super_block *);
62261+ void (* const write_super) (struct super_block *);
62262+ int (* const sync_fs)(struct super_block *sb, int wait);
62263+ int (* const freeze_fs) (struct super_block *);
62264+ int (* const unfreeze_fs) (struct super_block *);
62265+ int (* const statfs) (struct dentry *, struct kstatfs *);
62266+ int (* const remount_fs) (struct super_block *, int *, char *);
62267+ void (* const umount_begin) (struct super_block *);
62268+
62269+ int (* const show_options)(struct seq_file *, struct vfsmount *);
62270+ int (* const show_devname)(struct seq_file *, struct vfsmount *);
62271+ int (* const show_path)(struct seq_file *, struct vfsmount *);
62272+ int (* const show_stats)(struct seq_file *, struct vfsmount *);
62273 #ifdef CONFIG_QUOTA
62274- ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
62275- ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
62276+ ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
62277+ ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
62278 #endif
62279- int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
62280+ int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
62281 };
62282
62283 /*
62284diff -urNp linux-2.6.39.1/include/linux/fs_struct.h linux-2.6.39.1/include/linux/fs_struct.h
62285--- linux-2.6.39.1/include/linux/fs_struct.h 2011-05-19 00:06:34.000000000 -0400
62286+++ linux-2.6.39.1/include/linux/fs_struct.h 2011-05-22 19:36:33.000000000 -0400
62287@@ -6,7 +6,7 @@
62288 #include <linux/seqlock.h>
62289
62290 struct fs_struct {
62291- int users;
62292+ atomic_t users;
62293 spinlock_t lock;
62294 seqcount_t seq;
62295 int umask;
62296diff -urNp linux-2.6.39.1/include/linux/ftrace_event.h linux-2.6.39.1/include/linux/ftrace_event.h
62297--- linux-2.6.39.1/include/linux/ftrace_event.h 2011-05-19 00:06:34.000000000 -0400
62298+++ linux-2.6.39.1/include/linux/ftrace_event.h 2011-05-22 19:36:33.000000000 -0400
62299@@ -235,7 +235,7 @@ extern int trace_define_field(struct ftr
62300 extern int trace_add_event_call(struct ftrace_event_call *call);
62301 extern void trace_remove_event_call(struct ftrace_event_call *call);
62302
62303-#define is_signed_type(type) (((type)(-1)) < 0)
62304+#define is_signed_type(type) (((type)(-1)) < (type)1)
62305
62306 int trace_set_clr_event(const char *system, const char *event, int set);
62307
62308diff -urNp linux-2.6.39.1/include/linux/ftrace.h linux-2.6.39.1/include/linux/ftrace.h
62309--- linux-2.6.39.1/include/linux/ftrace.h 2011-05-19 00:06:34.000000000 -0400
62310+++ linux-2.6.39.1/include/linux/ftrace.h 2011-05-22 19:36:33.000000000 -0400
62311@@ -140,7 +140,7 @@ extern void
62312 unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
62313 void *data);
62314 extern void
62315-unregister_ftrace_function_probe_func(char *glob, struct ftrace_probe_ops *ops);
62316+unregister_ftrace_function_probe_func(char *glob, const struct ftrace_probe_ops *ops);
62317 extern void unregister_ftrace_function_probe_all(char *glob);
62318
62319 extern int ftrace_text_reserved(void *start, void *end);
62320diff -urNp linux-2.6.39.1/include/linux/genhd.h linux-2.6.39.1/include/linux/genhd.h
62321--- linux-2.6.39.1/include/linux/genhd.h 2011-06-03 00:04:14.000000000 -0400
62322+++ linux-2.6.39.1/include/linux/genhd.h 2011-06-03 00:32:08.000000000 -0400
62323@@ -184,7 +184,7 @@ struct gendisk {
62324 struct kobject *slave_dir;
62325
62326 struct timer_rand_state *random;
62327- atomic_t sync_io; /* RAID */
62328+ atomic_unchecked_t sync_io; /* RAID */
62329 struct disk_events *ev;
62330 #ifdef CONFIG_BLK_DEV_INTEGRITY
62331 struct blk_integrity *integrity;
62332diff -urNp linux-2.6.39.1/include/linux/gracl.h linux-2.6.39.1/include/linux/gracl.h
62333--- linux-2.6.39.1/include/linux/gracl.h 1969-12-31 19:00:00.000000000 -0500
62334+++ linux-2.6.39.1/include/linux/gracl.h 2011-05-22 19:41:42.000000000 -0400
62335@@ -0,0 +1,317 @@
62336+#ifndef GR_ACL_H
62337+#define GR_ACL_H
62338+
62339+#include <linux/grdefs.h>
62340+#include <linux/resource.h>
62341+#include <linux/capability.h>
62342+#include <linux/dcache.h>
62343+#include <asm/resource.h>
62344+
62345+/* Major status information */
62346+
62347+#define GR_VERSION "grsecurity 2.2.2"
62348+#define GRSECURITY_VERSION 0x2202
62349+
62350+enum {
62351+ GR_SHUTDOWN = 0,
62352+ GR_ENABLE = 1,
62353+ GR_SPROLE = 2,
62354+ GR_RELOAD = 3,
62355+ GR_SEGVMOD = 4,
62356+ GR_STATUS = 5,
62357+ GR_UNSPROLE = 6,
62358+ GR_PASSSET = 7,
62359+ GR_SPROLEPAM = 8,
62360+};
62361+
62362+/* Password setup definitions
62363+ * kernel/grhash.c */
62364+enum {
62365+ GR_PW_LEN = 128,
62366+ GR_SALT_LEN = 16,
62367+ GR_SHA_LEN = 32,
62368+};
62369+
62370+enum {
62371+ GR_SPROLE_LEN = 64,
62372+};
62373+
62374+enum {
62375+ GR_NO_GLOB = 0,
62376+ GR_REG_GLOB,
62377+ GR_CREATE_GLOB
62378+};
62379+
62380+#define GR_NLIMITS 32
62381+
62382+/* Begin Data Structures */
62383+
62384+struct sprole_pw {
62385+ unsigned char *rolename;
62386+ unsigned char salt[GR_SALT_LEN];
62387+ unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
62388+};
62389+
62390+struct name_entry {
62391+ __u32 key;
62392+ ino_t inode;
62393+ dev_t device;
62394+ char *name;
62395+ __u16 len;
62396+ __u8 deleted;
62397+ struct name_entry *prev;
62398+ struct name_entry *next;
62399+};
62400+
62401+struct inodev_entry {
62402+ struct name_entry *nentry;
62403+ struct inodev_entry *prev;
62404+ struct inodev_entry *next;
62405+};
62406+
62407+struct acl_role_db {
62408+ struct acl_role_label **r_hash;
62409+ __u32 r_size;
62410+};
62411+
62412+struct inodev_db {
62413+ struct inodev_entry **i_hash;
62414+ __u32 i_size;
62415+};
62416+
62417+struct name_db {
62418+ struct name_entry **n_hash;
62419+ __u32 n_size;
62420+};
62421+
62422+struct crash_uid {
62423+ uid_t uid;
62424+ unsigned long expires;
62425+};
62426+
62427+struct gr_hash_struct {
62428+ void **table;
62429+ void **nametable;
62430+ void *first;
62431+ __u32 table_size;
62432+ __u32 used_size;
62433+ int type;
62434+};
62435+
62436+/* Userspace Grsecurity ACL data structures */
62437+
62438+struct acl_subject_label {
62439+ char *filename;
62440+ ino_t inode;
62441+ dev_t device;
62442+ __u32 mode;
62443+ kernel_cap_t cap_mask;
62444+ kernel_cap_t cap_lower;
62445+ kernel_cap_t cap_invert_audit;
62446+
62447+ struct rlimit res[GR_NLIMITS];
62448+ __u32 resmask;
62449+
62450+ __u8 user_trans_type;
62451+ __u8 group_trans_type;
62452+ uid_t *user_transitions;
62453+ gid_t *group_transitions;
62454+ __u16 user_trans_num;
62455+ __u16 group_trans_num;
62456+
62457+ __u32 sock_families[2];
62458+ __u32 ip_proto[8];
62459+ __u32 ip_type;
62460+ struct acl_ip_label **ips;
62461+ __u32 ip_num;
62462+ __u32 inaddr_any_override;
62463+
62464+ __u32 crashes;
62465+ unsigned long expires;
62466+
62467+ struct acl_subject_label *parent_subject;
62468+ struct gr_hash_struct *hash;
62469+ struct acl_subject_label *prev;
62470+ struct acl_subject_label *next;
62471+
62472+ struct acl_object_label **obj_hash;
62473+ __u32 obj_hash_size;
62474+ __u16 pax_flags;
62475+};
62476+
62477+struct role_allowed_ip {
62478+ __u32 addr;
62479+ __u32 netmask;
62480+
62481+ struct role_allowed_ip *prev;
62482+ struct role_allowed_ip *next;
62483+};
62484+
62485+struct role_transition {
62486+ char *rolename;
62487+
62488+ struct role_transition *prev;
62489+ struct role_transition *next;
62490+};
62491+
62492+struct acl_role_label {
62493+ char *rolename;
62494+ uid_t uidgid;
62495+ __u16 roletype;
62496+
62497+ __u16 auth_attempts;
62498+ unsigned long expires;
62499+
62500+ struct acl_subject_label *root_label;
62501+ struct gr_hash_struct *hash;
62502+
62503+ struct acl_role_label *prev;
62504+ struct acl_role_label *next;
62505+
62506+ struct role_transition *transitions;
62507+ struct role_allowed_ip *allowed_ips;
62508+ uid_t *domain_children;
62509+ __u16 domain_child_num;
62510+
62511+ struct acl_subject_label **subj_hash;
62512+ __u32 subj_hash_size;
62513+};
62514+
62515+struct user_acl_role_db {
62516+ struct acl_role_label **r_table;
62517+ __u32 num_pointers; /* Number of allocations to track */
62518+ __u32 num_roles; /* Number of roles */
62519+ __u32 num_domain_children; /* Number of domain children */
62520+ __u32 num_subjects; /* Number of subjects */
62521+ __u32 num_objects; /* Number of objects */
62522+};
62523+
62524+struct acl_object_label {
62525+ char *filename;
62526+ ino_t inode;
62527+ dev_t device;
62528+ __u32 mode;
62529+
62530+ struct acl_subject_label *nested;
62531+ struct acl_object_label *globbed;
62532+
62533+ /* next two structures not used */
62534+
62535+ struct acl_object_label *prev;
62536+ struct acl_object_label *next;
62537+};
62538+
62539+struct acl_ip_label {
62540+ char *iface;
62541+ __u32 addr;
62542+ __u32 netmask;
62543+ __u16 low, high;
62544+ __u8 mode;
62545+ __u32 type;
62546+ __u32 proto[8];
62547+
62548+ /* next two structures not used */
62549+
62550+ struct acl_ip_label *prev;
62551+ struct acl_ip_label *next;
62552+};
62553+
62554+struct gr_arg {
62555+ struct user_acl_role_db role_db;
62556+ unsigned char pw[GR_PW_LEN];
62557+ unsigned char salt[GR_SALT_LEN];
62558+ unsigned char sum[GR_SHA_LEN];
62559+ unsigned char sp_role[GR_SPROLE_LEN];
62560+ struct sprole_pw *sprole_pws;
62561+ dev_t segv_device;
62562+ ino_t segv_inode;
62563+ uid_t segv_uid;
62564+ __u16 num_sprole_pws;
62565+ __u16 mode;
62566+};
62567+
62568+struct gr_arg_wrapper {
62569+ struct gr_arg *arg;
62570+ __u32 version;
62571+ __u32 size;
62572+};
62573+
62574+struct subject_map {
62575+ struct acl_subject_label *user;
62576+ struct acl_subject_label *kernel;
62577+ struct subject_map *prev;
62578+ struct subject_map *next;
62579+};
62580+
62581+struct acl_subj_map_db {
62582+ struct subject_map **s_hash;
62583+ __u32 s_size;
62584+};
62585+
62586+/* End Data Structures Section */
62587+
62588+/* Hash functions generated by empirical testing by Brad Spengler
62589+ Makes good use of the low bits of the inode. Generally 0-1 times
62590+ in loop for successful match. 0-3 for unsuccessful match.
62591+ Shift/add algorithm with modulus of table size and an XOR*/
62592+
62593+static __inline__ unsigned int
62594+rhash(const uid_t uid, const __u16 type, const unsigned int sz)
62595+{
62596+ return ((((uid + type) << (16 + type)) ^ uid) % sz);
62597+}
62598+
62599+ static __inline__ unsigned int
62600+shash(const struct acl_subject_label *userp, const unsigned int sz)
62601+{
62602+ return ((const unsigned long)userp % sz);
62603+}
62604+
62605+static __inline__ unsigned int
62606+fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
62607+{
62608+ return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
62609+}
62610+
62611+static __inline__ unsigned int
62612+nhash(const char *name, const __u16 len, const unsigned int sz)
62613+{
62614+ return full_name_hash((const unsigned char *)name, len) % sz;
62615+}
62616+
62617+#define FOR_EACH_ROLE_START(role) \
62618+ role = role_list; \
62619+ while (role) {
62620+
62621+#define FOR_EACH_ROLE_END(role) \
62622+ role = role->prev; \
62623+ }
62624+
62625+#define FOR_EACH_SUBJECT_START(role,subj,iter) \
62626+ subj = NULL; \
62627+ iter = 0; \
62628+ while (iter < role->subj_hash_size) { \
62629+ if (subj == NULL) \
62630+ subj = role->subj_hash[iter]; \
62631+ if (subj == NULL) { \
62632+ iter++; \
62633+ continue; \
62634+ }
62635+
62636+#define FOR_EACH_SUBJECT_END(subj,iter) \
62637+ subj = subj->next; \
62638+ if (subj == NULL) \
62639+ iter++; \
62640+ }
62641+
62642+
62643+#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
62644+ subj = role->hash->first; \
62645+ while (subj != NULL) {
62646+
62647+#define FOR_EACH_NESTED_SUBJECT_END(subj) \
62648+ subj = subj->next; \
62649+ }
62650+
62651+#endif
62652+
62653diff -urNp linux-2.6.39.1/include/linux/gralloc.h linux-2.6.39.1/include/linux/gralloc.h
62654--- linux-2.6.39.1/include/linux/gralloc.h 1969-12-31 19:00:00.000000000 -0500
62655+++ linux-2.6.39.1/include/linux/gralloc.h 2011-05-22 19:41:42.000000000 -0400
62656@@ -0,0 +1,9 @@
62657+#ifndef __GRALLOC_H
62658+#define __GRALLOC_H
62659+
62660+void acl_free_all(void);
62661+int acl_alloc_stack_init(unsigned long size);
62662+void *acl_alloc(unsigned long len);
62663+void *acl_alloc_num(unsigned long num, unsigned long len);
62664+
62665+#endif
62666diff -urNp linux-2.6.39.1/include/linux/grdefs.h linux-2.6.39.1/include/linux/grdefs.h
62667--- linux-2.6.39.1/include/linux/grdefs.h 1969-12-31 19:00:00.000000000 -0500
62668+++ linux-2.6.39.1/include/linux/grdefs.h 2011-05-22 19:41:42.000000000 -0400
62669@@ -0,0 +1,139 @@
62670+#ifndef GRDEFS_H
62671+#define GRDEFS_H
62672+
62673+/* Begin grsecurity status declarations */
62674+
62675+enum {
62676+ GR_READY = 0x01,
62677+ GR_STATUS_INIT = 0x00 // disabled state
62678+};
62679+
62680+/* Begin ACL declarations */
62681+
62682+/* Role flags */
62683+
62684+enum {
62685+ GR_ROLE_USER = 0x0001,
62686+ GR_ROLE_GROUP = 0x0002,
62687+ GR_ROLE_DEFAULT = 0x0004,
62688+ GR_ROLE_SPECIAL = 0x0008,
62689+ GR_ROLE_AUTH = 0x0010,
62690+ GR_ROLE_NOPW = 0x0020,
62691+ GR_ROLE_GOD = 0x0040,
62692+ GR_ROLE_LEARN = 0x0080,
62693+ GR_ROLE_TPE = 0x0100,
62694+ GR_ROLE_DOMAIN = 0x0200,
62695+ GR_ROLE_PAM = 0x0400,
62696+ GR_ROLE_PERSIST = 0x0800
62697+};
62698+
62699+/* ACL Subject and Object mode flags */
62700+enum {
62701+ GR_DELETED = 0x80000000
62702+};
62703+
62704+/* ACL Object-only mode flags */
62705+enum {
62706+ GR_READ = 0x00000001,
62707+ GR_APPEND = 0x00000002,
62708+ GR_WRITE = 0x00000004,
62709+ GR_EXEC = 0x00000008,
62710+ GR_FIND = 0x00000010,
62711+ GR_INHERIT = 0x00000020,
62712+ GR_SETID = 0x00000040,
62713+ GR_CREATE = 0x00000080,
62714+ GR_DELETE = 0x00000100,
62715+ GR_LINK = 0x00000200,
62716+ GR_AUDIT_READ = 0x00000400,
62717+ GR_AUDIT_APPEND = 0x00000800,
62718+ GR_AUDIT_WRITE = 0x00001000,
62719+ GR_AUDIT_EXEC = 0x00002000,
62720+ GR_AUDIT_FIND = 0x00004000,
62721+ GR_AUDIT_INHERIT= 0x00008000,
62722+ GR_AUDIT_SETID = 0x00010000,
62723+ GR_AUDIT_CREATE = 0x00020000,
62724+ GR_AUDIT_DELETE = 0x00040000,
62725+ GR_AUDIT_LINK = 0x00080000,
62726+ GR_PTRACERD = 0x00100000,
62727+ GR_NOPTRACE = 0x00200000,
62728+ GR_SUPPRESS = 0x00400000,
62729+ GR_NOLEARN = 0x00800000,
62730+ GR_INIT_TRANSFER= 0x01000000
62731+};
62732+
62733+#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
62734+ GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
62735+ GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
62736+
62737+/* ACL subject-only mode flags */
62738+enum {
62739+ GR_KILL = 0x00000001,
62740+ GR_VIEW = 0x00000002,
62741+ GR_PROTECTED = 0x00000004,
62742+ GR_LEARN = 0x00000008,
62743+ GR_OVERRIDE = 0x00000010,
62744+ /* just a placeholder, this mode is only used in userspace */
62745+ GR_DUMMY = 0x00000020,
62746+ GR_PROTSHM = 0x00000040,
62747+ GR_KILLPROC = 0x00000080,
62748+ GR_KILLIPPROC = 0x00000100,
62749+ /* just a placeholder, this mode is only used in userspace */
62750+ GR_NOTROJAN = 0x00000200,
62751+ GR_PROTPROCFD = 0x00000400,
62752+ GR_PROCACCT = 0x00000800,
62753+ GR_RELAXPTRACE = 0x00001000,
62754+ GR_NESTED = 0x00002000,
62755+ GR_INHERITLEARN = 0x00004000,
62756+ GR_PROCFIND = 0x00008000,
62757+ GR_POVERRIDE = 0x00010000,
62758+ GR_KERNELAUTH = 0x00020000,
62759+ GR_ATSECURE = 0x00040000
62760+};
62761+
62762+enum {
62763+ GR_PAX_ENABLE_SEGMEXEC = 0x0001,
62764+ GR_PAX_ENABLE_PAGEEXEC = 0x0002,
62765+ GR_PAX_ENABLE_MPROTECT = 0x0004,
62766+ GR_PAX_ENABLE_RANDMMAP = 0x0008,
62767+ GR_PAX_ENABLE_EMUTRAMP = 0x0010,
62768+ GR_PAX_DISABLE_SEGMEXEC = 0x0100,
62769+ GR_PAX_DISABLE_PAGEEXEC = 0x0200,
62770+ GR_PAX_DISABLE_MPROTECT = 0x0400,
62771+ GR_PAX_DISABLE_RANDMMAP = 0x0800,
62772+ GR_PAX_DISABLE_EMUTRAMP = 0x1000,
62773+};
62774+
62775+enum {
62776+ GR_ID_USER = 0x01,
62777+ GR_ID_GROUP = 0x02,
62778+};
62779+
62780+enum {
62781+ GR_ID_ALLOW = 0x01,
62782+ GR_ID_DENY = 0x02,
62783+};
62784+
62785+#define GR_CRASH_RES 31
62786+#define GR_UIDTABLE_MAX 500
62787+
62788+/* begin resource learning section */
62789+enum {
62790+ GR_RLIM_CPU_BUMP = 60,
62791+ GR_RLIM_FSIZE_BUMP = 50000,
62792+ GR_RLIM_DATA_BUMP = 10000,
62793+ GR_RLIM_STACK_BUMP = 1000,
62794+ GR_RLIM_CORE_BUMP = 10000,
62795+ GR_RLIM_RSS_BUMP = 500000,
62796+ GR_RLIM_NPROC_BUMP = 1,
62797+ GR_RLIM_NOFILE_BUMP = 5,
62798+ GR_RLIM_MEMLOCK_BUMP = 50000,
62799+ GR_RLIM_AS_BUMP = 500000,
62800+ GR_RLIM_LOCKS_BUMP = 2,
62801+ GR_RLIM_SIGPENDING_BUMP = 5,
62802+ GR_RLIM_MSGQUEUE_BUMP = 10000,
62803+ GR_RLIM_NICE_BUMP = 1,
62804+ GR_RLIM_RTPRIO_BUMP = 1,
62805+ GR_RLIM_RTTIME_BUMP = 1000000
62806+};
62807+
62808+#endif
62809diff -urNp linux-2.6.39.1/include/linux/grinternal.h linux-2.6.39.1/include/linux/grinternal.h
62810--- linux-2.6.39.1/include/linux/grinternal.h 1969-12-31 19:00:00.000000000 -0500
62811+++ linux-2.6.39.1/include/linux/grinternal.h 2011-05-22 19:41:42.000000000 -0400
62812@@ -0,0 +1,219 @@
62813+#ifndef __GRINTERNAL_H
62814+#define __GRINTERNAL_H
62815+
62816+#ifdef CONFIG_GRKERNSEC
62817+
62818+#include <linux/fs.h>
62819+#include <linux/mnt_namespace.h>
62820+#include <linux/nsproxy.h>
62821+#include <linux/gracl.h>
62822+#include <linux/grdefs.h>
62823+#include <linux/grmsg.h>
62824+
62825+void gr_add_learn_entry(const char *fmt, ...)
62826+ __attribute__ ((format (printf, 1, 2)));
62827+__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
62828+ const struct vfsmount *mnt);
62829+__u32 gr_check_create(const struct dentry *new_dentry,
62830+ const struct dentry *parent,
62831+ const struct vfsmount *mnt, const __u32 mode);
62832+int gr_check_protected_task(const struct task_struct *task);
62833+__u32 to_gr_audit(const __u32 reqmode);
62834+int gr_set_acls(const int type);
62835+int gr_apply_subject_to_task(struct task_struct *task);
62836+int gr_acl_is_enabled(void);
62837+char gr_roletype_to_char(void);
62838+
62839+void gr_handle_alertkill(struct task_struct *task);
62840+char *gr_to_filename(const struct dentry *dentry,
62841+ const struct vfsmount *mnt);
62842+char *gr_to_filename1(const struct dentry *dentry,
62843+ const struct vfsmount *mnt);
62844+char *gr_to_filename2(const struct dentry *dentry,
62845+ const struct vfsmount *mnt);
62846+char *gr_to_filename3(const struct dentry *dentry,
62847+ const struct vfsmount *mnt);
62848+
62849+extern int grsec_enable_harden_ptrace;
62850+extern int grsec_enable_link;
62851+extern int grsec_enable_fifo;
62852+extern int grsec_enable_execve;
62853+extern int grsec_enable_shm;
62854+extern int grsec_enable_execlog;
62855+extern int grsec_enable_signal;
62856+extern int grsec_enable_audit_ptrace;
62857+extern int grsec_enable_forkfail;
62858+extern int grsec_enable_time;
62859+extern int grsec_enable_rofs;
62860+extern int grsec_enable_chroot_shmat;
62861+extern int grsec_enable_chroot_findtask;
62862+extern int grsec_enable_chroot_mount;
62863+extern int grsec_enable_chroot_double;
62864+extern int grsec_enable_chroot_pivot;
62865+extern int grsec_enable_chroot_chdir;
62866+extern int grsec_enable_chroot_chmod;
62867+extern int grsec_enable_chroot_mknod;
62868+extern int grsec_enable_chroot_fchdir;
62869+extern int grsec_enable_chroot_nice;
62870+extern int grsec_enable_chroot_execlog;
62871+extern int grsec_enable_chroot_caps;
62872+extern int grsec_enable_chroot_sysctl;
62873+extern int grsec_enable_chroot_unix;
62874+extern int grsec_enable_tpe;
62875+extern int grsec_tpe_gid;
62876+extern int grsec_enable_tpe_all;
62877+extern int grsec_enable_tpe_invert;
62878+extern int grsec_enable_socket_all;
62879+extern int grsec_socket_all_gid;
62880+extern int grsec_enable_socket_client;
62881+extern int grsec_socket_client_gid;
62882+extern int grsec_enable_socket_server;
62883+extern int grsec_socket_server_gid;
62884+extern int grsec_audit_gid;
62885+extern int grsec_enable_group;
62886+extern int grsec_enable_audit_textrel;
62887+extern int grsec_enable_log_rwxmaps;
62888+extern int grsec_enable_mount;
62889+extern int grsec_enable_chdir;
62890+extern int grsec_resource_logging;
62891+extern int grsec_enable_blackhole;
62892+extern int grsec_lastack_retries;
62893+extern int grsec_lock;
62894+
62895+extern spinlock_t grsec_alert_lock;
62896+extern unsigned long grsec_alert_wtime;
62897+extern unsigned long grsec_alert_fyet;
62898+
62899+extern spinlock_t grsec_audit_lock;
62900+
62901+extern rwlock_t grsec_exec_file_lock;
62902+
62903+#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
62904+ gr_to_filename2((tsk)->exec_file->f_path.dentry, \
62905+ (tsk)->exec_file->f_vfsmnt) : "/")
62906+
62907+#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
62908+ gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
62909+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
62910+
62911+#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
62912+ gr_to_filename((tsk)->exec_file->f_path.dentry, \
62913+ (tsk)->exec_file->f_vfsmnt) : "/")
62914+
62915+#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
62916+ gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
62917+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
62918+
62919+#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
62920+
62921+#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
62922+
62923+#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
62924+ (task)->pid, (cred)->uid, \
62925+ (cred)->euid, (cred)->gid, (cred)->egid, \
62926+ gr_parent_task_fullpath(task), \
62927+ (task)->real_parent->comm, (task)->real_parent->pid, \
62928+ (pcred)->uid, (pcred)->euid, \
62929+ (pcred)->gid, (pcred)->egid
62930+
62931+#define GR_CHROOT_CAPS {{ \
62932+ CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
62933+ CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
62934+ CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
62935+ CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
62936+ CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
62937+ CAP_TO_MASK(CAP_IPC_OWNER) , 0 }}
62938+
62939+#define security_learn(normal_msg,args...) \
62940+({ \
62941+ read_lock(&grsec_exec_file_lock); \
62942+ gr_add_learn_entry(normal_msg "\n", ## args); \
62943+ read_unlock(&grsec_exec_file_lock); \
62944+})
62945+
62946+enum {
62947+ GR_DO_AUDIT,
62948+ GR_DONT_AUDIT,
62949+ /* used for non-audit messages that we shouldn't kill the task on */
62950+ GR_DONT_AUDIT_GOOD
62951+};
62952+
62953+enum {
62954+ GR_TTYSNIFF,
62955+ GR_RBAC,
62956+ GR_RBAC_STR,
62957+ GR_STR_RBAC,
62958+ GR_RBAC_MODE2,
62959+ GR_RBAC_MODE3,
62960+ GR_FILENAME,
62961+ GR_SYSCTL_HIDDEN,
62962+ GR_NOARGS,
62963+ GR_ONE_INT,
62964+ GR_ONE_INT_TWO_STR,
62965+ GR_ONE_STR,
62966+ GR_STR_INT,
62967+ GR_TWO_STR_INT,
62968+ GR_TWO_INT,
62969+ GR_TWO_U64,
62970+ GR_THREE_INT,
62971+ GR_FIVE_INT_TWO_STR,
62972+ GR_TWO_STR,
62973+ GR_THREE_STR,
62974+ GR_FOUR_STR,
62975+ GR_STR_FILENAME,
62976+ GR_FILENAME_STR,
62977+ GR_FILENAME_TWO_INT,
62978+ GR_FILENAME_TWO_INT_STR,
62979+ GR_TEXTREL,
62980+ GR_PTRACE,
62981+ GR_RESOURCE,
62982+ GR_CAP,
62983+ GR_SIG,
62984+ GR_SIG2,
62985+ GR_CRASH1,
62986+ GR_CRASH2,
62987+ GR_PSACCT,
62988+ GR_RWXMAP
62989+};
62990+
62991+#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
62992+#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
62993+#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
62994+#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
62995+#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
62996+#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
62997+#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
62998+#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
62999+#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
63000+#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
63001+#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
63002+#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
63003+#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
63004+#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
63005+#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
63006+#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
63007+#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
63008+#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
63009+#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
63010+#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
63011+#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
63012+#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
63013+#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
63014+#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
63015+#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
63016+#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
63017+#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
63018+#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
63019+#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
63020+#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
63021+#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
63022+#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
63023+#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
63024+#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
63025+#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
63026+
63027+void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
63028+
63029+#endif
63030+
63031+#endif
63032diff -urNp linux-2.6.39.1/include/linux/grmsg.h linux-2.6.39.1/include/linux/grmsg.h
63033--- linux-2.6.39.1/include/linux/grmsg.h 1969-12-31 19:00:00.000000000 -0500
63034+++ linux-2.6.39.1/include/linux/grmsg.h 2011-05-22 19:41:42.000000000 -0400
63035@@ -0,0 +1,108 @@
63036+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
63037+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
63038+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
63039+#define GR_STOPMOD_MSG "denied modification of module state by "
63040+#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
63041+#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
63042+#define GR_IOPERM_MSG "denied use of ioperm() by "
63043+#define GR_IOPL_MSG "denied use of iopl() by "
63044+#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
63045+#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
63046+#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
63047+#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
63048+#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
63049+#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
63050+#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
63051+#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
63052+#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
63053+#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
63054+#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
63055+#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
63056+#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
63057+#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
63058+#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
63059+#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
63060+#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
63061+#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
63062+#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
63063+#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
63064+#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
63065+#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
63066+#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
63067+#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
63068+#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
63069+#define GR_NPROC_MSG "denied overstep of process limit by "
63070+#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
63071+#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
63072+#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
63073+#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
63074+#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
63075+#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
63076+#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
63077+#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
63078+#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
63079+#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
63080+#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
63081+#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
63082+#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
63083+#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
63084+#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
63085+#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
63086+#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
63087+#define GR_INITF_ACL_MSG "init_variables() failed %s by "
63088+#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
63089+#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
63090+#define GR_SHUTS_ACL_MSG "shutdown auth success for "
63091+#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
63092+#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
63093+#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
63094+#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
63095+#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
63096+#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
63097+#define GR_ENABLEF_ACL_MSG "unable to load %s for "
63098+#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
63099+#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
63100+#define GR_RELOADF_ACL_MSG "failed reload of %s for "
63101+#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
63102+#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
63103+#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
63104+#define GR_SPROLEF_ACL_MSG "special role %s failure for "
63105+#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
63106+#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
63107+#define GR_INVMODE_ACL_MSG "invalid mode %d by "
63108+#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
63109+#define GR_FAILFORK_MSG "failed fork with errno %s by "
63110+#define GR_NICE_CHROOT_MSG "denied priority change by "
63111+#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
63112+#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
63113+#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
63114+#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
63115+#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
63116+#define GR_TIME_MSG "time set by "
63117+#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
63118+#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
63119+#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
63120+#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
63121+#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
63122+#define GR_BIND_MSG "denied bind() by "
63123+#define GR_CONNECT_MSG "denied connect() by "
63124+#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
63125+#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
63126+#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
63127+#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
63128+#define GR_CAP_ACL_MSG "use of %s denied for "
63129+#define GR_CAP_ACL_MSG2 "use of %s permitted for "
63130+#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
63131+#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
63132+#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
63133+#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
63134+#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
63135+#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
63136+#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
63137+#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
63138+#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
63139+#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
63140+#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
63141+#define GR_VM86_MSG "denied use of vm86 by "
63142+#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
63143+#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
63144diff -urNp linux-2.6.39.1/include/linux/grsecurity.h linux-2.6.39.1/include/linux/grsecurity.h
63145--- linux-2.6.39.1/include/linux/grsecurity.h 1969-12-31 19:00:00.000000000 -0500
63146+++ linux-2.6.39.1/include/linux/grsecurity.h 2011-05-22 19:41:42.000000000 -0400
63147@@ -0,0 +1,212 @@
63148+#ifndef GR_SECURITY_H
63149+#define GR_SECURITY_H
63150+#include <linux/fs.h>
63151+#include <linux/fs_struct.h>
63152+#include <linux/binfmts.h>
63153+#include <linux/gracl.h>
63154+#include <linux/compat.h>
63155+
63156+/* notify of brain-dead configs */
63157+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
63158+#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
63159+#endif
63160+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
63161+#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
63162+#endif
63163+#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
63164+#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
63165+#endif
63166+#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
63167+#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
63168+#endif
63169+#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
63170+#error "CONFIG_PAX enabled, but no PaX options are enabled."
63171+#endif
63172+
63173+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
63174+void gr_handle_brute_check(void);
63175+void gr_handle_kernel_exploit(void);
63176+int gr_process_user_ban(void);
63177+
63178+char gr_roletype_to_char(void);
63179+
63180+int gr_acl_enable_at_secure(void);
63181+
63182+int gr_check_user_change(int real, int effective, int fs);
63183+int gr_check_group_change(int real, int effective, int fs);
63184+
63185+void gr_del_task_from_ip_table(struct task_struct *p);
63186+
63187+int gr_pid_is_chrooted(struct task_struct *p);
63188+int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
63189+int gr_handle_chroot_nice(void);
63190+int gr_handle_chroot_sysctl(const int op);
63191+int gr_handle_chroot_setpriority(struct task_struct *p,
63192+ const int niceval);
63193+int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
63194+int gr_handle_chroot_chroot(const struct dentry *dentry,
63195+ const struct vfsmount *mnt);
63196+int gr_handle_chroot_caps(struct path *path);
63197+void gr_handle_chroot_chdir(struct path *path);
63198+int gr_handle_chroot_chmod(const struct dentry *dentry,
63199+ const struct vfsmount *mnt, const int mode);
63200+int gr_handle_chroot_mknod(const struct dentry *dentry,
63201+ const struct vfsmount *mnt, const int mode);
63202+int gr_handle_chroot_mount(const struct dentry *dentry,
63203+ const struct vfsmount *mnt,
63204+ const char *dev_name);
63205+int gr_handle_chroot_pivot(void);
63206+int gr_handle_chroot_unix(struct pid *pid);
63207+
63208+int gr_handle_rawio(const struct inode *inode);
63209+int gr_handle_nproc(void);
63210+
63211+void gr_handle_ioperm(void);
63212+void gr_handle_iopl(void);
63213+
63214+int gr_tpe_allow(const struct file *file);
63215+
63216+void gr_set_chroot_entries(struct task_struct *task, struct path *path);
63217+void gr_clear_chroot_entries(struct task_struct *task);
63218+
63219+void gr_log_forkfail(const int retval);
63220+void gr_log_timechange(void);
63221+void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
63222+void gr_log_chdir(const struct dentry *dentry,
63223+ const struct vfsmount *mnt);
63224+void gr_log_chroot_exec(const struct dentry *dentry,
63225+ const struct vfsmount *mnt);
63226+void gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv);
63227+#ifdef CONFIG_COMPAT
63228+void gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv);
63229+#endif
63230+void gr_log_remount(const char *devname, const int retval);
63231+void gr_log_unmount(const char *devname, const int retval);
63232+void gr_log_mount(const char *from, const char *to, const int retval);
63233+void gr_log_textrel(struct vm_area_struct *vma);
63234+void gr_log_rwxmmap(struct file *file);
63235+void gr_log_rwxmprotect(struct file *file);
63236+
63237+int gr_handle_follow_link(const struct inode *parent,
63238+ const struct inode *inode,
63239+ const struct dentry *dentry,
63240+ const struct vfsmount *mnt);
63241+int gr_handle_fifo(const struct dentry *dentry,
63242+ const struct vfsmount *mnt,
63243+ const struct dentry *dir, const int flag,
63244+ const int acc_mode);
63245+int gr_handle_hardlink(const struct dentry *dentry,
63246+ const struct vfsmount *mnt,
63247+ struct inode *inode,
63248+ const int mode, const char *to);
63249+
63250+int gr_is_capable(const int cap);
63251+int gr_is_capable_nolog(const int cap);
63252+void gr_learn_resource(const struct task_struct *task, const int limit,
63253+ const unsigned long wanted, const int gt);
63254+void gr_copy_label(struct task_struct *tsk);
63255+void gr_handle_crash(struct task_struct *task, const int sig);
63256+int gr_handle_signal(const struct task_struct *p, const int sig);
63257+int gr_check_crash_uid(const uid_t uid);
63258+int gr_check_protected_task(const struct task_struct *task);
63259+int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
63260+int gr_acl_handle_mmap(const struct file *file,
63261+ const unsigned long prot);
63262+int gr_acl_handle_mprotect(const struct file *file,
63263+ const unsigned long prot);
63264+int gr_check_hidden_task(const struct task_struct *tsk);
63265+__u32 gr_acl_handle_truncate(const struct dentry *dentry,
63266+ const struct vfsmount *mnt);
63267+__u32 gr_acl_handle_utime(const struct dentry *dentry,
63268+ const struct vfsmount *mnt);
63269+__u32 gr_acl_handle_access(const struct dentry *dentry,
63270+ const struct vfsmount *mnt, const int fmode);
63271+__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
63272+ const struct vfsmount *mnt, mode_t mode);
63273+__u32 gr_acl_handle_chmod(const struct dentry *dentry,
63274+ const struct vfsmount *mnt, mode_t mode);
63275+__u32 gr_acl_handle_chown(const struct dentry *dentry,
63276+ const struct vfsmount *mnt);
63277+__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
63278+ const struct vfsmount *mnt);
63279+int gr_handle_ptrace(struct task_struct *task, const long request);
63280+int gr_handle_proc_ptrace(struct task_struct *task);
63281+__u32 gr_acl_handle_execve(const struct dentry *dentry,
63282+ const struct vfsmount *mnt);
63283+int gr_check_crash_exec(const struct file *filp);
63284+int gr_acl_is_enabled(void);
63285+void gr_set_kernel_label(struct task_struct *task);
63286+void gr_set_role_label(struct task_struct *task, const uid_t uid,
63287+ const gid_t gid);
63288+int gr_set_proc_label(const struct dentry *dentry,
63289+ const struct vfsmount *mnt,
63290+ const int unsafe_share);
63291+__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
63292+ const struct vfsmount *mnt);
63293+__u32 gr_acl_handle_open(const struct dentry *dentry,
63294+ const struct vfsmount *mnt, const int fmode);
63295+__u32 gr_acl_handle_creat(const struct dentry *dentry,
63296+ const struct dentry *p_dentry,
63297+ const struct vfsmount *p_mnt, const int fmode,
63298+ const int imode);
63299+void gr_handle_create(const struct dentry *dentry,
63300+ const struct vfsmount *mnt);
63301+__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
63302+ const struct dentry *parent_dentry,
63303+ const struct vfsmount *parent_mnt,
63304+ const int mode);
63305+__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
63306+ const struct dentry *parent_dentry,
63307+ const struct vfsmount *parent_mnt);
63308+__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
63309+ const struct vfsmount *mnt);
63310+void gr_handle_delete(const ino_t ino, const dev_t dev);
63311+__u32 gr_acl_handle_unlink(const struct dentry *dentry,
63312+ const struct vfsmount *mnt);
63313+__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
63314+ const struct dentry *parent_dentry,
63315+ const struct vfsmount *parent_mnt,
63316+ const char *from);
63317+__u32 gr_acl_handle_link(const struct dentry *new_dentry,
63318+ const struct dentry *parent_dentry,
63319+ const struct vfsmount *parent_mnt,
63320+ const struct dentry *old_dentry,
63321+ const struct vfsmount *old_mnt, const char *to);
63322+int gr_acl_handle_rename(struct dentry *new_dentry,
63323+ struct dentry *parent_dentry,
63324+ const struct vfsmount *parent_mnt,
63325+ struct dentry *old_dentry,
63326+ struct inode *old_parent_inode,
63327+ struct vfsmount *old_mnt, const char *newname);
63328+void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
63329+ struct dentry *old_dentry,
63330+ struct dentry *new_dentry,
63331+ struct vfsmount *mnt, const __u8 replace);
63332+__u32 gr_check_link(const struct dentry *new_dentry,
63333+ const struct dentry *parent_dentry,
63334+ const struct vfsmount *parent_mnt,
63335+ const struct dentry *old_dentry,
63336+ const struct vfsmount *old_mnt);
63337+int gr_acl_handle_filldir(const struct file *file, const char *name,
63338+ const unsigned int namelen, const ino_t ino);
63339+
63340+__u32 gr_acl_handle_unix(const struct dentry *dentry,
63341+ const struct vfsmount *mnt);
63342+void gr_acl_handle_exit(void);
63343+void gr_acl_handle_psacct(struct task_struct *task, const long code);
63344+int gr_acl_handle_procpidmem(const struct task_struct *task);
63345+int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
63346+int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
63347+void gr_audit_ptrace(struct task_struct *task);
63348+dev_t gr_get_dev_from_dentry(struct dentry *dentry);
63349+
63350+#ifdef CONFIG_GRKERNSEC
63351+void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
63352+void gr_handle_vm86(void);
63353+void gr_handle_mem_readwrite(u64 from, u64 to);
63354+
63355+extern int grsec_enable_dmesg;
63356+extern int grsec_disable_privio;
63357+#endif
63358+
63359+#endif
63360diff -urNp linux-2.6.39.1/include/linux/grsock.h linux-2.6.39.1/include/linux/grsock.h
63361--- linux-2.6.39.1/include/linux/grsock.h 1969-12-31 19:00:00.000000000 -0500
63362+++ linux-2.6.39.1/include/linux/grsock.h 2011-05-22 19:41:42.000000000 -0400
63363@@ -0,0 +1,19 @@
63364+#ifndef __GRSOCK_H
63365+#define __GRSOCK_H
63366+
63367+extern void gr_attach_curr_ip(const struct sock *sk);
63368+extern int gr_handle_sock_all(const int family, const int type,
63369+ const int protocol);
63370+extern int gr_handle_sock_server(const struct sockaddr *sck);
63371+extern int gr_handle_sock_server_other(const struct sock *sck);
63372+extern int gr_handle_sock_client(const struct sockaddr *sck);
63373+extern int gr_search_connect(struct socket * sock,
63374+ struct sockaddr_in * addr);
63375+extern int gr_search_bind(struct socket * sock,
63376+ struct sockaddr_in * addr);
63377+extern int gr_search_listen(struct socket * sock);
63378+extern int gr_search_accept(struct socket * sock);
63379+extern int gr_search_socket(const int domain, const int type,
63380+ const int protocol);
63381+
63382+#endif
63383diff -urNp linux-2.6.39.1/include/linux/highmem.h linux-2.6.39.1/include/linux/highmem.h
63384--- linux-2.6.39.1/include/linux/highmem.h 2011-05-19 00:06:34.000000000 -0400
63385+++ linux-2.6.39.1/include/linux/highmem.h 2011-05-22 19:36:33.000000000 -0400
63386@@ -185,6 +185,18 @@ static inline void clear_highpage(struct
63387 kunmap_atomic(kaddr, KM_USER0);
63388 }
63389
63390+static inline void sanitize_highpage(struct page *page)
63391+{
63392+ void *kaddr;
63393+ unsigned long flags;
63394+
63395+ local_irq_save(flags);
63396+ kaddr = kmap_atomic(page, KM_CLEARPAGE);
63397+ clear_page(kaddr);
63398+ kunmap_atomic(kaddr, KM_CLEARPAGE);
63399+ local_irq_restore(flags);
63400+}
63401+
63402 static inline void zero_user_segments(struct page *page,
63403 unsigned start1, unsigned end1,
63404 unsigned start2, unsigned end2)
63405diff -urNp linux-2.6.39.1/include/linux/i2o.h linux-2.6.39.1/include/linux/i2o.h
63406--- linux-2.6.39.1/include/linux/i2o.h 2011-05-19 00:06:34.000000000 -0400
63407+++ linux-2.6.39.1/include/linux/i2o.h 2011-05-22 19:36:33.000000000 -0400
63408@@ -564,7 +564,7 @@ struct i2o_controller {
63409 struct i2o_device *exec; /* Executive */
63410 #if BITS_PER_LONG == 64
63411 spinlock_t context_list_lock; /* lock for context_list */
63412- atomic_t context_list_counter; /* needed for unique contexts */
63413+ atomic_unchecked_t context_list_counter; /* needed for unique contexts */
63414 struct list_head context_list; /* list of context id's
63415 and pointers */
63416 #endif
63417diff -urNp linux-2.6.39.1/include/linux/if_phonet.h linux-2.6.39.1/include/linux/if_phonet.h
63418--- linux-2.6.39.1/include/linux/if_phonet.h 2011-05-19 00:06:34.000000000 -0400
63419+++ linux-2.6.39.1/include/linux/if_phonet.h 2011-05-22 19:36:33.000000000 -0400
63420@@ -13,7 +13,7 @@
63421 #define PHONET_DEV_MTU PHONET_MAX_MTU
63422
63423 #ifdef __KERNEL__
63424-extern struct header_ops phonet_header_ops;
63425+extern const struct header_ops phonet_header_ops;
63426 #endif
63427
63428 #endif
63429diff -urNp linux-2.6.39.1/include/linux/init.h linux-2.6.39.1/include/linux/init.h
63430--- linux-2.6.39.1/include/linux/init.h 2011-05-19 00:06:34.000000000 -0400
63431+++ linux-2.6.39.1/include/linux/init.h 2011-05-22 19:36:33.000000000 -0400
63432@@ -293,13 +293,13 @@ void __init parse_early_options(char *cm
63433
63434 /* Each module must use one module_init(). */
63435 #define module_init(initfn) \
63436- static inline initcall_t __inittest(void) \
63437+ static inline __used initcall_t __inittest(void) \
63438 { return initfn; } \
63439 int init_module(void) __attribute__((alias(#initfn)));
63440
63441 /* This is only required if you want to be unloadable. */
63442 #define module_exit(exitfn) \
63443- static inline exitcall_t __exittest(void) \
63444+ static inline __used exitcall_t __exittest(void) \
63445 { return exitfn; } \
63446 void cleanup_module(void) __attribute__((alias(#exitfn)));
63447
63448diff -urNp linux-2.6.39.1/include/linux/init_task.h linux-2.6.39.1/include/linux/init_task.h
63449--- linux-2.6.39.1/include/linux/init_task.h 2011-05-19 00:06:34.000000000 -0400
63450+++ linux-2.6.39.1/include/linux/init_task.h 2011-05-22 19:36:33.000000000 -0400
63451@@ -83,6 +83,12 @@ extern struct group_info init_groups;
63452 #define INIT_IDS
63453 #endif
63454
63455+#ifdef CONFIG_X86
63456+#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
63457+#else
63458+#define INIT_TASK_THREAD_INFO
63459+#endif
63460+
63461 /*
63462 * Because of the reduced scope of CAP_SETPCAP when filesystem
63463 * capabilities are in effect, it is safe to allow CAP_SETPCAP to
63464@@ -163,6 +169,7 @@ extern struct cred init_cred;
63465 RCU_INIT_POINTER(.cred, &init_cred), \
63466 .comm = "swapper", \
63467 .thread = INIT_THREAD, \
63468+ INIT_TASK_THREAD_INFO \
63469 .fs = &init_fs, \
63470 .files = &init_files, \
63471 .signal = &init_signals, \
63472diff -urNp linux-2.6.39.1/include/linux/interrupt.h linux-2.6.39.1/include/linux/interrupt.h
63473--- linux-2.6.39.1/include/linux/interrupt.h 2011-05-19 00:06:34.000000000 -0400
63474+++ linux-2.6.39.1/include/linux/interrupt.h 2011-05-22 19:36:33.000000000 -0400
63475@@ -422,7 +422,7 @@ enum
63476 /* map softirq index to softirq name. update 'softirq_to_name' in
63477 * kernel/softirq.c when adding a new softirq.
63478 */
63479-extern char *softirq_to_name[NR_SOFTIRQS];
63480+extern const char * const softirq_to_name[NR_SOFTIRQS];
63481
63482 /* softirq mask and active fields moved to irq_cpustat_t in
63483 * asm/hardirq.h to get better cache usage. KAO
63484@@ -430,12 +430,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
63485
63486 struct softirq_action
63487 {
63488- void (*action)(struct softirq_action *);
63489+ void (*action)(void);
63490 };
63491
63492 asmlinkage void do_softirq(void);
63493 asmlinkage void __do_softirq(void);
63494-extern void open_softirq(int nr, void (*action)(struct softirq_action *));
63495+extern void open_softirq(int nr, void (*action)(void));
63496 extern void softirq_init(void);
63497 static inline void __raise_softirq_irqoff(unsigned int nr)
63498 {
63499diff -urNp linux-2.6.39.1/include/linux/iommu.h linux-2.6.39.1/include/linux/iommu.h
63500--- linux-2.6.39.1/include/linux/iommu.h 2011-05-19 00:06:34.000000000 -0400
63501+++ linux-2.6.39.1/include/linux/iommu.h 2011-05-22 19:36:33.000000000 -0400
63502@@ -49,7 +49,7 @@ struct iommu_ops {
63503
63504 #ifdef CONFIG_IOMMU_API
63505
63506-extern void register_iommu(struct iommu_ops *ops);
63507+extern void register_iommu(const struct iommu_ops *ops);
63508 extern bool iommu_found(void);
63509 extern struct iommu_domain *iommu_domain_alloc(void);
63510 extern void iommu_domain_free(struct iommu_domain *domain);
63511diff -urNp linux-2.6.39.1/include/linux/ipmi.h linux-2.6.39.1/include/linux/ipmi.h
63512--- linux-2.6.39.1/include/linux/ipmi.h 2011-05-19 00:06:34.000000000 -0400
63513+++ linux-2.6.39.1/include/linux/ipmi.h 2011-05-22 19:36:33.000000000 -0400
63514@@ -282,7 +282,7 @@ struct ipmi_user_hndl {
63515
63516 /* Create a new user of the IPMI layer on the given interface number. */
63517 int ipmi_create_user(unsigned int if_num,
63518- struct ipmi_user_hndl *handler,
63519+ const struct ipmi_user_hndl *handler,
63520 void *handler_data,
63521 ipmi_user_t *user);
63522
63523diff -urNp linux-2.6.39.1/include/linux/kallsyms.h linux-2.6.39.1/include/linux/kallsyms.h
63524--- linux-2.6.39.1/include/linux/kallsyms.h 2011-05-19 00:06:34.000000000 -0400
63525+++ linux-2.6.39.1/include/linux/kallsyms.h 2011-05-22 22:52:54.000000000 -0400
63526@@ -15,7 +15,8 @@
63527
63528 struct module;
63529
63530-#ifdef CONFIG_KALLSYMS
63531+#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
63532+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
63533 /* Lookup the address for a symbol. Returns 0 if not found. */
63534 unsigned long kallsyms_lookup_name(const char *name);
63535
63536@@ -99,6 +100,16 @@ static inline int lookup_symbol_attrs(un
63537 /* Stupid that this does nothing, but I didn't create this mess. */
63538 #define __print_symbol(fmt, addr)
63539 #endif /*CONFIG_KALLSYMS*/
63540+#else /* when included by kallsyms.c, vsnprintf.c, or
63541+ arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
63542+extern void __print_symbol(const char *fmt, unsigned long address);
63543+extern int sprint_backtrace(char *buffer, unsigned long address);
63544+extern int sprint_symbol(char *buffer, unsigned long address);
63545+const char *kallsyms_lookup(unsigned long addr,
63546+ unsigned long *symbolsize,
63547+ unsigned long *offset,
63548+ char **modname, char *namebuf);
63549+#endif
63550
63551 /* This macro allows us to keep printk typechecking */
63552 static void __check_printsym_format(const char *fmt, ...)
63553diff -urNp linux-2.6.39.1/include/linux/kgdb.h linux-2.6.39.1/include/linux/kgdb.h
63554--- linux-2.6.39.1/include/linux/kgdb.h 2011-05-19 00:06:34.000000000 -0400
63555+++ linux-2.6.39.1/include/linux/kgdb.h 2011-05-22 19:36:33.000000000 -0400
63556@@ -53,7 +53,7 @@ extern int kgdb_connected;
63557 extern int kgdb_io_module_registered;
63558
63559 extern atomic_t kgdb_setting_breakpoint;
63560-extern atomic_t kgdb_cpu_doing_single_step;
63561+extern atomic_unchecked_t kgdb_cpu_doing_single_step;
63562
63563 extern struct task_struct *kgdb_usethread;
63564 extern struct task_struct *kgdb_contthread;
63565@@ -269,22 +269,22 @@ struct kgdb_arch {
63566 */
63567 struct kgdb_io {
63568 const char *name;
63569- int (*read_char) (void);
63570- void (*write_char) (u8);
63571- void (*flush) (void);
63572- int (*init) (void);
63573- void (*pre_exception) (void);
63574- void (*post_exception) (void);
63575+ int (* const read_char) (void);
63576+ void (* const write_char) (u8);
63577+ void (* const flush) (void);
63578+ int (* const init) (void);
63579+ void (* const pre_exception) (void);
63580+ void (* const post_exception) (void);
63581 int is_console;
63582 };
63583
63584-extern struct kgdb_arch arch_kgdb_ops;
63585+extern const struct kgdb_arch arch_kgdb_ops;
63586
63587 extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
63588
63589-extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
63590-extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
63591-extern struct kgdb_io *dbg_io_ops;
63592+extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
63593+extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
63594+extern const struct kgdb_io *dbg_io_ops;
63595
63596 extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
63597 extern char *kgdb_mem2hex(char *mem, char *buf, int count);
63598diff -urNp linux-2.6.39.1/include/linux/kmod.h linux-2.6.39.1/include/linux/kmod.h
63599--- linux-2.6.39.1/include/linux/kmod.h 2011-05-19 00:06:34.000000000 -0400
63600+++ linux-2.6.39.1/include/linux/kmod.h 2011-05-22 19:41:42.000000000 -0400
63601@@ -33,6 +33,8 @@ extern char modprobe_path[]; /* for sysc
63602 * usually useless though. */
63603 extern int __request_module(bool wait, const char *name, ...) \
63604 __attribute__((format(printf, 2, 3)));
63605+extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
63606+ __attribute__((format(printf, 3, 4)));
63607 #define request_module(mod...) __request_module(true, mod)
63608 #define request_module_nowait(mod...) __request_module(false, mod)
63609 #define try_then_request_module(x, mod...) \
63610diff -urNp linux-2.6.39.1/include/linux/kvm_host.h linux-2.6.39.1/include/linux/kvm_host.h
63611--- linux-2.6.39.1/include/linux/kvm_host.h 2011-05-19 00:06:34.000000000 -0400
63612+++ linux-2.6.39.1/include/linux/kvm_host.h 2011-05-22 19:36:33.000000000 -0400
63613@@ -302,7 +302,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
63614 void vcpu_load(struct kvm_vcpu *vcpu);
63615 void vcpu_put(struct kvm_vcpu *vcpu);
63616
63617-int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
63618+int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
63619 struct module *module);
63620 void kvm_exit(void);
63621
63622@@ -442,7 +442,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
63623 struct kvm_guest_debug *dbg);
63624 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
63625
63626-int kvm_arch_init(void *opaque);
63627+int kvm_arch_init(const void *opaque);
63628 void kvm_arch_exit(void);
63629
63630 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
63631diff -urNp linux-2.6.39.1/include/linux/lapb.h linux-2.6.39.1/include/linux/lapb.h
63632--- linux-2.6.39.1/include/linux/lapb.h 2011-05-19 00:06:34.000000000 -0400
63633+++ linux-2.6.39.1/include/linux/lapb.h 2011-05-22 19:36:33.000000000 -0400
63634@@ -44,7 +44,7 @@ struct lapb_parms_struct {
63635 unsigned int mode;
63636 };
63637
63638-extern int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks);
63639+extern int lapb_register(struct net_device *dev, const struct lapb_register_struct *callbacks);
63640 extern int lapb_unregister(struct net_device *dev);
63641 extern int lapb_getparms(struct net_device *dev, struct lapb_parms_struct *parms);
63642 extern int lapb_setparms(struct net_device *dev, struct lapb_parms_struct *parms);
63643diff -urNp linux-2.6.39.1/include/linux/lcd.h linux-2.6.39.1/include/linux/lcd.h
63644--- linux-2.6.39.1/include/linux/lcd.h 2011-05-19 00:06:34.000000000 -0400
63645+++ linux-2.6.39.1/include/linux/lcd.h 2011-05-22 19:36:33.000000000 -0400
63646@@ -60,7 +60,7 @@ struct lcd_device {
63647 points to something in the body of that driver, it is also invalid. */
63648 struct mutex ops_lock;
63649 /* If this is NULL, the backing module is unloaded */
63650- struct lcd_ops *ops;
63651+ const struct lcd_ops *ops;
63652 /* Serialise access to set_power method */
63653 struct mutex update_lock;
63654 /* The framebuffer notifier block */
63655@@ -101,7 +101,7 @@ static inline void lcd_set_power(struct
63656 }
63657
63658 extern struct lcd_device *lcd_device_register(const char *name,
63659- struct device *parent, void *devdata, struct lcd_ops *ops);
63660+ struct device *parent, void *devdata, const struct lcd_ops *ops);
63661 extern void lcd_device_unregister(struct lcd_device *ld);
63662
63663 #define to_lcd_device(obj) container_of(obj, struct lcd_device, dev)
63664diff -urNp linux-2.6.39.1/include/linux/libata.h linux-2.6.39.1/include/linux/libata.h
63665--- linux-2.6.39.1/include/linux/libata.h 2011-05-19 00:06:34.000000000 -0400
63666+++ linux-2.6.39.1/include/linux/libata.h 2011-05-22 19:36:33.000000000 -0400
63667@@ -524,11 +524,11 @@ struct ata_ioports {
63668
63669 struct ata_host {
63670 spinlock_t lock;
63671- struct device *dev;
63672+ struct device *dev;
63673 void __iomem * const *iomap;
63674 unsigned int n_ports;
63675 void *private_data;
63676- struct ata_port_operations *ops;
63677+ const struct ata_port_operations *ops;
63678 unsigned long flags;
63679
63680 struct mutex eh_mutex;
63681@@ -719,7 +719,7 @@ struct ata_link {
63682
63683 struct ata_port {
63684 struct Scsi_Host *scsi_host; /* our co-allocated scsi host */
63685- struct ata_port_operations *ops;
63686+ const struct ata_port_operations *ops;
63687 spinlock_t *lock;
63688 /* Flags owned by the EH context. Only EH should touch these once the
63689 port is active */
63690@@ -907,7 +907,7 @@ struct ata_port_info {
63691 unsigned long pio_mask;
63692 unsigned long mwdma_mask;
63693 unsigned long udma_mask;
63694- struct ata_port_operations *port_ops;
63695+ const struct ata_port_operations *port_ops;
63696 void *private_data;
63697 };
63698
63699@@ -931,7 +931,7 @@ extern const unsigned long sata_deb_timi
63700 extern const unsigned long sata_deb_timing_hotplug[];
63701 extern const unsigned long sata_deb_timing_long[];
63702
63703-extern struct ata_port_operations ata_dummy_port_ops;
63704+extern const struct ata_port_operations ata_dummy_port_ops;
63705 extern const struct ata_port_info ata_dummy_port_info;
63706
63707 static inline const unsigned long *
63708@@ -977,7 +977,7 @@ extern int ata_host_activate(struct ata_
63709 struct scsi_host_template *sht);
63710 extern void ata_host_detach(struct ata_host *host);
63711 extern void ata_host_init(struct ata_host *, struct device *,
63712- unsigned long, struct ata_port_operations *);
63713+ unsigned long, const struct ata_port_operations *);
63714 extern int ata_scsi_detect(struct scsi_host_template *sht);
63715 extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
63716 extern int ata_scsi_queuecmd(struct Scsi_Host *h, struct scsi_cmnd *cmd);
63717diff -urNp linux-2.6.39.1/include/linux/lockd/bind.h linux-2.6.39.1/include/linux/lockd/bind.h
63718--- linux-2.6.39.1/include/linux/lockd/bind.h 2011-05-19 00:06:34.000000000 -0400
63719+++ linux-2.6.39.1/include/linux/lockd/bind.h 2011-05-22 19:36:33.000000000 -0400
63720@@ -23,13 +23,13 @@ struct svc_rqst;
63721 * This is the set of functions for lockd->nfsd communication
63722 */
63723 struct nlmsvc_binding {
63724- __be32 (*fopen)(struct svc_rqst *,
63725+ __be32 (* const fopen)(struct svc_rqst *,
63726 struct nfs_fh *,
63727 struct file **);
63728- void (*fclose)(struct file *);
63729+ void (* const fclose)(struct file *);
63730 };
63731
63732-extern struct nlmsvc_binding * nlmsvc_ops;
63733+extern const struct nlmsvc_binding * nlmsvc_ops;
63734
63735 /*
63736 * Similar to nfs_client_initdata, but without the NFS-specific
63737diff -urNp linux-2.6.39.1/include/linux/mfd/abx500.h linux-2.6.39.1/include/linux/mfd/abx500.h
63738--- linux-2.6.39.1/include/linux/mfd/abx500.h 2011-05-19 00:06:34.000000000 -0400
63739+++ linux-2.6.39.1/include/linux/mfd/abx500.h 2011-05-22 19:36:33.000000000 -0400
63740@@ -227,6 +227,6 @@ struct abx500_ops {
63741 int (*startup_irq_enabled) (struct device *, unsigned int);
63742 };
63743
63744-int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops);
63745+int abx500_register_ops(struct device *core_dev, const struct abx500_ops *ops);
63746 void abx500_remove_ops(struct device *dev);
63747 #endif
63748diff -urNp linux-2.6.39.1/include/linux/mm.h linux-2.6.39.1/include/linux/mm.h
63749--- linux-2.6.39.1/include/linux/mm.h 2011-05-19 00:06:34.000000000 -0400
63750+++ linux-2.6.39.1/include/linux/mm.h 2011-05-22 19:36:33.000000000 -0400
63751@@ -113,7 +113,14 @@ extern unsigned int kobjsize(const void
63752
63753 #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
63754 #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
63755+
63756+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
63757+#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
63758+#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
63759+#else
63760 #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
63761+#endif
63762+
63763 #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
63764 #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
63765
63766@@ -1010,34 +1017,6 @@ int set_page_dirty(struct page *page);
63767 int set_page_dirty_lock(struct page *page);
63768 int clear_page_dirty_for_io(struct page *page);
63769
63770-/* Is the vma a continuation of the stack vma above it? */
63771-static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
63772-{
63773- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
63774-}
63775-
63776-static inline int stack_guard_page_start(struct vm_area_struct *vma,
63777- unsigned long addr)
63778-{
63779- return (vma->vm_flags & VM_GROWSDOWN) &&
63780- (vma->vm_start == addr) &&
63781- !vma_growsdown(vma->vm_prev, addr);
63782-}
63783-
63784-/* Is the vma a continuation of the stack vma below it? */
63785-static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
63786-{
63787- return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
63788-}
63789-
63790-static inline int stack_guard_page_end(struct vm_area_struct *vma,
63791- unsigned long addr)
63792-{
63793- return (vma->vm_flags & VM_GROWSUP) &&
63794- (vma->vm_end == addr) &&
63795- !vma_growsup(vma->vm_next, addr);
63796-}
63797-
63798 extern unsigned long move_page_tables(struct vm_area_struct *vma,
63799 unsigned long old_addr, struct vm_area_struct *new_vma,
63800 unsigned long new_addr, unsigned long len);
63801@@ -1189,6 +1168,15 @@ struct shrinker {
63802 extern void register_shrinker(struct shrinker *);
63803 extern void unregister_shrinker(struct shrinker *);
63804
63805+#ifdef CONFIG_MMU
63806+pgprot_t vm_get_page_prot(unsigned long vm_flags);
63807+#else
63808+static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
63809+{
63810+ return __pgprot(0);
63811+}
63812+#endif
63813+
63814 int vma_wants_writenotify(struct vm_area_struct *vma);
63815
63816 extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
63817@@ -1476,6 +1464,7 @@ out:
63818 }
63819
63820 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
63821+extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
63822
63823 extern unsigned long do_brk(unsigned long, unsigned long);
63824
63825@@ -1532,6 +1521,10 @@ extern struct vm_area_struct * find_vma(
63826 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
63827 struct vm_area_struct **pprev);
63828
63829+extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
63830+extern __must_check long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
63831+extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
63832+
63833 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
63834 NULL if none. Assume start_addr < end_addr. */
63835 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
63836@@ -1548,15 +1541,6 @@ static inline unsigned long vma_pages(st
63837 return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
63838 }
63839
63840-#ifdef CONFIG_MMU
63841-pgprot_t vm_get_page_prot(unsigned long vm_flags);
63842-#else
63843-static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
63844-{
63845- return __pgprot(0);
63846-}
63847-#endif
63848-
63849 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
63850 int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
63851 unsigned long pfn, unsigned long size, pgprot_t);
63852@@ -1668,7 +1652,7 @@ extern int unpoison_memory(unsigned long
63853 extern int sysctl_memory_failure_early_kill;
63854 extern int sysctl_memory_failure_recovery;
63855 extern void shake_page(struct page *p, int access);
63856-extern atomic_long_t mce_bad_pages;
63857+extern atomic_long_unchecked_t mce_bad_pages;
63858 extern int soft_offline_page(struct page *page, int flags);
63859
63860 extern void dump_page(struct page *page);
63861@@ -1682,5 +1666,11 @@ extern void copy_user_huge_page(struct p
63862 unsigned int pages_per_huge_page);
63863 #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */
63864
63865+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
63866+extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
63867+#else
63868+static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
63869+#endif
63870+
63871 #endif /* __KERNEL__ */
63872 #endif /* _LINUX_MM_H */
63873diff -urNp linux-2.6.39.1/include/linux/mm_types.h linux-2.6.39.1/include/linux/mm_types.h
63874--- linux-2.6.39.1/include/linux/mm_types.h 2011-05-19 00:06:34.000000000 -0400
63875+++ linux-2.6.39.1/include/linux/mm_types.h 2011-05-22 19:36:33.000000000 -0400
63876@@ -183,6 +183,8 @@ struct vm_area_struct {
63877 #ifdef CONFIG_NUMA
63878 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
63879 #endif
63880+
63881+ struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
63882 };
63883
63884 struct core_thread {
63885@@ -317,6 +319,24 @@ struct mm_struct {
63886 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
63887 pgtable_t pmd_huge_pte; /* protected by page_table_lock */
63888 #endif
63889+
63890+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
63891+ unsigned long pax_flags;
63892+#endif
63893+
63894+#ifdef CONFIG_PAX_DLRESOLVE
63895+ unsigned long call_dl_resolve;
63896+#endif
63897+
63898+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
63899+ unsigned long call_syscall;
63900+#endif
63901+
63902+#ifdef CONFIG_PAX_ASLR
63903+ unsigned long delta_mmap; /* randomized offset */
63904+ unsigned long delta_stack; /* randomized offset */
63905+#endif
63906+
63907 };
63908
63909 /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
63910diff -urNp linux-2.6.39.1/include/linux/mmu_notifier.h linux-2.6.39.1/include/linux/mmu_notifier.h
63911--- linux-2.6.39.1/include/linux/mmu_notifier.h 2011-05-19 00:06:34.000000000 -0400
63912+++ linux-2.6.39.1/include/linux/mmu_notifier.h 2011-05-22 19:36:33.000000000 -0400
63913@@ -255,12 +255,12 @@ static inline void mmu_notifier_mm_destr
63914 */
63915 #define ptep_clear_flush_notify(__vma, __address, __ptep) \
63916 ({ \
63917- pte_t __pte; \
63918+ pte_t ___pte; \
63919 struct vm_area_struct *___vma = __vma; \
63920 unsigned long ___address = __address; \
63921- __pte = ptep_clear_flush(___vma, ___address, __ptep); \
63922+ ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
63923 mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
63924- __pte; \
63925+ ___pte; \
63926 })
63927
63928 #define pmdp_clear_flush_notify(__vma, __address, __pmdp) \
63929diff -urNp linux-2.6.39.1/include/linux/mmzone.h linux-2.6.39.1/include/linux/mmzone.h
63930--- linux-2.6.39.1/include/linux/mmzone.h 2011-05-19 00:06:34.000000000 -0400
63931+++ linux-2.6.39.1/include/linux/mmzone.h 2011-05-22 19:36:33.000000000 -0400
63932@@ -355,7 +355,7 @@ struct zone {
63933 unsigned long flags; /* zone flags, see below */
63934
63935 /* Zone statistics */
63936- atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63937+ atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63938
63939 /*
63940 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
63941diff -urNp linux-2.6.39.1/include/linux/mod_devicetable.h linux-2.6.39.1/include/linux/mod_devicetable.h
63942--- linux-2.6.39.1/include/linux/mod_devicetable.h 2011-05-19 00:06:34.000000000 -0400
63943+++ linux-2.6.39.1/include/linux/mod_devicetable.h 2011-05-22 19:36:33.000000000 -0400
63944@@ -12,7 +12,7 @@
63945 typedef unsigned long kernel_ulong_t;
63946 #endif
63947
63948-#define PCI_ANY_ID (~0)
63949+#define PCI_ANY_ID ((__u16)~0)
63950
63951 struct pci_device_id {
63952 __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
63953@@ -131,7 +131,7 @@ struct usb_device_id {
63954 #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
63955 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
63956
63957-#define HID_ANY_ID (~0)
63958+#define HID_ANY_ID (~0U)
63959
63960 struct hid_device_id {
63961 __u16 bus;
63962diff -urNp linux-2.6.39.1/include/linux/module.h linux-2.6.39.1/include/linux/module.h
63963--- linux-2.6.39.1/include/linux/module.h 2011-05-19 00:06:34.000000000 -0400
63964+++ linux-2.6.39.1/include/linux/module.h 2011-05-22 19:36:33.000000000 -0400
63965@@ -324,19 +324,16 @@ struct module
63966 int (*init)(void);
63967
63968 /* If this is non-NULL, vfree after init() returns */
63969- void *module_init;
63970+ void *module_init_rx, *module_init_rw;
63971
63972 /* Here is the actual code + data, vfree'd on unload. */
63973- void *module_core;
63974+ void *module_core_rx, *module_core_rw;
63975
63976 /* Here are the sizes of the init and core sections */
63977- unsigned int init_size, core_size;
63978+ unsigned int init_size_rw, core_size_rw;
63979
63980 /* The size of the executable code in each section. */
63981- unsigned int init_text_size, core_text_size;
63982-
63983- /* Size of RO sections of the module (text+rodata) */
63984- unsigned int init_ro_size, core_ro_size;
63985+ unsigned int init_size_rx, core_size_rx;
63986
63987 /* Arch-specific module values */
63988 struct mod_arch_specific arch;
63989@@ -441,16 +438,46 @@ bool is_module_address(unsigned long add
63990 bool is_module_percpu_address(unsigned long addr);
63991 bool is_module_text_address(unsigned long addr);
63992
63993+static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
63994+{
63995+
63996+#ifdef CONFIG_PAX_KERNEXEC
63997+ if (ktla_ktva(addr) >= (unsigned long)start &&
63998+ ktla_ktva(addr) < (unsigned long)start + size)
63999+ return 1;
64000+#endif
64001+
64002+ return ((void *)addr >= start && (void *)addr < start + size);
64003+}
64004+
64005+static inline int within_module_core_rx(unsigned long addr, struct module *mod)
64006+{
64007+ return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
64008+}
64009+
64010+static inline int within_module_core_rw(unsigned long addr, struct module *mod)
64011+{
64012+ return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
64013+}
64014+
64015+static inline int within_module_init_rx(unsigned long addr, struct module *mod)
64016+{
64017+ return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
64018+}
64019+
64020+static inline int within_module_init_rw(unsigned long addr, struct module *mod)
64021+{
64022+ return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
64023+}
64024+
64025 static inline int within_module_core(unsigned long addr, struct module *mod)
64026 {
64027- return (unsigned long)mod->module_core <= addr &&
64028- addr < (unsigned long)mod->module_core + mod->core_size;
64029+ return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
64030 }
64031
64032 static inline int within_module_init(unsigned long addr, struct module *mod)
64033 {
64034- return (unsigned long)mod->module_init <= addr &&
64035- addr < (unsigned long)mod->module_init + mod->init_size;
64036+ return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
64037 }
64038
64039 /* Search for module by name: must hold module_mutex. */
64040diff -urNp linux-2.6.39.1/include/linux/moduleloader.h linux-2.6.39.1/include/linux/moduleloader.h
64041--- linux-2.6.39.1/include/linux/moduleloader.h 2011-05-19 00:06:34.000000000 -0400
64042+++ linux-2.6.39.1/include/linux/moduleloader.h 2011-05-22 19:36:33.000000000 -0400
64043@@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
64044 sections. Returns NULL on failure. */
64045 void *module_alloc(unsigned long size);
64046
64047+#ifdef CONFIG_PAX_KERNEXEC
64048+void *module_alloc_exec(unsigned long size);
64049+#else
64050+#define module_alloc_exec(x) module_alloc(x)
64051+#endif
64052+
64053 /* Free memory returned from module_alloc. */
64054 void module_free(struct module *mod, void *module_region);
64055
64056+#ifdef CONFIG_PAX_KERNEXEC
64057+void module_free_exec(struct module *mod, void *module_region);
64058+#else
64059+#define module_free_exec(x, y) module_free((x), (y))
64060+#endif
64061+
64062 /* Apply the given relocation to the (simplified) ELF. Return -error
64063 or 0. */
64064 int apply_relocate(Elf_Shdr *sechdrs,
64065diff -urNp linux-2.6.39.1/include/linux/moduleparam.h linux-2.6.39.1/include/linux/moduleparam.h
64066--- linux-2.6.39.1/include/linux/moduleparam.h 2011-05-19 00:06:34.000000000 -0400
64067+++ linux-2.6.39.1/include/linux/moduleparam.h 2011-05-22 19:36:33.000000000 -0400
64068@@ -255,7 +255,7 @@ static inline void __kernel_param_unlock
64069 * @len is usually just sizeof(string).
64070 */
64071 #define module_param_string(name, string, len, perm) \
64072- static const struct kparam_string __param_string_##name \
64073+ static const struct kparam_string __param_string_##name __used \
64074 = { len, string }; \
64075 __module_param_call(MODULE_PARAM_PREFIX, name, \
64076 &param_ops_string, \
64077@@ -285,48 +285,48 @@ static inline void destroy_params(const
64078 #define __param_check(name, p, type) \
64079 static inline type *__check_##name(void) { return(p); }
64080
64081-extern struct kernel_param_ops param_ops_byte;
64082+extern const struct kernel_param_ops param_ops_byte;
64083 extern int param_set_byte(const char *val, const struct kernel_param *kp);
64084 extern int param_get_byte(char *buffer, const struct kernel_param *kp);
64085 #define param_check_byte(name, p) __param_check(name, p, unsigned char)
64086
64087-extern struct kernel_param_ops param_ops_short;
64088+extern const struct kernel_param_ops param_ops_short;
64089 extern int param_set_short(const char *val, const struct kernel_param *kp);
64090 extern int param_get_short(char *buffer, const struct kernel_param *kp);
64091 #define param_check_short(name, p) __param_check(name, p, short)
64092
64093-extern struct kernel_param_ops param_ops_ushort;
64094+extern const struct kernel_param_ops param_ops_ushort;
64095 extern int param_set_ushort(const char *val, const struct kernel_param *kp);
64096 extern int param_get_ushort(char *buffer, const struct kernel_param *kp);
64097 #define param_check_ushort(name, p) __param_check(name, p, unsigned short)
64098
64099-extern struct kernel_param_ops param_ops_int;
64100+extern const struct kernel_param_ops param_ops_int;
64101 extern int param_set_int(const char *val, const struct kernel_param *kp);
64102 extern int param_get_int(char *buffer, const struct kernel_param *kp);
64103 #define param_check_int(name, p) __param_check(name, p, int)
64104
64105-extern struct kernel_param_ops param_ops_uint;
64106+extern const struct kernel_param_ops param_ops_uint;
64107 extern int param_set_uint(const char *val, const struct kernel_param *kp);
64108 extern int param_get_uint(char *buffer, const struct kernel_param *kp);
64109 #define param_check_uint(name, p) __param_check(name, p, unsigned int)
64110
64111-extern struct kernel_param_ops param_ops_long;
64112+extern const struct kernel_param_ops param_ops_long;
64113 extern int param_set_long(const char *val, const struct kernel_param *kp);
64114 extern int param_get_long(char *buffer, const struct kernel_param *kp);
64115 #define param_check_long(name, p) __param_check(name, p, long)
64116
64117-extern struct kernel_param_ops param_ops_ulong;
64118+extern const struct kernel_param_ops param_ops_ulong;
64119 extern int param_set_ulong(const char *val, const struct kernel_param *kp);
64120 extern int param_get_ulong(char *buffer, const struct kernel_param *kp);
64121 #define param_check_ulong(name, p) __param_check(name, p, unsigned long)
64122
64123-extern struct kernel_param_ops param_ops_charp;
64124+extern const struct kernel_param_ops param_ops_charp;
64125 extern int param_set_charp(const char *val, const struct kernel_param *kp);
64126 extern int param_get_charp(char *buffer, const struct kernel_param *kp);
64127 #define param_check_charp(name, p) __param_check(name, p, char *)
64128
64129 /* For historical reasons "bool" parameters can be (unsigned) "int". */
64130-extern struct kernel_param_ops param_ops_bool;
64131+extern const struct kernel_param_ops param_ops_bool;
64132 extern int param_set_bool(const char *val, const struct kernel_param *kp);
64133 extern int param_get_bool(char *buffer, const struct kernel_param *kp);
64134 #define param_check_bool(name, p) \
64135@@ -337,7 +337,7 @@ extern int param_get_bool(char *buffer,
64136 !__same_type((p), int *)); \
64137 }
64138
64139-extern struct kernel_param_ops param_ops_invbool;
64140+extern const struct kernel_param_ops param_ops_invbool;
64141 extern int param_set_invbool(const char *val, const struct kernel_param *kp);
64142 extern int param_get_invbool(char *buffer, const struct kernel_param *kp);
64143 #define param_check_invbool(name, p) __param_check(name, p, bool)
64144@@ -370,7 +370,7 @@ extern int param_get_invbool(char *buffe
64145 * module_param_named() for why this might be necessary.
64146 */
64147 #define module_param_array_named(name, array, type, nump, perm) \
64148- static const struct kparam_array __param_arr_##name \
64149+ static const struct kparam_array __param_arr_##name __used \
64150 = { ARRAY_SIZE(array), nump, &param_ops_##type, \
64151 sizeof(array[0]), array }; \
64152 __module_param_call(MODULE_PARAM_PREFIX, name, \
64153@@ -379,9 +379,9 @@ extern int param_get_invbool(char *buffe
64154 __same_type(array[0], bool), perm); \
64155 __MODULE_PARM_TYPE(name, "array of " #type)
64156
64157-extern struct kernel_param_ops param_array_ops;
64158+extern const struct kernel_param_ops param_array_ops;
64159
64160-extern struct kernel_param_ops param_ops_string;
64161+extern const struct kernel_param_ops param_ops_string;
64162 extern int param_set_copystring(const char *val, const struct kernel_param *);
64163 extern int param_get_string(char *buffer, const struct kernel_param *kp);
64164
64165diff -urNp linux-2.6.39.1/include/linux/mutex.h linux-2.6.39.1/include/linux/mutex.h
64166--- linux-2.6.39.1/include/linux/mutex.h 2011-05-19 00:06:34.000000000 -0400
64167+++ linux-2.6.39.1/include/linux/mutex.h 2011-05-22 19:36:33.000000000 -0400
64168@@ -51,7 +51,7 @@ struct mutex {
64169 spinlock_t wait_lock;
64170 struct list_head wait_list;
64171 #if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_SMP)
64172- struct thread_info *owner;
64173+ struct task_struct *owner;
64174 #endif
64175 #ifdef CONFIG_DEBUG_MUTEXES
64176 const char *name;
64177diff -urNp linux-2.6.39.1/include/linux/namei.h linux-2.6.39.1/include/linux/namei.h
64178--- linux-2.6.39.1/include/linux/namei.h 2011-05-19 00:06:34.000000000 -0400
64179+++ linux-2.6.39.1/include/linux/namei.h 2011-05-22 19:36:33.000000000 -0400
64180@@ -24,7 +24,7 @@ struct nameidata {
64181 unsigned seq;
64182 int last_type;
64183 unsigned depth;
64184- char *saved_names[MAX_NESTED_LINKS + 1];
64185+ const char *saved_names[MAX_NESTED_LINKS + 1];
64186
64187 /* Intent data */
64188 union {
64189@@ -91,12 +91,12 @@ extern int follow_up(struct path *);
64190 extern struct dentry *lock_rename(struct dentry *, struct dentry *);
64191 extern void unlock_rename(struct dentry *, struct dentry *);
64192
64193-static inline void nd_set_link(struct nameidata *nd, char *path)
64194+static inline void nd_set_link(struct nameidata *nd, const char *path)
64195 {
64196 nd->saved_names[nd->depth] = path;
64197 }
64198
64199-static inline char *nd_get_link(struct nameidata *nd)
64200+static inline const char *nd_get_link(const struct nameidata *nd)
64201 {
64202 return nd->saved_names[nd->depth];
64203 }
64204diff -urNp linux-2.6.39.1/include/linux/netfilter/xt_gradm.h linux-2.6.39.1/include/linux/netfilter/xt_gradm.h
64205--- linux-2.6.39.1/include/linux/netfilter/xt_gradm.h 1969-12-31 19:00:00.000000000 -0500
64206+++ linux-2.6.39.1/include/linux/netfilter/xt_gradm.h 2011-05-22 19:41:42.000000000 -0400
64207@@ -0,0 +1,9 @@
64208+#ifndef _LINUX_NETFILTER_XT_GRADM_H
64209+#define _LINUX_NETFILTER_XT_GRADM_H 1
64210+
64211+struct xt_gradm_mtinfo {
64212+ __u16 flags;
64213+ __u16 invflags;
64214+};
64215+
64216+#endif
64217diff -urNp linux-2.6.39.1/include/linux/oprofile.h linux-2.6.39.1/include/linux/oprofile.h
64218--- linux-2.6.39.1/include/linux/oprofile.h 2011-05-19 00:06:34.000000000 -0400
64219+++ linux-2.6.39.1/include/linux/oprofile.h 2011-05-22 19:36:33.000000000 -0400
64220@@ -139,9 +139,9 @@ int oprofilefs_create_ulong(struct super
64221 int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
64222 char const * name, ulong * val);
64223
64224-/** Create a file for read-only access to an atomic_t. */
64225+/** Create a file for read-only access to an atomic_unchecked_t. */
64226 int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
64227- char const * name, atomic_t * val);
64228+ char const * name, atomic_unchecked_t * val);
64229
64230 /** create a directory */
64231 struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
64232diff -urNp linux-2.6.39.1/include/linux/padata.h linux-2.6.39.1/include/linux/padata.h
64233--- linux-2.6.39.1/include/linux/padata.h 2011-05-19 00:06:34.000000000 -0400
64234+++ linux-2.6.39.1/include/linux/padata.h 2011-05-22 19:36:33.000000000 -0400
64235@@ -129,7 +129,7 @@ struct parallel_data {
64236 struct padata_instance *pinst;
64237 struct padata_parallel_queue __percpu *pqueue;
64238 struct padata_serial_queue __percpu *squeue;
64239- atomic_t seq_nr;
64240+ atomic_unchecked_t seq_nr;
64241 atomic_t reorder_objects;
64242 atomic_t refcnt;
64243 unsigned int max_seq_nr;
64244diff -urNp linux-2.6.39.1/include/linux/pci.h linux-2.6.39.1/include/linux/pci.h
64245--- linux-2.6.39.1/include/linux/pci.h 2011-05-19 00:06:34.000000000 -0400
64246+++ linux-2.6.39.1/include/linux/pci.h 2011-05-22 19:36:33.000000000 -0400
64247@@ -411,7 +411,7 @@ struct pci_bus {
64248 struct resource *resource[PCI_BRIDGE_RESOURCE_NUM];
64249 struct list_head resources; /* address space routed to this bus */
64250
64251- struct pci_ops *ops; /* configuration access functions */
64252+ const struct pci_ops *ops; /* configuration access functions */
64253 void *sysdata; /* hook for sys-specific extension */
64254 struct proc_dir_entry *procdir; /* directory entry in /proc/bus/pci */
64255
64256@@ -550,7 +550,7 @@ struct pci_driver {
64257 int (*resume_early) (struct pci_dev *dev);
64258 int (*resume) (struct pci_dev *dev); /* Device woken up */
64259 void (*shutdown) (struct pci_dev *dev);
64260- struct pci_error_handlers *err_handler;
64261+ const struct pci_error_handlers *err_handler;
64262 struct device_driver driver;
64263 struct pci_dynids dynids;
64264 };
64265@@ -639,7 +639,7 @@ void pcibios_scan_specific_bus(int busn)
64266 extern struct pci_bus *pci_find_bus(int domain, int busnr);
64267 void pci_bus_add_devices(const struct pci_bus *bus);
64268 struct pci_bus *pci_scan_bus_parented(struct device *parent, int bus,
64269- struct pci_ops *ops, void *sysdata);
64270+ const struct pci_ops *ops, void *sysdata);
64271 static inline struct pci_bus * __devinit pci_scan_bus(int bus, struct pci_ops *ops,
64272 void *sysdata)
64273 {
64274@@ -650,7 +650,7 @@ static inline struct pci_bus * __devinit
64275 return root_bus;
64276 }
64277 struct pci_bus *pci_create_bus(struct device *parent, int bus,
64278- struct pci_ops *ops, void *sysdata);
64279+ const struct pci_ops *ops, void *sysdata);
64280 struct pci_bus *pci_add_new_bus(struct pci_bus *parent, struct pci_dev *dev,
64281 int busnr);
64282 void pcie_update_link_speed(struct pci_bus *bus, u16 link_status);
64283@@ -727,7 +727,7 @@ int pci_bus_write_config_word(struct pci
64284 int where, u16 val);
64285 int pci_bus_write_config_dword(struct pci_bus *bus, unsigned int devfn,
64286 int where, u32 val);
64287-struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, struct pci_ops *ops);
64288+const struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, const struct pci_ops *ops);
64289
64290 static inline int pci_read_config_byte(struct pci_dev *dev, int where, u8 *val)
64291 {
64292diff -urNp linux-2.6.39.1/include/linux/perf_event.h linux-2.6.39.1/include/linux/perf_event.h
64293--- linux-2.6.39.1/include/linux/perf_event.h 2011-05-19 00:06:34.000000000 -0400
64294+++ linux-2.6.39.1/include/linux/perf_event.h 2011-05-22 19:36:33.000000000 -0400
64295@@ -759,8 +759,8 @@ struct perf_event {
64296
64297 enum perf_event_active_state state;
64298 unsigned int attach_state;
64299- local64_t count;
64300- atomic64_t child_count;
64301+ local64_t count; /* PaX: fix it one day */
64302+ atomic64_unchecked_t child_count;
64303
64304 /*
64305 * These are the total time in nanoseconds that the event
64306@@ -811,8 +811,8 @@ struct perf_event {
64307 * These accumulate total time (in nanoseconds) that children
64308 * events have been enabled and running, respectively.
64309 */
64310- atomic64_t child_total_time_enabled;
64311- atomic64_t child_total_time_running;
64312+ atomic64_unchecked_t child_total_time_enabled;
64313+ atomic64_unchecked_t child_total_time_running;
64314
64315 /*
64316 * Protect attach/detach and child_list:
64317@@ -1090,9 +1090,9 @@ void perf_event_task_sched_out(struct ta
64318 }
64319
64320 extern void perf_event_mmap(struct vm_area_struct *vma);
64321-extern struct perf_guest_info_callbacks *perf_guest_cbs;
64322-extern int perf_register_guest_info_callbacks(struct perf_guest_info_callbacks *callbacks);
64323-extern int perf_unregister_guest_info_callbacks(struct perf_guest_info_callbacks *callbacks);
64324+extern const struct perf_guest_info_callbacks *perf_guest_cbs;
64325+extern int perf_register_guest_info_callbacks(const struct perf_guest_info_callbacks *callbacks);
64326+extern int perf_unregister_guest_info_callbacks(const struct perf_guest_info_callbacks *callbacks);
64327
64328 extern void perf_event_comm(struct task_struct *tsk);
64329 extern void perf_event_fork(struct task_struct *tsk);
64330diff -urNp linux-2.6.39.1/include/linux/pipe_fs_i.h linux-2.6.39.1/include/linux/pipe_fs_i.h
64331--- linux-2.6.39.1/include/linux/pipe_fs_i.h 2011-05-19 00:06:34.000000000 -0400
64332+++ linux-2.6.39.1/include/linux/pipe_fs_i.h 2011-05-22 19:36:33.000000000 -0400
64333@@ -46,9 +46,9 @@ struct pipe_buffer {
64334 struct pipe_inode_info {
64335 wait_queue_head_t wait;
64336 unsigned int nrbufs, curbuf, buffers;
64337- unsigned int readers;
64338- unsigned int writers;
64339- unsigned int waiting_writers;
64340+ atomic_t readers;
64341+ atomic_t writers;
64342+ atomic_t waiting_writers;
64343 unsigned int r_counter;
64344 unsigned int w_counter;
64345 struct page *tmp_page;
64346diff -urNp linux-2.6.39.1/include/linux/pm.h linux-2.6.39.1/include/linux/pm.h
64347--- linux-2.6.39.1/include/linux/pm.h 2011-05-19 00:06:34.000000000 -0400
64348+++ linux-2.6.39.1/include/linux/pm.h 2011-05-22 19:36:33.000000000 -0400
64349@@ -268,7 +268,7 @@ const struct dev_pm_ops name = { \
64350 * runtime PM, make the pm member point to generic_subsys_pm_ops.
64351 */
64352 #ifdef CONFIG_PM
64353-extern struct dev_pm_ops generic_subsys_pm_ops;
64354+extern const struct dev_pm_ops generic_subsys_pm_ops;
64355 #define GENERIC_SUBSYS_PM_OPS (&generic_subsys_pm_ops)
64356 #else
64357 #define GENERIC_SUBSYS_PM_OPS NULL
64358@@ -471,7 +471,7 @@ extern void update_pm_runtime_accounting
64359 * subsystem-level and driver-level callbacks.
64360 */
64361 struct dev_power_domain {
64362- struct dev_pm_ops ops;
64363+ const struct dev_pm_ops ops;
64364 };
64365
64366 /*
64367diff -urNp linux-2.6.39.1/include/linux/pm_runtime.h linux-2.6.39.1/include/linux/pm_runtime.h
64368--- linux-2.6.39.1/include/linux/pm_runtime.h 2011-05-19 00:06:34.000000000 -0400
64369+++ linux-2.6.39.1/include/linux/pm_runtime.h 2011-05-22 19:36:33.000000000 -0400
64370@@ -94,7 +94,7 @@ static inline bool pm_runtime_callbacks_
64371
64372 static inline void pm_runtime_mark_last_busy(struct device *dev)
64373 {
64374- ACCESS_ONCE(dev->power.last_busy) = jiffies;
64375+ ACCESS_ONCE_RW(dev->power.last_busy) = jiffies;
64376 }
64377
64378 #else /* !CONFIG_PM_RUNTIME */
64379diff -urNp linux-2.6.39.1/include/linux/poison.h linux-2.6.39.1/include/linux/poison.h
64380--- linux-2.6.39.1/include/linux/poison.h 2011-05-19 00:06:34.000000000 -0400
64381+++ linux-2.6.39.1/include/linux/poison.h 2011-05-22 19:36:33.000000000 -0400
64382@@ -19,8 +19,8 @@
64383 * under normal circumstances, used to verify that nobody uses
64384 * non-initialized list entries.
64385 */
64386-#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
64387-#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
64388+#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
64389+#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
64390
64391 /********** include/linux/timer.h **********/
64392 /*
64393diff -urNp linux-2.6.39.1/include/linux/posix-timers.h linux-2.6.39.1/include/linux/posix-timers.h
64394--- linux-2.6.39.1/include/linux/posix-timers.h 2011-05-19 00:06:34.000000000 -0400
64395+++ linux-2.6.39.1/include/linux/posix-timers.h 2011-05-22 19:36:33.000000000 -0400
64396@@ -102,10 +102,10 @@ struct k_clock {
64397 struct itimerspec * cur_setting);
64398 };
64399
64400-extern struct k_clock clock_posix_cpu;
64401-extern struct k_clock clock_posix_dynamic;
64402+extern const struct k_clock clock_posix_cpu;
64403+extern const struct k_clock clock_posix_dynamic;
64404
64405-void posix_timers_register_clock(const clockid_t clock_id, struct k_clock *new_clock);
64406+void posix_timers_register_clock(const clockid_t clock_id, const struct k_clock *new_clock);
64407
64408 /* function to call to trigger timer event */
64409 int posix_timer_event(struct k_itimer *timr, int si_private);
64410diff -urNp linux-2.6.39.1/include/linux/proc_fs.h linux-2.6.39.1/include/linux/proc_fs.h
64411--- linux-2.6.39.1/include/linux/proc_fs.h 2011-05-19 00:06:34.000000000 -0400
64412+++ linux-2.6.39.1/include/linux/proc_fs.h 2011-05-22 19:41:42.000000000 -0400
64413@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
64414 return proc_create_data(name, mode, parent, proc_fops, NULL);
64415 }
64416
64417+static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
64418+ struct proc_dir_entry *parent, const struct file_operations *proc_fops)
64419+{
64420+#ifdef CONFIG_GRKERNSEC_PROC_USER
64421+ return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
64422+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
64423+ return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
64424+#else
64425+ return proc_create_data(name, mode, parent, proc_fops, NULL);
64426+#endif
64427+}
64428+
64429+
64430 static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
64431 mode_t mode, struct proc_dir_entry *base,
64432 read_proc_t *read_proc, void * data)
64433diff -urNp linux-2.6.39.1/include/linux/ptrace.h linux-2.6.39.1/include/linux/ptrace.h
64434--- linux-2.6.39.1/include/linux/ptrace.h 2011-05-19 00:06:34.000000000 -0400
64435+++ linux-2.6.39.1/include/linux/ptrace.h 2011-05-22 19:41:42.000000000 -0400
64436@@ -115,10 +115,10 @@ extern void __ptrace_unlink(struct task_
64437 extern void exit_ptrace(struct task_struct *tracer);
64438 #define PTRACE_MODE_READ 1
64439 #define PTRACE_MODE_ATTACH 2
64440-/* Returns 0 on success, -errno on denial. */
64441-extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
64442 /* Returns true on success, false on denial. */
64443 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
64444+/* Returns true on success, false on denial. */
64445+extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
64446
64447 static inline int ptrace_reparented(struct task_struct *child)
64448 {
64449diff -urNp linux-2.6.39.1/include/linux/random.h linux-2.6.39.1/include/linux/random.h
64450--- linux-2.6.39.1/include/linux/random.h 2011-05-19 00:06:34.000000000 -0400
64451+++ linux-2.6.39.1/include/linux/random.h 2011-05-22 19:36:33.000000000 -0400
64452@@ -80,12 +80,17 @@ void srandom32(u32 seed);
64453
64454 u32 prandom32(struct rnd_state *);
64455
64456+static inline unsigned long pax_get_random_long(void)
64457+{
64458+ return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
64459+}
64460+
64461 /*
64462 * Handle minimum values for seeds
64463 */
64464 static inline u32 __seed(u32 x, u32 m)
64465 {
64466- return (x < m) ? x + m : x;
64467+ return (x <= m) ? x + m + 1 : x;
64468 }
64469
64470 /**
64471diff -urNp linux-2.6.39.1/include/linux/reboot.h linux-2.6.39.1/include/linux/reboot.h
64472--- linux-2.6.39.1/include/linux/reboot.h 2011-05-19 00:06:34.000000000 -0400
64473+++ linux-2.6.39.1/include/linux/reboot.h 2011-05-22 19:36:33.000000000 -0400
64474@@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(st
64475 * Architecture-specific implementations of sys_reboot commands.
64476 */
64477
64478-extern void machine_restart(char *cmd);
64479-extern void machine_halt(void);
64480-extern void machine_power_off(void);
64481+extern void machine_restart(char *cmd) __noreturn;
64482+extern void machine_halt(void) __noreturn;
64483+extern void machine_power_off(void) __noreturn;
64484
64485 extern void machine_shutdown(void);
64486 struct pt_regs;
64487@@ -60,9 +60,9 @@ extern void machine_crash_shutdown(struc
64488 */
64489
64490 extern void kernel_restart_prepare(char *cmd);
64491-extern void kernel_restart(char *cmd);
64492-extern void kernel_halt(void);
64493-extern void kernel_power_off(void);
64494+extern void kernel_restart(char *cmd) __noreturn;
64495+extern void kernel_halt(void) __noreturn;
64496+extern void kernel_power_off(void) __noreturn;
64497
64498 extern int C_A_D; /* for sysctl */
64499 void ctrl_alt_del(void);
64500@@ -76,7 +76,7 @@ extern int orderly_poweroff(bool force);
64501 * Emergency restart, callable from an interrupt handler.
64502 */
64503
64504-extern void emergency_restart(void);
64505+extern void emergency_restart(void) __noreturn;
64506 #include <asm/emergency-restart.h>
64507
64508 #endif
64509diff -urNp linux-2.6.39.1/include/linux/reiserfs_fs.h linux-2.6.39.1/include/linux/reiserfs_fs.h
64510--- linux-2.6.39.1/include/linux/reiserfs_fs.h 2011-05-19 00:06:34.000000000 -0400
64511+++ linux-2.6.39.1/include/linux/reiserfs_fs.h 2011-05-22 19:36:33.000000000 -0400
64512@@ -1406,7 +1406,7 @@ static inline loff_t max_reiserfs_offset
64513 #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
64514
64515 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
64516-#define get_generation(s) atomic_read (&fs_generation(s))
64517+#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
64518 #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
64519 #define __fs_changed(gen,s) (gen != get_generation (s))
64520 #define fs_changed(gen,s) \
64521@@ -1618,24 +1618,24 @@ static inline struct super_block *sb_fro
64522 */
64523
64524 struct item_operations {
64525- int (*bytes_number) (struct item_head * ih, int block_size);
64526- void (*decrement_key) (struct cpu_key *);
64527- int (*is_left_mergeable) (struct reiserfs_key * ih,
64528+ int (* const bytes_number) (struct item_head * ih, int block_size);
64529+ void (* const decrement_key) (struct cpu_key *);
64530+ int (* const is_left_mergeable) (struct reiserfs_key * ih,
64531 unsigned long bsize);
64532- void (*print_item) (struct item_head *, char *item);
64533- void (*check_item) (struct item_head *, char *item);
64534+ void (* const print_item) (struct item_head *, char *item);
64535+ void (* const check_item) (struct item_head *, char *item);
64536
64537- int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
64538+ int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
64539 int is_affected, int insert_size);
64540- int (*check_left) (struct virtual_item * vi, int free,
64541+ int (* const check_left) (struct virtual_item * vi, int free,
64542 int start_skip, int end_skip);
64543- int (*check_right) (struct virtual_item * vi, int free);
64544- int (*part_size) (struct virtual_item * vi, int from, int to);
64545- int (*unit_num) (struct virtual_item * vi);
64546- void (*print_vi) (struct virtual_item * vi);
64547+ int (* const check_right) (struct virtual_item * vi, int free);
64548+ int (* const part_size) (struct virtual_item * vi, int from, int to);
64549+ int (* const unit_num) (struct virtual_item * vi);
64550+ void (* const print_vi) (struct virtual_item * vi);
64551 };
64552
64553-extern struct item_operations *item_ops[TYPE_ANY + 1];
64554+extern const struct item_operations * const item_ops[TYPE_ANY + 1];
64555
64556 #define op_bytes_number(ih,bsize) item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
64557 #define op_is_left_mergeable(key,bsize) item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
64558diff -urNp linux-2.6.39.1/include/linux/reiserfs_fs_sb.h linux-2.6.39.1/include/linux/reiserfs_fs_sb.h
64559--- linux-2.6.39.1/include/linux/reiserfs_fs_sb.h 2011-05-19 00:06:34.000000000 -0400
64560+++ linux-2.6.39.1/include/linux/reiserfs_fs_sb.h 2011-05-22 19:36:33.000000000 -0400
64561@@ -386,7 +386,7 @@ struct reiserfs_sb_info {
64562 /* Comment? -Hans */
64563 wait_queue_head_t s_wait;
64564 /* To be obsoleted soon by per buffer seals.. -Hans */
64565- atomic_t s_generation_counter; // increased by one every time the
64566+ atomic_unchecked_t s_generation_counter; // increased by one every time the
64567 // tree gets re-balanced
64568 unsigned long s_properties; /* File system properties. Currently holds
64569 on-disk FS format */
64570diff -urNp linux-2.6.39.1/include/linux/rmap.h linux-2.6.39.1/include/linux/rmap.h
64571--- linux-2.6.39.1/include/linux/rmap.h 2011-05-19 00:06:34.000000000 -0400
64572+++ linux-2.6.39.1/include/linux/rmap.h 2011-05-22 19:36:33.000000000 -0400
64573@@ -119,8 +119,8 @@ static inline void anon_vma_unlock(struc
64574 void anon_vma_init(void); /* create anon_vma_cachep */
64575 int anon_vma_prepare(struct vm_area_struct *);
64576 void unlink_anon_vmas(struct vm_area_struct *);
64577-int anon_vma_clone(struct vm_area_struct *, struct vm_area_struct *);
64578-int anon_vma_fork(struct vm_area_struct *, struct vm_area_struct *);
64579+int anon_vma_clone(struct vm_area_struct *, const struct vm_area_struct *);
64580+int anon_vma_fork(struct vm_area_struct *, const struct vm_area_struct *);
64581 void __anon_vma_link(struct vm_area_struct *);
64582
64583 static inline void anon_vma_merge(struct vm_area_struct *vma,
64584diff -urNp linux-2.6.39.1/include/linux/sched.h linux-2.6.39.1/include/linux/sched.h
64585--- linux-2.6.39.1/include/linux/sched.h 2011-05-19 00:06:34.000000000 -0400
64586+++ linux-2.6.39.1/include/linux/sched.h 2011-06-03 23:34:26.000000000 -0400
64587@@ -100,6 +100,7 @@ struct bio_list;
64588 struct fs_struct;
64589 struct perf_event_context;
64590 struct blk_plug;
64591+struct linux_binprm;
64592
64593 /*
64594 * List of flags we want to share for kernel threads,
64595@@ -360,7 +361,7 @@ extern signed long schedule_timeout_inte
64596 extern signed long schedule_timeout_killable(signed long timeout);
64597 extern signed long schedule_timeout_uninterruptible(signed long timeout);
64598 asmlinkage void schedule(void);
64599-extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner);
64600+extern int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner);
64601
64602 struct nsproxy;
64603 struct user_namespace;
64604@@ -381,10 +382,13 @@ struct user_namespace;
64605 #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
64606
64607 extern int sysctl_max_map_count;
64608+extern unsigned long sysctl_heap_stack_gap;
64609
64610 #include <linux/aio.h>
64611
64612 #ifdef CONFIG_MMU
64613+extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
64614+extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
64615 extern void arch_pick_mmap_layout(struct mm_struct *mm);
64616 extern unsigned long
64617 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
64618@@ -629,6 +633,17 @@ struct signal_struct {
64619 #ifdef CONFIG_TASKSTATS
64620 struct taskstats *stats;
64621 #endif
64622+
64623+#ifdef CONFIG_GRKERNSEC
64624+ u32 curr_ip;
64625+ u32 saved_ip;
64626+ u32 gr_saddr;
64627+ u32 gr_daddr;
64628+ u16 gr_sport;
64629+ u16 gr_dport;
64630+ u8 used_accept:1;
64631+#endif
64632+
64633 #ifdef CONFIG_AUDIT
64634 unsigned audit_tty;
64635 struct tty_audit_buf *tty_audit_buf;
64636@@ -701,6 +716,11 @@ struct user_struct {
64637 struct key *session_keyring; /* UID's default session keyring */
64638 #endif
64639
64640+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
64641+ unsigned int banned;
64642+ unsigned long ban_expires;
64643+#endif
64644+
64645 /* Hash table maintenance information */
64646 struct hlist_node uidhash_node;
64647 uid_t uid;
64648@@ -1310,8 +1330,8 @@ struct task_struct {
64649 struct list_head thread_group;
64650
64651 struct completion *vfork_done; /* for vfork() */
64652- int __user *set_child_tid; /* CLONE_CHILD_SETTID */
64653- int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
64654+ pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
64655+ pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
64656
64657 cputime_t utime, stime, utimescaled, stimescaled;
64658 cputime_t gtime;
64659@@ -1327,13 +1347,6 @@ struct task_struct {
64660 struct task_cputime cputime_expires;
64661 struct list_head cpu_timers[3];
64662
64663-/* process credentials */
64664- const struct cred __rcu *real_cred; /* objective and real subjective task
64665- * credentials (COW) */
64666- const struct cred __rcu *cred; /* effective (overridable) subjective task
64667- * credentials (COW) */
64668- struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
64669-
64670 char comm[TASK_COMM_LEN]; /* executable name excluding path
64671 - access with [gs]et_task_comm (which lock
64672 it with task_lock())
64673@@ -1350,8 +1363,16 @@ struct task_struct {
64674 #endif
64675 /* CPU-specific state of this task */
64676 struct thread_struct thread;
64677+/* thread_info moved to task_struct */
64678+#ifdef CONFIG_X86
64679+ struct thread_info tinfo;
64680+#endif
64681 /* filesystem information */
64682 struct fs_struct *fs;
64683+
64684+ const struct cred __rcu *cred; /* effective (overridable) subjective task
64685+ * credentials (COW) */
64686+
64687 /* open file information */
64688 struct files_struct *files;
64689 /* namespaces */
64690@@ -1398,6 +1419,11 @@ struct task_struct {
64691 struct rt_mutex_waiter *pi_blocked_on;
64692 #endif
64693
64694+/* process credentials */
64695+ const struct cred __rcu *real_cred; /* objective and real subjective task
64696+ * credentials (COW) */
64697+ struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
64698+
64699 #ifdef CONFIG_DEBUG_MUTEXES
64700 /* mutex deadlock detection */
64701 struct mutex_waiter *blocked_on;
64702@@ -1508,6 +1534,21 @@ struct task_struct {
64703 unsigned long default_timer_slack_ns;
64704
64705 struct list_head *scm_work_list;
64706+
64707+#ifdef CONFIG_GRKERNSEC
64708+ /* grsecurity */
64709+ struct dentry *gr_chroot_dentry;
64710+ struct acl_subject_label *acl;
64711+ struct acl_role_label *role;
64712+ struct file *exec_file;
64713+ u16 acl_role_id;
64714+ /* is this the task that authenticated to the special role */
64715+ u8 acl_sp_role;
64716+ u8 is_writable;
64717+ u8 brute;
64718+ u8 gr_is_chrooted;
64719+#endif
64720+
64721 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
64722 /* Index of current stored address in ret_stack */
64723 int curr_ret_stack;
64724@@ -1542,6 +1583,57 @@ struct task_struct {
64725 #endif
64726 };
64727
64728+#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
64729+#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
64730+#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
64731+#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
64732+/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
64733+#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
64734+
64735+#ifdef CONFIG_PAX_SOFTMODE
64736+extern unsigned int pax_softmode;
64737+#endif
64738+
64739+extern int pax_check_flags(unsigned long *);
64740+
64741+/* if tsk != current then task_lock must be held on it */
64742+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
64743+static inline unsigned long pax_get_flags(struct task_struct *tsk)
64744+{
64745+ if (likely(tsk->mm))
64746+ return tsk->mm->pax_flags;
64747+ else
64748+ return 0UL;
64749+}
64750+
64751+/* if tsk != current then task_lock must be held on it */
64752+static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
64753+{
64754+ if (likely(tsk->mm)) {
64755+ tsk->mm->pax_flags = flags;
64756+ return 0;
64757+ }
64758+ return -EINVAL;
64759+}
64760+#endif
64761+
64762+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
64763+extern void pax_set_initial_flags(struct linux_binprm *bprm);
64764+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
64765+extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
64766+#endif
64767+
64768+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
64769+void pax_report_insns(void *pc, void *sp);
64770+void pax_report_refcount_overflow(struct pt_regs *regs);
64771+void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type);
64772+
64773+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
64774+extern void pax_track_stack(void);
64775+#else
64776+static inline void pax_track_stack(void) {}
64777+#endif
64778+
64779 /* Future-safe accessor for struct task_struct's cpus_allowed. */
64780 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
64781
64782@@ -2009,7 +2101,9 @@ void yield(void);
64783 extern struct exec_domain default_exec_domain;
64784
64785 union thread_union {
64786+#ifndef CONFIG_X86
64787 struct thread_info thread_info;
64788+#endif
64789 unsigned long stack[THREAD_SIZE/sizeof(long)];
64790 };
64791
64792@@ -2179,7 +2273,7 @@ extern void __cleanup_sighand(struct sig
64793 extern void exit_itimers(struct signal_struct *);
64794 extern void flush_itimer_signals(void);
64795
64796-extern NORET_TYPE void do_group_exit(int);
64797+extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
64798
64799 extern void daemonize(const char *, ...);
64800 extern int allow_signal(int);
64801@@ -2320,13 +2414,17 @@ static inline unsigned long *end_of_stac
64802
64803 #endif
64804
64805-static inline int object_is_on_stack(void *obj)
64806+static inline int object_starts_on_stack(void *obj)
64807 {
64808- void *stack = task_stack_page(current);
64809+ const void *stack = task_stack_page(current);
64810
64811 return (obj >= stack) && (obj < (stack + THREAD_SIZE));
64812 }
64813
64814+#ifdef CONFIG_PAX_USERCOPY
64815+extern int object_is_on_stack(const void *obj, unsigned long len);
64816+#endif
64817+
64818 extern void thread_info_cache_init(void);
64819
64820 #ifdef CONFIG_DEBUG_STACK_USAGE
64821diff -urNp linux-2.6.39.1/include/linux/screen_info.h linux-2.6.39.1/include/linux/screen_info.h
64822--- linux-2.6.39.1/include/linux/screen_info.h 2011-05-19 00:06:34.000000000 -0400
64823+++ linux-2.6.39.1/include/linux/screen_info.h 2011-05-22 19:36:33.000000000 -0400
64824@@ -43,7 +43,8 @@ struct screen_info {
64825 __u16 pages; /* 0x32 */
64826 __u16 vesa_attributes; /* 0x34 */
64827 __u32 capabilities; /* 0x36 */
64828- __u8 _reserved[6]; /* 0x3a */
64829+ __u16 vesapm_size; /* 0x3a */
64830+ __u8 _reserved[4]; /* 0x3c */
64831 } __attribute__((packed));
64832
64833 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
64834diff -urNp linux-2.6.39.1/include/linux/security.h linux-2.6.39.1/include/linux/security.h
64835--- linux-2.6.39.1/include/linux/security.h 2011-05-19 00:06:34.000000000 -0400
64836+++ linux-2.6.39.1/include/linux/security.h 2011-05-22 19:41:42.000000000 -0400
64837@@ -36,6 +36,7 @@
64838 #include <linux/key.h>
64839 #include <linux/xfrm.h>
64840 #include <linux/slab.h>
64841+#include <linux/grsecurity.h>
64842 #include <net/flow.h>
64843
64844 /* Maximum number of letters for an LSM name string */
64845diff -urNp linux-2.6.39.1/include/linux/shm.h linux-2.6.39.1/include/linux/shm.h
64846--- linux-2.6.39.1/include/linux/shm.h 2011-05-19 00:06:34.000000000 -0400
64847+++ linux-2.6.39.1/include/linux/shm.h 2011-05-22 19:41:42.000000000 -0400
64848@@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
64849 pid_t shm_cprid;
64850 pid_t shm_lprid;
64851 struct user_struct *mlock_user;
64852+#ifdef CONFIG_GRKERNSEC
64853+ time_t shm_createtime;
64854+ pid_t shm_lapid;
64855+#endif
64856 };
64857
64858 /* shm_mode upper byte flags */
64859diff -urNp linux-2.6.39.1/include/linux/skbuff.h linux-2.6.39.1/include/linux/skbuff.h
64860--- linux-2.6.39.1/include/linux/skbuff.h 2011-05-19 00:06:34.000000000 -0400
64861+++ linux-2.6.39.1/include/linux/skbuff.h 2011-05-22 19:36:33.000000000 -0400
64862@@ -592,7 +592,7 @@ static inline struct skb_shared_hwtstamp
64863 */
64864 static inline int skb_queue_empty(const struct sk_buff_head *list)
64865 {
64866- return list->next == (struct sk_buff *)list;
64867+ return list->next == (const struct sk_buff *)list;
64868 }
64869
64870 /**
64871@@ -605,7 +605,7 @@ static inline int skb_queue_empty(const
64872 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
64873 const struct sk_buff *skb)
64874 {
64875- return skb->next == (struct sk_buff *)list;
64876+ return skb->next == (const struct sk_buff *)list;
64877 }
64878
64879 /**
64880@@ -618,7 +618,7 @@ static inline bool skb_queue_is_last(con
64881 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
64882 const struct sk_buff *skb)
64883 {
64884- return skb->prev == (struct sk_buff *)list;
64885+ return skb->prev == (const struct sk_buff *)list;
64886 }
64887
64888 /**
64889@@ -1435,7 +1435,7 @@ static inline int pskb_network_may_pull(
64890 * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
64891 */
64892 #ifndef NET_SKB_PAD
64893-#define NET_SKB_PAD max(32, L1_CACHE_BYTES)
64894+#define NET_SKB_PAD max(_AC(32,U), L1_CACHE_BYTES)
64895 #endif
64896
64897 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
64898diff -urNp linux-2.6.39.1/include/linux/slab_def.h linux-2.6.39.1/include/linux/slab_def.h
64899--- linux-2.6.39.1/include/linux/slab_def.h 2011-05-19 00:06:34.000000000 -0400
64900+++ linux-2.6.39.1/include/linux/slab_def.h 2011-05-22 19:36:33.000000000 -0400
64901@@ -96,10 +96,10 @@ struct kmem_cache {
64902 unsigned long node_allocs;
64903 unsigned long node_frees;
64904 unsigned long node_overflow;
64905- atomic_t allochit;
64906- atomic_t allocmiss;
64907- atomic_t freehit;
64908- atomic_t freemiss;
64909+ atomic_unchecked_t allochit;
64910+ atomic_unchecked_t allocmiss;
64911+ atomic_unchecked_t freehit;
64912+ atomic_unchecked_t freemiss;
64913
64914 /*
64915 * If debugging is enabled, then the allocator can add additional
64916diff -urNp linux-2.6.39.1/include/linux/slab.h linux-2.6.39.1/include/linux/slab.h
64917--- linux-2.6.39.1/include/linux/slab.h 2011-05-19 00:06:34.000000000 -0400
64918+++ linux-2.6.39.1/include/linux/slab.h 2011-05-23 17:07:00.000000000 -0400
64919@@ -11,12 +11,20 @@
64920
64921 #include <linux/gfp.h>
64922 #include <linux/types.h>
64923+#include <linux/err.h>
64924
64925 /*
64926 * Flags to pass to kmem_cache_create().
64927 * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
64928 */
64929 #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
64930+
64931+#ifdef CONFIG_PAX_USERCOPY
64932+#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
64933+#else
64934+#define SLAB_USERCOPY 0x00000000UL
64935+#endif
64936+
64937 #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
64938 #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
64939 #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
64940@@ -87,10 +95,13 @@
64941 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
64942 * Both make kfree a no-op.
64943 */
64944-#define ZERO_SIZE_PTR ((void *)16)
64945+#define ZERO_SIZE_PTR \
64946+({ \
64947+ BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
64948+ (void *)(-MAX_ERRNO-1L); \
64949+})
64950
64951-#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
64952- (unsigned long)ZERO_SIZE_PTR)
64953+#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
64954
64955 /*
64956 * struct kmem_cache related prototypes
64957@@ -141,6 +152,7 @@ void * __must_check krealloc(const void
64958 void kfree(const void *);
64959 void kzfree(const void *);
64960 size_t ksize(const void *);
64961+void check_object_size(const void *ptr, unsigned long n, bool to);
64962
64963 /*
64964 * Allocator specific definitions. These are mainly used to establish optimized
64965@@ -333,4 +345,59 @@ static inline void *kzalloc_node(size_t
64966
64967 void __init kmem_cache_init_late(void);
64968
64969+#define kmalloc(x, y) \
64970+({ \
64971+ void *___retval; \
64972+ intoverflow_t ___x = (intoverflow_t)x; \
64973+ if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n")) \
64974+ ___retval = NULL; \
64975+ else \
64976+ ___retval = kmalloc((size_t)___x, (y)); \
64977+ ___retval; \
64978+})
64979+
64980+#define kmalloc_node(x, y, z) \
64981+({ \
64982+ void *___retval; \
64983+ intoverflow_t ___x = (intoverflow_t)x; \
64984+ if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
64985+ ___retval = NULL; \
64986+ else \
64987+ ___retval = kmalloc_node((size_t)___x, (y), (z));\
64988+ ___retval; \
64989+})
64990+
64991+#define kzalloc(x, y) \
64992+({ \
64993+ void *___retval; \
64994+ intoverflow_t ___x = (intoverflow_t)x; \
64995+ if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n")) \
64996+ ___retval = NULL; \
64997+ else \
64998+ ___retval = kzalloc((size_t)___x, (y)); \
64999+ ___retval; \
65000+})
65001+
65002+#define __krealloc(x, y, z) \
65003+({ \
65004+ void *___retval; \
65005+ intoverflow_t ___y = (intoverflow_t)y; \
65006+ if (WARN(___y > ULONG_MAX, "__krealloc size overflow\n"))\
65007+ ___retval = NULL; \
65008+ else \
65009+ ___retval = __krealloc((x), (size_t)___y, (z)); \
65010+ ___retval; \
65011+})
65012+
65013+#define krealloc(x, y, z) \
65014+({ \
65015+ void *___retval; \
65016+ intoverflow_t ___y = (intoverflow_t)y; \
65017+ if (WARN(___y > ULONG_MAX, "krealloc size overflow\n")) \
65018+ ___retval = NULL; \
65019+ else \
65020+ ___retval = krealloc((x), (size_t)___y, (z)); \
65021+ ___retval; \
65022+})
65023+
65024 #endif /* _LINUX_SLAB_H */
65025diff -urNp linux-2.6.39.1/include/linux/slub_def.h linux-2.6.39.1/include/linux/slub_def.h
65026--- linux-2.6.39.1/include/linux/slub_def.h 2011-05-19 00:06:34.000000000 -0400
65027+++ linux-2.6.39.1/include/linux/slub_def.h 2011-05-22 19:36:33.000000000 -0400
65028@@ -84,7 +84,7 @@ struct kmem_cache {
65029 struct kmem_cache_order_objects max;
65030 struct kmem_cache_order_objects min;
65031 gfp_t allocflags; /* gfp flags to use on each alloc */
65032- int refcount; /* Refcount for slab cache destroy */
65033+ atomic_t refcount; /* Refcount for slab cache destroy */
65034 void (*ctor)(void *);
65035 int inuse; /* Offset to metadata */
65036 int align; /* Alignment */
65037diff -urNp linux-2.6.39.1/include/linux/sonet.h linux-2.6.39.1/include/linux/sonet.h
65038--- linux-2.6.39.1/include/linux/sonet.h 2011-05-19 00:06:34.000000000 -0400
65039+++ linux-2.6.39.1/include/linux/sonet.h 2011-05-22 19:36:33.000000000 -0400
65040@@ -61,7 +61,7 @@ struct sonet_stats {
65041 #include <asm/atomic.h>
65042
65043 struct k_sonet_stats {
65044-#define __HANDLE_ITEM(i) atomic_t i
65045+#define __HANDLE_ITEM(i) atomic_unchecked_t i
65046 __SONET_ITEMS
65047 #undef __HANDLE_ITEM
65048 };
65049diff -urNp linux-2.6.39.1/include/linux/ssb/ssb_driver_gige.h linux-2.6.39.1/include/linux/ssb/ssb_driver_gige.h
65050--- linux-2.6.39.1/include/linux/ssb/ssb_driver_gige.h 2011-05-19 00:06:34.000000000 -0400
65051+++ linux-2.6.39.1/include/linux/ssb/ssb_driver_gige.h 2011-05-22 19:36:33.000000000 -0400
65052@@ -44,7 +44,7 @@ struct ssb_gige {
65053
65054 /* The PCI controller device. */
65055 struct pci_controller pci_controller;
65056- struct pci_ops pci_ops;
65057+ const struct pci_ops pci_ops;
65058 struct resource mem_resource;
65059 struct resource io_resource;
65060 };
65061diff -urNp linux-2.6.39.1/include/linux/sunrpc/clnt.h linux-2.6.39.1/include/linux/sunrpc/clnt.h
65062--- linux-2.6.39.1/include/linux/sunrpc/clnt.h 2011-05-19 00:06:34.000000000 -0400
65063+++ linux-2.6.39.1/include/linux/sunrpc/clnt.h 2011-05-22 19:36:33.000000000 -0400
65064@@ -169,9 +169,9 @@ static inline unsigned short rpc_get_por
65065 {
65066 switch (sap->sa_family) {
65067 case AF_INET:
65068- return ntohs(((struct sockaddr_in *)sap)->sin_port);
65069+ return ntohs(((const struct sockaddr_in *)sap)->sin_port);
65070 case AF_INET6:
65071- return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
65072+ return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
65073 }
65074 return 0;
65075 }
65076@@ -204,7 +204,7 @@ static inline bool __rpc_cmp_addr4(const
65077 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
65078 const struct sockaddr *src)
65079 {
65080- const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
65081+ const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
65082 struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
65083
65084 dsin->sin_family = ssin->sin_family;
65085@@ -301,7 +301,7 @@ static inline u32 rpc_get_scope_id(const
65086 if (sa->sa_family != AF_INET6)
65087 return 0;
65088
65089- return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
65090+ return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
65091 }
65092
65093 #endif /* __KERNEL__ */
65094diff -urNp linux-2.6.39.1/include/linux/sunrpc/svc_rdma.h linux-2.6.39.1/include/linux/sunrpc/svc_rdma.h
65095--- linux-2.6.39.1/include/linux/sunrpc/svc_rdma.h 2011-05-19 00:06:34.000000000 -0400
65096+++ linux-2.6.39.1/include/linux/sunrpc/svc_rdma.h 2011-05-22 19:36:33.000000000 -0400
65097@@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
65098 extern unsigned int svcrdma_max_requests;
65099 extern unsigned int svcrdma_max_req_size;
65100
65101-extern atomic_t rdma_stat_recv;
65102-extern atomic_t rdma_stat_read;
65103-extern atomic_t rdma_stat_write;
65104-extern atomic_t rdma_stat_sq_starve;
65105-extern atomic_t rdma_stat_rq_starve;
65106-extern atomic_t rdma_stat_rq_poll;
65107-extern atomic_t rdma_stat_rq_prod;
65108-extern atomic_t rdma_stat_sq_poll;
65109-extern atomic_t rdma_stat_sq_prod;
65110+extern atomic_unchecked_t rdma_stat_recv;
65111+extern atomic_unchecked_t rdma_stat_read;
65112+extern atomic_unchecked_t rdma_stat_write;
65113+extern atomic_unchecked_t rdma_stat_sq_starve;
65114+extern atomic_unchecked_t rdma_stat_rq_starve;
65115+extern atomic_unchecked_t rdma_stat_rq_poll;
65116+extern atomic_unchecked_t rdma_stat_rq_prod;
65117+extern atomic_unchecked_t rdma_stat_sq_poll;
65118+extern atomic_unchecked_t rdma_stat_sq_prod;
65119
65120 #define RPCRDMA_VERSION 1
65121
65122diff -urNp linux-2.6.39.1/include/linux/suspend.h linux-2.6.39.1/include/linux/suspend.h
65123--- linux-2.6.39.1/include/linux/suspend.h 2011-05-19 00:06:34.000000000 -0400
65124+++ linux-2.6.39.1/include/linux/suspend.h 2011-05-22 19:36:33.000000000 -0400
65125@@ -106,15 +106,15 @@ typedef int __bitwise suspend_state_t;
65126 * which require special recovery actions in that situation.
65127 */
65128 struct platform_suspend_ops {
65129- int (*valid)(suspend_state_t state);
65130- int (*begin)(suspend_state_t state);
65131- int (*prepare)(void);
65132- int (*prepare_late)(void);
65133- int (*enter)(suspend_state_t state);
65134- void (*wake)(void);
65135- void (*finish)(void);
65136- void (*end)(void);
65137- void (*recover)(void);
65138+ int (* const valid)(suspend_state_t state);
65139+ int (* const begin)(suspend_state_t state);
65140+ int (* const prepare)(void);
65141+ int (* const prepare_late)(void);
65142+ int (* const enter)(suspend_state_t state);
65143+ void (* const wake)(void);
65144+ void (* const finish)(void);
65145+ void (* const end)(void);
65146+ void (* const recover)(void);
65147 };
65148
65149 #ifdef CONFIG_SUSPEND
65150@@ -217,16 +217,16 @@ extern void mark_free_pages(struct zone
65151 * platforms which require special recovery actions in that situation.
65152 */
65153 struct platform_hibernation_ops {
65154- int (*begin)(void);
65155- void (*end)(void);
65156- int (*pre_snapshot)(void);
65157- void (*finish)(void);
65158- int (*prepare)(void);
65159- int (*enter)(void);
65160- void (*leave)(void);
65161- int (*pre_restore)(void);
65162- void (*restore_cleanup)(void);
65163- void (*recover)(void);
65164+ int (* const begin)(void);
65165+ void (* const end)(void);
65166+ int (* const pre_snapshot)(void);
65167+ void (* const finish)(void);
65168+ int (* const prepare)(void);
65169+ int (* const enter)(void);
65170+ void (* const leave)(void);
65171+ int (* const pre_restore)(void);
65172+ void (* const restore_cleanup)(void);
65173+ void (* const recover)(void);
65174 };
65175
65176 #ifdef CONFIG_HIBERNATION
65177diff -urNp linux-2.6.39.1/include/linux/sysctl.h linux-2.6.39.1/include/linux/sysctl.h
65178--- linux-2.6.39.1/include/linux/sysctl.h 2011-05-19 00:06:34.000000000 -0400
65179+++ linux-2.6.39.1/include/linux/sysctl.h 2011-05-22 19:41:42.000000000 -0400
65180@@ -155,7 +155,11 @@ enum
65181 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
65182 };
65183
65184-
65185+#ifdef CONFIG_PAX_SOFTMODE
65186+enum {
65187+ PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
65188+};
65189+#endif
65190
65191 /* CTL_VM names: */
65192 enum
65193@@ -967,6 +971,8 @@ typedef int proc_handler (struct ctl_tab
65194
65195 extern int proc_dostring(struct ctl_table *, int,
65196 void __user *, size_t *, loff_t *);
65197+extern int proc_dostring_modpriv(struct ctl_table *, int,
65198+ void __user *, size_t *, loff_t *);
65199 extern int proc_dointvec(struct ctl_table *, int,
65200 void __user *, size_t *, loff_t *);
65201 extern int proc_dointvec_minmax(struct ctl_table *, int,
65202diff -urNp linux-2.6.39.1/include/linux/sysfs.h linux-2.6.39.1/include/linux/sysfs.h
65203--- linux-2.6.39.1/include/linux/sysfs.h 2011-05-19 00:06:34.000000000 -0400
65204+++ linux-2.6.39.1/include/linux/sysfs.h 2011-05-22 19:36:33.000000000 -0400
65205@@ -110,8 +110,8 @@ struct bin_attribute {
65206 #define sysfs_bin_attr_init(bin_attr) sysfs_attr_init(&(bin_attr)->attr)
65207
65208 struct sysfs_ops {
65209- ssize_t (*show)(struct kobject *, struct attribute *,char *);
65210- ssize_t (*store)(struct kobject *,struct attribute *,const char *, size_t);
65211+ ssize_t (* const show)(struct kobject *, struct attribute *,char *);
65212+ ssize_t (* const store)(struct kobject *,struct attribute *,const char *, size_t);
65213 };
65214
65215 struct sysfs_dirent;
65216diff -urNp linux-2.6.39.1/include/linux/tty.h linux-2.6.39.1/include/linux/tty.h
65217--- linux-2.6.39.1/include/linux/tty.h 2011-05-19 00:06:34.000000000 -0400
65218+++ linux-2.6.39.1/include/linux/tty.h 2011-05-22 19:36:33.000000000 -0400
65219@@ -13,6 +13,7 @@
65220 #include <linux/tty_driver.h>
65221 #include <linux/tty_ldisc.h>
65222 #include <linux/mutex.h>
65223+#include <linux/poll.h>
65224
65225 #include <asm/system.h>
65226
65227@@ -466,7 +467,6 @@ extern int tty_perform_flush(struct tty_
65228 extern dev_t tty_devnum(struct tty_struct *tty);
65229 extern void proc_clear_tty(struct task_struct *p);
65230 extern struct tty_struct *get_current_tty(void);
65231-extern void tty_default_fops(struct file_operations *fops);
65232 extern struct tty_struct *alloc_tty_struct(void);
65233 extern int tty_add_file(struct tty_struct *tty, struct file *file);
65234 extern void free_tty_struct(struct tty_struct *tty);
65235@@ -529,6 +529,18 @@ extern void tty_ldisc_begin(void);
65236 /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
65237 extern void tty_ldisc_enable(struct tty_struct *tty);
65238
65239+/* tty_io.c */
65240+extern ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
65241+extern ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
65242+extern unsigned int tty_poll(struct file *, poll_table *);
65243+#ifdef CONFIG_COMPAT
65244+extern long tty_compat_ioctl(struct file *file, unsigned int cmd,
65245+ unsigned long arg);
65246+#else
65247+#define tty_compat_ioctl NULL
65248+#endif
65249+extern int tty_release(struct inode *, struct file *);
65250+extern int tty_fasync(int fd, struct file *filp, int on);
65251
65252 /* n_tty.c */
65253 extern struct tty_ldisc_ops tty_ldisc_N_TTY;
65254diff -urNp linux-2.6.39.1/include/linux/tty_ldisc.h linux-2.6.39.1/include/linux/tty_ldisc.h
65255--- linux-2.6.39.1/include/linux/tty_ldisc.h 2011-05-19 00:06:34.000000000 -0400
65256+++ linux-2.6.39.1/include/linux/tty_ldisc.h 2011-05-22 19:36:33.000000000 -0400
65257@@ -148,7 +148,7 @@ struct tty_ldisc_ops {
65258
65259 struct module *owner;
65260
65261- int refcount;
65262+ atomic_t refcount;
65263 };
65264
65265 struct tty_ldisc {
65266diff -urNp linux-2.6.39.1/include/linux/types.h linux-2.6.39.1/include/linux/types.h
65267--- linux-2.6.39.1/include/linux/types.h 2011-05-19 00:06:34.000000000 -0400
65268+++ linux-2.6.39.1/include/linux/types.h 2011-05-22 19:36:33.000000000 -0400
65269@@ -213,10 +213,26 @@ typedef struct {
65270 int counter;
65271 } atomic_t;
65272
65273+#ifdef CONFIG_PAX_REFCOUNT
65274+typedef struct {
65275+ int counter;
65276+} atomic_unchecked_t;
65277+#else
65278+typedef atomic_t atomic_unchecked_t;
65279+#endif
65280+
65281 #ifdef CONFIG_64BIT
65282 typedef struct {
65283 long counter;
65284 } atomic64_t;
65285+
65286+#ifdef CONFIG_PAX_REFCOUNT
65287+typedef struct {
65288+ long counter;
65289+} atomic64_unchecked_t;
65290+#else
65291+typedef atomic64_t atomic64_unchecked_t;
65292+#endif
65293 #endif
65294
65295 struct list_head {
65296diff -urNp linux-2.6.39.1/include/linux/uaccess.h linux-2.6.39.1/include/linux/uaccess.h
65297--- linux-2.6.39.1/include/linux/uaccess.h 2011-05-19 00:06:34.000000000 -0400
65298+++ linux-2.6.39.1/include/linux/uaccess.h 2011-05-22 19:36:33.000000000 -0400
65299@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
65300 long ret; \
65301 mm_segment_t old_fs = get_fs(); \
65302 \
65303- set_fs(KERNEL_DS); \
65304 pagefault_disable(); \
65305+ set_fs(KERNEL_DS); \
65306 ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
65307- pagefault_enable(); \
65308 set_fs(old_fs); \
65309+ pagefault_enable(); \
65310 ret; \
65311 })
65312
65313@@ -93,8 +93,8 @@ static inline unsigned long __copy_from_
65314 * Safely read from address @src to the buffer at @dst. If a kernel fault
65315 * happens, handle that and return -EFAULT.
65316 */
65317-extern long probe_kernel_read(void *dst, void *src, size_t size);
65318-extern long __probe_kernel_read(void *dst, void *src, size_t size);
65319+extern long probe_kernel_read(void *dst, const void *src, size_t size);
65320+extern long __probe_kernel_read(void *dst, const void *src, size_t size);
65321
65322 /*
65323 * probe_kernel_write(): safely attempt to write to a location
65324@@ -105,7 +105,7 @@ extern long __probe_kernel_read(void *ds
65325 * Safely write to address @dst from the buffer at @src. If a kernel fault
65326 * happens, handle that and return -EFAULT.
65327 */
65328-extern long notrace probe_kernel_write(void *dst, void *src, size_t size);
65329-extern long notrace __probe_kernel_write(void *dst, void *src, size_t size);
65330+extern long notrace probe_kernel_write(void *dst, const void *src, size_t size);
65331+extern long notrace __probe_kernel_write(void *dst, const void *src, size_t size);
65332
65333 #endif /* __LINUX_UACCESS_H__ */
65334diff -urNp linux-2.6.39.1/include/linux/unaligned/access_ok.h linux-2.6.39.1/include/linux/unaligned/access_ok.h
65335--- linux-2.6.39.1/include/linux/unaligned/access_ok.h 2011-05-19 00:06:34.000000000 -0400
65336+++ linux-2.6.39.1/include/linux/unaligned/access_ok.h 2011-05-22 19:36:33.000000000 -0400
65337@@ -6,32 +6,32 @@
65338
65339 static inline u16 get_unaligned_le16(const void *p)
65340 {
65341- return le16_to_cpup((__le16 *)p);
65342+ return le16_to_cpup((const __le16 *)p);
65343 }
65344
65345 static inline u32 get_unaligned_le32(const void *p)
65346 {
65347- return le32_to_cpup((__le32 *)p);
65348+ return le32_to_cpup((const __le32 *)p);
65349 }
65350
65351 static inline u64 get_unaligned_le64(const void *p)
65352 {
65353- return le64_to_cpup((__le64 *)p);
65354+ return le64_to_cpup((const __le64 *)p);
65355 }
65356
65357 static inline u16 get_unaligned_be16(const void *p)
65358 {
65359- return be16_to_cpup((__be16 *)p);
65360+ return be16_to_cpup((const __be16 *)p);
65361 }
65362
65363 static inline u32 get_unaligned_be32(const void *p)
65364 {
65365- return be32_to_cpup((__be32 *)p);
65366+ return be32_to_cpup((const __be32 *)p);
65367 }
65368
65369 static inline u64 get_unaligned_be64(const void *p)
65370 {
65371- return be64_to_cpup((__be64 *)p);
65372+ return be64_to_cpup((const __be64 *)p);
65373 }
65374
65375 static inline void put_unaligned_le16(u16 val, void *p)
65376diff -urNp linux-2.6.39.1/include/linux/usb/hcd.h linux-2.6.39.1/include/linux/usb/hcd.h
65377--- linux-2.6.39.1/include/linux/usb/hcd.h 2011-05-19 00:06:34.000000000 -0400
65378+++ linux-2.6.39.1/include/linux/usb/hcd.h 2011-05-22 19:36:33.000000000 -0400
65379@@ -615,7 +615,7 @@ struct usb_mon_operations {
65380 /* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
65381 };
65382
65383-extern struct usb_mon_operations *mon_ops;
65384+extern const struct usb_mon_operations *mon_ops;
65385
65386 static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
65387 {
65388@@ -637,7 +637,7 @@ static inline void usbmon_urb_complete(s
65389 (*mon_ops->urb_complete)(bus, urb, status);
65390 }
65391
65392-int usb_mon_register(struct usb_mon_operations *ops);
65393+int usb_mon_register(const struct usb_mon_operations *ops);
65394 void usb_mon_deregister(void);
65395
65396 #else
65397diff -urNp linux-2.6.39.1/include/linux/usb/intel_mid_otg.h linux-2.6.39.1/include/linux/usb/intel_mid_otg.h
65398--- linux-2.6.39.1/include/linux/usb/intel_mid_otg.h 2011-05-19 00:06:34.000000000 -0400
65399+++ linux-2.6.39.1/include/linux/usb/intel_mid_otg.h 2011-05-22 19:36:33.000000000 -0400
65400@@ -115,7 +115,7 @@ struct intel_mid_otg_xceiv {
65401 void __iomem *base;
65402
65403 /* ops to access ulpi */
65404- struct iotg_ulpi_access_ops ulpi_ops;
65405+ const struct iotg_ulpi_access_ops ulpi_ops;
65406
65407 /* atomic notifier for interrupt context */
65408 struct atomic_notifier_head iotg_notifier;
65409diff -urNp linux-2.6.39.1/include/linux/usb/ulpi.h linux-2.6.39.1/include/linux/usb/ulpi.h
65410--- linux-2.6.39.1/include/linux/usb/ulpi.h 2011-05-19 00:06:34.000000000 -0400
65411+++ linux-2.6.39.1/include/linux/usb/ulpi.h 2011-05-22 19:36:33.000000000 -0400
65412@@ -186,7 +186,7 @@ struct otg_transceiver *otg_ulpi_create(
65413
65414 #ifdef CONFIG_USB_ULPI_VIEWPORT
65415 /* access ops for controllers with a viewport register */
65416-extern struct otg_io_access_ops ulpi_viewport_access_ops;
65417+extern const struct otg_io_access_ops ulpi_viewport_access_ops;
65418 #endif
65419
65420 #endif /* __LINUX_USB_ULPI_H */
65421diff -urNp linux-2.6.39.1/include/linux/vga_switcheroo.h linux-2.6.39.1/include/linux/vga_switcheroo.h
65422--- linux-2.6.39.1/include/linux/vga_switcheroo.h 2011-05-19 00:06:34.000000000 -0400
65423+++ linux-2.6.39.1/include/linux/vga_switcheroo.h 2011-05-22 19:36:33.000000000 -0400
65424@@ -39,7 +39,7 @@ int vga_switcheroo_register_client(struc
65425 void vga_switcheroo_client_fb_set(struct pci_dev *dev,
65426 struct fb_info *info);
65427
65428-int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler);
65429+int vga_switcheroo_register_handler(const struct vga_switcheroo_handler *handler);
65430 void vga_switcheroo_unregister_handler(void);
65431
65432 int vga_switcheroo_process_delayed_switch(void);
65433@@ -52,7 +52,7 @@ static inline int vga_switcheroo_registe
65434 void (*reprobe)(struct pci_dev *dev),
65435 bool (*can_switch)(struct pci_dev *dev)) { return 0; }
65436 static inline void vga_switcheroo_client_fb_set(struct pci_dev *dev, struct fb_info *info) {}
65437-static inline int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler) { return 0; }
65438+static inline int vga_switcheroo_register_handler(const struct vga_switcheroo_handler *handler) { return 0; }
65439 static inline void vga_switcheroo_unregister_handler(void) {}
65440 static inline int vga_switcheroo_process_delayed_switch(void) { return 0; }
65441
65442diff -urNp linux-2.6.39.1/include/linux/virtio.h linux-2.6.39.1/include/linux/virtio.h
65443--- linux-2.6.39.1/include/linux/virtio.h 2011-05-19 00:06:34.000000000 -0400
65444+++ linux-2.6.39.1/include/linux/virtio.h 2011-05-22 19:36:33.000000000 -0400
65445@@ -102,7 +102,7 @@ struct virtio_device {
65446 int index;
65447 struct device dev;
65448 struct virtio_device_id id;
65449- struct virtio_config_ops *config;
65450+ const struct virtio_config_ops *config;
65451 struct list_head vqs;
65452 /* Note that this is a Linux set_bit-style bitmap. */
65453 unsigned long features[1];
65454diff -urNp linux-2.6.39.1/include/linux/vmalloc.h linux-2.6.39.1/include/linux/vmalloc.h
65455--- linux-2.6.39.1/include/linux/vmalloc.h 2011-05-19 00:06:34.000000000 -0400
65456+++ linux-2.6.39.1/include/linux/vmalloc.h 2011-05-22 19:36:33.000000000 -0400
65457@@ -13,6 +13,11 @@ struct vm_area_struct; /* vma defining
65458 #define VM_MAP 0x00000004 /* vmap()ed pages */
65459 #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
65460 #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
65461+
65462+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
65463+#define VM_KERNEXEC 0x00000020 /* allocate from executable kernel memory range */
65464+#endif
65465+
65466 /* bits [20..32] reserved for arch specific ioremap internals */
65467
65468 /*
65469@@ -155,4 +160,103 @@ pcpu_free_vm_areas(struct vm_struct **vm
65470 # endif
65471 #endif
65472
65473+#define vmalloc(x) \
65474+({ \
65475+ void *___retval; \
65476+ intoverflow_t ___x = (intoverflow_t)x; \
65477+ if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n")) \
65478+ ___retval = NULL; \
65479+ else \
65480+ ___retval = vmalloc((unsigned long)___x); \
65481+ ___retval; \
65482+})
65483+
65484+#define vzalloc(x) \
65485+({ \
65486+ void *___retval; \
65487+ intoverflow_t ___x = (intoverflow_t)x; \
65488+ if (WARN(___x > ULONG_MAX, "vzalloc size overflow\n")) \
65489+ ___retval = NULL; \
65490+ else \
65491+ ___retval = vzalloc((unsigned long)___x); \
65492+ ___retval; \
65493+})
65494+
65495+#define __vmalloc(x, y, z) \
65496+({ \
65497+ void *___retval; \
65498+ intoverflow_t ___x = (intoverflow_t)x; \
65499+ if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
65500+ ___retval = NULL; \
65501+ else \
65502+ ___retval = __vmalloc((unsigned long)___x, (y), (z));\
65503+ ___retval; \
65504+})
65505+
65506+#define vmalloc_user(x) \
65507+({ \
65508+ void *___retval; \
65509+ intoverflow_t ___x = (intoverflow_t)x; \
65510+ if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
65511+ ___retval = NULL; \
65512+ else \
65513+ ___retval = vmalloc_user((unsigned long)___x); \
65514+ ___retval; \
65515+})
65516+
65517+#define vmalloc_exec(x) \
65518+({ \
65519+ void *___retval; \
65520+ intoverflow_t ___x = (intoverflow_t)x; \
65521+ if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
65522+ ___retval = NULL; \
65523+ else \
65524+ ___retval = vmalloc_exec((unsigned long)___x); \
65525+ ___retval; \
65526+})
65527+
65528+#define vmalloc_node(x, y) \
65529+({ \
65530+ void *___retval; \
65531+ intoverflow_t ___x = (intoverflow_t)x; \
65532+ if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
65533+ ___retval = NULL; \
65534+ else \
65535+ ___retval = vmalloc_node((unsigned long)___x, (y));\
65536+ ___retval; \
65537+})
65538+
65539+#define vzalloc_node(x, y) \
65540+({ \
65541+ void *___retval; \
65542+ intoverflow_t ___x = (intoverflow_t)x; \
65543+ if (WARN(___x > ULONG_MAX, "vzalloc_node size overflow\n"))\
65544+ ___retval = NULL; \
65545+ else \
65546+ ___retval = vzalloc_node((unsigned long)___x, (y));\
65547+ ___retval; \
65548+})
65549+
65550+#define vmalloc_32(x) \
65551+({ \
65552+ void *___retval; \
65553+ intoverflow_t ___x = (intoverflow_t)x; \
65554+ if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
65555+ ___retval = NULL; \
65556+ else \
65557+ ___retval = vmalloc_32((unsigned long)___x); \
65558+ ___retval; \
65559+})
65560+
65561+#define vmalloc_32_user(x) \
65562+({ \
65563+void *___retval; \
65564+ intoverflow_t ___x = (intoverflow_t)x; \
65565+ if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
65566+ ___retval = NULL; \
65567+ else \
65568+ ___retval = vmalloc_32_user((unsigned long)___x);\
65569+ ___retval; \
65570+})
65571+
65572 #endif /* _LINUX_VMALLOC_H */
65573diff -urNp linux-2.6.39.1/include/linux/vmstat.h linux-2.6.39.1/include/linux/vmstat.h
65574--- linux-2.6.39.1/include/linux/vmstat.h 2011-05-19 00:06:34.000000000 -0400
65575+++ linux-2.6.39.1/include/linux/vmstat.h 2011-05-22 19:36:33.000000000 -0400
65576@@ -147,18 +147,18 @@ static inline void vm_events_fold_cpu(in
65577 /*
65578 * Zone based page accounting with per cpu differentials.
65579 */
65580-extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
65581+extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
65582
65583 static inline void zone_page_state_add(long x, struct zone *zone,
65584 enum zone_stat_item item)
65585 {
65586- atomic_long_add(x, &zone->vm_stat[item]);
65587- atomic_long_add(x, &vm_stat[item]);
65588+ atomic_long_add_unchecked(x, &zone->vm_stat[item]);
65589+ atomic_long_add_unchecked(x, &vm_stat[item]);
65590 }
65591
65592 static inline unsigned long global_page_state(enum zone_stat_item item)
65593 {
65594- long x = atomic_long_read(&vm_stat[item]);
65595+ long x = atomic_long_read_unchecked(&vm_stat[item]);
65596 #ifdef CONFIG_SMP
65597 if (x < 0)
65598 x = 0;
65599@@ -169,7 +169,7 @@ static inline unsigned long global_page_
65600 static inline unsigned long zone_page_state(struct zone *zone,
65601 enum zone_stat_item item)
65602 {
65603- long x = atomic_long_read(&zone->vm_stat[item]);
65604+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
65605 #ifdef CONFIG_SMP
65606 if (x < 0)
65607 x = 0;
65608@@ -186,7 +186,7 @@ static inline unsigned long zone_page_st
65609 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
65610 enum zone_stat_item item)
65611 {
65612- long x = atomic_long_read(&zone->vm_stat[item]);
65613+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
65614
65615 #ifdef CONFIG_SMP
65616 int cpu;
65617@@ -280,8 +280,8 @@ static inline void __mod_zone_page_state
65618
65619 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
65620 {
65621- atomic_long_inc(&zone->vm_stat[item]);
65622- atomic_long_inc(&vm_stat[item]);
65623+ atomic_long_inc_unchecked(&zone->vm_stat[item]);
65624+ atomic_long_inc_unchecked(&vm_stat[item]);
65625 }
65626
65627 static inline void __inc_zone_page_state(struct page *page,
65628@@ -292,8 +292,8 @@ static inline void __inc_zone_page_state
65629
65630 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
65631 {
65632- atomic_long_dec(&zone->vm_stat[item]);
65633- atomic_long_dec(&vm_stat[item]);
65634+ atomic_long_dec_unchecked(&zone->vm_stat[item]);
65635+ atomic_long_dec_unchecked(&vm_stat[item]);
65636 }
65637
65638 static inline void __dec_zone_page_state(struct page *page,
65639diff -urNp linux-2.6.39.1/include/media/saa7146_vv.h linux-2.6.39.1/include/media/saa7146_vv.h
65640--- linux-2.6.39.1/include/media/saa7146_vv.h 2011-05-19 00:06:34.000000000 -0400
65641+++ linux-2.6.39.1/include/media/saa7146_vv.h 2011-05-22 19:36:33.000000000 -0400
65642@@ -202,13 +202,13 @@ void saa7146_set_gpio(struct saa7146_dev
65643
65644 /* from saa7146_video.c */
65645 extern const struct v4l2_ioctl_ops saa7146_video_ioctl_ops;
65646-extern struct saa7146_use_ops saa7146_video_uops;
65647+extern const struct saa7146_use_ops saa7146_video_uops;
65648 int saa7146_start_preview(struct saa7146_fh *fh);
65649 int saa7146_stop_preview(struct saa7146_fh *fh);
65650 long saa7146_video_do_ioctl(struct file *file, unsigned int cmd, void *arg);
65651
65652 /* from saa7146_vbi.c */
65653-extern struct saa7146_use_ops saa7146_vbi_uops;
65654+extern const struct saa7146_use_ops saa7146_vbi_uops;
65655
65656 /* resource management functions */
65657 int saa7146_res_get(struct saa7146_fh *fh, unsigned int bit);
65658diff -urNp linux-2.6.39.1/include/media/v4l2-device.h linux-2.6.39.1/include/media/v4l2-device.h
65659--- linux-2.6.39.1/include/media/v4l2-device.h 2011-05-19 00:06:34.000000000 -0400
65660+++ linux-2.6.39.1/include/media/v4l2-device.h 2011-05-22 19:36:33.000000000 -0400
65661@@ -95,7 +95,7 @@ int __must_check v4l2_device_register(st
65662 this function returns 0. If the name ends with a digit (e.g. cx18),
65663 then the name will be set to cx18-0 since cx180 looks really odd. */
65664 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
65665- atomic_t *instance);
65666+ atomic_unchecked_t *instance);
65667
65668 /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
65669 Since the parent disappears this ensures that v4l2_dev doesn't have an
65670diff -urNp linux-2.6.39.1/include/net/caif/cfctrl.h linux-2.6.39.1/include/net/caif/cfctrl.h
65671--- linux-2.6.39.1/include/net/caif/cfctrl.h 2011-05-19 00:06:34.000000000 -0400
65672+++ linux-2.6.39.1/include/net/caif/cfctrl.h 2011-05-22 19:36:33.000000000 -0400
65673@@ -101,8 +101,8 @@ struct cfctrl_request_info {
65674 struct cfctrl {
65675 struct cfsrvl serv;
65676 struct cfctrl_rsp res;
65677- atomic_t req_seq_no;
65678- atomic_t rsp_seq_no;
65679+ atomic_unchecked_t req_seq_no;
65680+ atomic_unchecked_t rsp_seq_no;
65681 struct list_head list;
65682 /* Protects from simultaneous access to first_req list */
65683 spinlock_t info_list_lock;
65684diff -urNp linux-2.6.39.1/include/net/flow.h linux-2.6.39.1/include/net/flow.h
65685--- linux-2.6.39.1/include/net/flow.h 2011-05-19 00:06:34.000000000 -0400
65686+++ linux-2.6.39.1/include/net/flow.h 2011-05-22 19:36:33.000000000 -0400
65687@@ -167,6 +167,6 @@ extern struct flow_cache_object *flow_ca
65688 u8 dir, flow_resolve_t resolver, void *ctx);
65689
65690 extern void flow_cache_flush(void);
65691-extern atomic_t flow_cache_genid;
65692+extern atomic_unchecked_t flow_cache_genid;
65693
65694 #endif
65695diff -urNp linux-2.6.39.1/include/net/inetpeer.h linux-2.6.39.1/include/net/inetpeer.h
65696--- linux-2.6.39.1/include/net/inetpeer.h 2011-05-19 00:06:34.000000000 -0400
65697+++ linux-2.6.39.1/include/net/inetpeer.h 2011-05-22 19:36:33.000000000 -0400
65698@@ -43,8 +43,8 @@ struct inet_peer {
65699 */
65700 union {
65701 struct {
65702- atomic_t rid; /* Frag reception counter */
65703- atomic_t ip_id_count; /* IP ID for the next packet */
65704+ atomic_unchecked_t rid; /* Frag reception counter */
65705+ atomic_unchecked_t ip_id_count; /* IP ID for the next packet */
65706 __u32 tcp_ts;
65707 __u32 tcp_ts_stamp;
65708 u32 metrics[RTAX_MAX];
65709@@ -108,7 +108,7 @@ static inline __u16 inet_getid(struct in
65710 {
65711 more++;
65712 inet_peer_refcheck(p);
65713- return atomic_add_return(more, &p->ip_id_count) - more;
65714+ return atomic_add_return_unchecked(more, &p->ip_id_count) - more;
65715 }
65716
65717 #endif /* _NET_INETPEER_H */
65718diff -urNp linux-2.6.39.1/include/net/ip_fib.h linux-2.6.39.1/include/net/ip_fib.h
65719--- linux-2.6.39.1/include/net/ip_fib.h 2011-05-19 00:06:34.000000000 -0400
65720+++ linux-2.6.39.1/include/net/ip_fib.h 2011-05-22 19:36:33.000000000 -0400
65721@@ -146,7 +146,7 @@ extern __be32 fib_info_update_nh_saddr(s
65722
65723 #define FIB_RES_SADDR(net, res) \
65724 ((FIB_RES_NH(res).nh_saddr_genid == \
65725- atomic_read(&(net)->ipv4.dev_addr_genid)) ? \
65726+ atomic_read_unchecked(&(net)->ipv4.dev_addr_genid)) ? \
65727 FIB_RES_NH(res).nh_saddr : \
65728 fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
65729 #define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw)
65730diff -urNp linux-2.6.39.1/include/net/ip_vs.h linux-2.6.39.1/include/net/ip_vs.h
65731--- linux-2.6.39.1/include/net/ip_vs.h 2011-05-19 00:06:34.000000000 -0400
65732+++ linux-2.6.39.1/include/net/ip_vs.h 2011-05-22 19:36:33.000000000 -0400
65733@@ -512,7 +512,7 @@ struct ip_vs_conn {
65734 struct ip_vs_conn *control; /* Master control connection */
65735 atomic_t n_control; /* Number of controlled ones */
65736 struct ip_vs_dest *dest; /* real server */
65737- atomic_t in_pkts; /* incoming packet counter */
65738+ atomic_unchecked_t in_pkts; /* incoming packet counter */
65739
65740 /* packet transmitter for different forwarding methods. If it
65741 mangles the packet, it must return NF_DROP or better NF_STOLEN,
65742@@ -650,7 +650,7 @@ struct ip_vs_dest {
65743 __be16 port; /* port number of the server */
65744 union nf_inet_addr addr; /* IP address of the server */
65745 volatile unsigned flags; /* dest status flags */
65746- atomic_t conn_flags; /* flags to copy to conn */
65747+ atomic_unchecked_t conn_flags; /* flags to copy to conn */
65748 atomic_t weight; /* server weight */
65749
65750 atomic_t refcnt; /* reference counter */
65751diff -urNp linux-2.6.39.1/include/net/irda/ircomm_tty.h linux-2.6.39.1/include/net/irda/ircomm_tty.h
65752--- linux-2.6.39.1/include/net/irda/ircomm_tty.h 2011-05-19 00:06:34.000000000 -0400
65753+++ linux-2.6.39.1/include/net/irda/ircomm_tty.h 2011-05-22 19:36:33.000000000 -0400
65754@@ -35,6 +35,7 @@
65755 #include <linux/termios.h>
65756 #include <linux/timer.h>
65757 #include <linux/tty.h> /* struct tty_struct */
65758+#include <asm/local.h>
65759
65760 #include <net/irda/irias_object.h>
65761 #include <net/irda/ircomm_core.h>
65762@@ -105,8 +106,8 @@ struct ircomm_tty_cb {
65763 unsigned short close_delay;
65764 unsigned short closing_wait; /* time to wait before closing */
65765
65766- int open_count;
65767- int blocked_open; /* # of blocked opens */
65768+ local_t open_count;
65769+ local_t blocked_open; /* # of blocked opens */
65770
65771 /* Protect concurent access to :
65772 * o self->open_count
65773diff -urNp linux-2.6.39.1/include/net/iucv/af_iucv.h linux-2.6.39.1/include/net/iucv/af_iucv.h
65774--- linux-2.6.39.1/include/net/iucv/af_iucv.h 2011-05-19 00:06:34.000000000 -0400
65775+++ linux-2.6.39.1/include/net/iucv/af_iucv.h 2011-05-22 19:36:33.000000000 -0400
65776@@ -87,7 +87,7 @@ struct iucv_sock {
65777 struct iucv_sock_list {
65778 struct hlist_head head;
65779 rwlock_t lock;
65780- atomic_t autobind_name;
65781+ atomic_unchecked_t autobind_name;
65782 };
65783
65784 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
65785diff -urNp linux-2.6.39.1/include/net/neighbour.h linux-2.6.39.1/include/net/neighbour.h
65786--- linux-2.6.39.1/include/net/neighbour.h 2011-05-19 00:06:34.000000000 -0400
65787+++ linux-2.6.39.1/include/net/neighbour.h 2011-05-22 19:36:33.000000000 -0400
65788@@ -118,12 +118,12 @@ struct neighbour {
65789
65790 struct neigh_ops {
65791 int family;
65792- void (*solicit)(struct neighbour *, struct sk_buff*);
65793- void (*error_report)(struct neighbour *, struct sk_buff*);
65794- int (*output)(struct sk_buff*);
65795- int (*connected_output)(struct sk_buff*);
65796- int (*hh_output)(struct sk_buff*);
65797- int (*queue_xmit)(struct sk_buff*);
65798+ void (* const solicit)(struct neighbour *, struct sk_buff*);
65799+ void (* const error_report)(struct neighbour *, struct sk_buff*);
65800+ int (* const output)(struct sk_buff*);
65801+ int (* const connected_output)(struct sk_buff*);
65802+ int (* const hh_output)(struct sk_buff*);
65803+ int (* const queue_xmit)(struct sk_buff*);
65804 };
65805
65806 struct pneigh_entry {
65807diff -urNp linux-2.6.39.1/include/net/netfilter/nf_conntrack_ecache.h linux-2.6.39.1/include/net/netfilter/nf_conntrack_ecache.h
65808--- linux-2.6.39.1/include/net/netfilter/nf_conntrack_ecache.h 2011-05-19 00:06:34.000000000 -0400
65809+++ linux-2.6.39.1/include/net/netfilter/nf_conntrack_ecache.h 2011-05-22 19:36:33.000000000 -0400
65810@@ -95,7 +95,7 @@ nf_conntrack_eventmask_report(unsigned i
65811 int report)
65812 {
65813 int ret = 0;
65814- struct nf_ct_event_notifier *notify;
65815+ const struct nf_ct_event_notifier *notify;
65816 struct nf_conntrack_ecache *e;
65817
65818 rcu_read_lock();
65819@@ -174,7 +174,7 @@ nf_ct_expect_event_report(enum ip_conntr
65820 u32 pid,
65821 int report)
65822 {
65823- struct nf_exp_event_notifier *notify;
65824+ const struct nf_exp_event_notifier *notify;
65825 struct nf_conntrack_ecache *e;
65826
65827 rcu_read_lock();
65828diff -urNp linux-2.6.39.1/include/net/netlink.h linux-2.6.39.1/include/net/netlink.h
65829--- linux-2.6.39.1/include/net/netlink.h 2011-05-19 00:06:34.000000000 -0400
65830+++ linux-2.6.39.1/include/net/netlink.h 2011-05-22 19:36:33.000000000 -0400
65831@@ -562,7 +562,7 @@ static inline void *nlmsg_get_pos(struct
65832 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
65833 {
65834 if (mark)
65835- skb_trim(skb, (unsigned char *) mark - skb->data);
65836+ skb_trim(skb, (const unsigned char *) mark - skb->data);
65837 }
65838
65839 /**
65840diff -urNp linux-2.6.39.1/include/net/netns/ipv4.h linux-2.6.39.1/include/net/netns/ipv4.h
65841--- linux-2.6.39.1/include/net/netns/ipv4.h 2011-05-19 00:06:34.000000000 -0400
65842+++ linux-2.6.39.1/include/net/netns/ipv4.h 2011-05-22 19:36:33.000000000 -0400
65843@@ -54,8 +54,8 @@ struct netns_ipv4 {
65844 int sysctl_rt_cache_rebuild_count;
65845 int current_rt_cache_rebuild_count;
65846
65847- atomic_t rt_genid;
65848- atomic_t dev_addr_genid;
65849+ atomic_unchecked_t rt_genid;
65850+ atomic_unchecked_t dev_addr_genid;
65851
65852 #ifdef CONFIG_IP_MROUTE
65853 #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
65854diff -urNp linux-2.6.39.1/include/net/sctp/sctp.h linux-2.6.39.1/include/net/sctp/sctp.h
65855--- linux-2.6.39.1/include/net/sctp/sctp.h 2011-05-19 00:06:34.000000000 -0400
65856+++ linux-2.6.39.1/include/net/sctp/sctp.h 2011-05-22 19:36:33.000000000 -0400
65857@@ -316,9 +316,9 @@ do { \
65858
65859 #else /* SCTP_DEBUG */
65860
65861-#define SCTP_DEBUG_PRINTK(whatever...)
65862-#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)
65863-#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
65864+#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
65865+#define SCTP_DEBUG_PRINTK_CONT(fmt, args...) do {} while (0)
65866+#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
65867 #define SCTP_ENABLE_DEBUG
65868 #define SCTP_DISABLE_DEBUG
65869 #define SCTP_ASSERT(expr, str, func)
65870diff -urNp linux-2.6.39.1/include/net/sock.h linux-2.6.39.1/include/net/sock.h
65871--- linux-2.6.39.1/include/net/sock.h 2011-05-19 00:06:34.000000000 -0400
65872+++ linux-2.6.39.1/include/net/sock.h 2011-05-22 19:36:33.000000000 -0400
65873@@ -277,7 +277,7 @@ struct sock {
65874 #ifdef CONFIG_RPS
65875 __u32 sk_rxhash;
65876 #endif
65877- atomic_t sk_drops;
65878+ atomic_unchecked_t sk_drops;
65879 int sk_rcvbuf;
65880
65881 struct sk_filter __rcu *sk_filter;
65882diff -urNp linux-2.6.39.1/include/net/tcp.h linux-2.6.39.1/include/net/tcp.h
65883--- linux-2.6.39.1/include/net/tcp.h 2011-05-19 00:06:34.000000000 -0400
65884+++ linux-2.6.39.1/include/net/tcp.h 2011-05-22 19:36:33.000000000 -0400
65885@@ -1374,7 +1374,7 @@ enum tcp_seq_states {
65886 struct tcp_seq_afinfo {
65887 char *name;
65888 sa_family_t family;
65889- struct file_operations seq_fops;
65890+ struct file_operations seq_fops; /* cannot be const */
65891 struct seq_operations seq_ops;
65892 };
65893
65894diff -urNp linux-2.6.39.1/include/net/udp.h linux-2.6.39.1/include/net/udp.h
65895--- linux-2.6.39.1/include/net/udp.h 2011-05-19 00:06:34.000000000 -0400
65896+++ linux-2.6.39.1/include/net/udp.h 2011-05-22 19:36:33.000000000 -0400
65897@@ -234,7 +234,7 @@ struct udp_seq_afinfo {
65898 char *name;
65899 sa_family_t family;
65900 struct udp_table *udp_table;
65901- struct file_operations seq_fops;
65902+ struct file_operations seq_fops; /* cannot be const */
65903 struct seq_operations seq_ops;
65904 };
65905
65906diff -urNp linux-2.6.39.1/include/net/xfrm.h linux-2.6.39.1/include/net/xfrm.h
65907--- linux-2.6.39.1/include/net/xfrm.h 2011-05-19 00:06:34.000000000 -0400
65908+++ linux-2.6.39.1/include/net/xfrm.h 2011-05-22 19:36:33.000000000 -0400
65909@@ -505,7 +505,7 @@ struct xfrm_policy {
65910 struct timer_list timer;
65911
65912 struct flow_cache_object flo;
65913- atomic_t genid;
65914+ atomic_unchecked_t genid;
65915 u32 priority;
65916 u32 index;
65917 struct xfrm_mark mark;
65918diff -urNp linux-2.6.39.1/include/pcmcia/ss.h linux-2.6.39.1/include/pcmcia/ss.h
65919--- linux-2.6.39.1/include/pcmcia/ss.h 2011-05-19 00:06:34.000000000 -0400
65920+++ linux-2.6.39.1/include/pcmcia/ss.h 2011-05-22 19:36:33.000000000 -0400
65921@@ -241,9 +241,9 @@ struct pcmcia_socket {
65922 * "select PCCARD_NONSTATIC" in Kconfig.
65923 *
65924 */
65925-extern struct pccard_resource_ops pccard_static_ops;
65926+extern const struct pccard_resource_ops pccard_static_ops;
65927 #if defined(CONFIG_PCMCIA) || defined(CONFIG_PCMCIA_MODULE)
65928-extern struct pccard_resource_ops pccard_iodyn_ops;
65929+extern const struct pccard_resource_ops pccard_iodyn_ops;
65930 extern struct pccard_resource_ops pccard_nonstatic_ops;
65931 #else
65932 /* If PCMCIA is not used, but only CARDBUS, these functions are not used
65933diff -urNp linux-2.6.39.1/include/rdma/ib_verbs.h linux-2.6.39.1/include/rdma/ib_verbs.h
65934--- linux-2.6.39.1/include/rdma/ib_verbs.h 2011-05-19 00:06:34.000000000 -0400
65935+++ linux-2.6.39.1/include/rdma/ib_verbs.h 2011-05-22 19:36:33.000000000 -0400
65936@@ -1149,7 +1149,7 @@ struct ib_device {
65937 struct ib_mad *in_mad,
65938 struct ib_mad *out_mad);
65939
65940- struct ib_dma_mapping_ops *dma_ops;
65941+ const struct ib_dma_mapping_ops *dma_ops;
65942
65943 struct module *owner;
65944 struct device dev;
65945diff -urNp linux-2.6.39.1/include/scsi/libfc.h linux-2.6.39.1/include/scsi/libfc.h
65946--- linux-2.6.39.1/include/scsi/libfc.h 2011-05-19 00:06:34.000000000 -0400
65947+++ linux-2.6.39.1/include/scsi/libfc.h 2011-05-22 19:36:33.000000000 -0400
65948@@ -202,7 +202,7 @@ struct fc_rport_priv {
65949 struct mutex rp_mutex;
65950 struct delayed_work retry_work;
65951 enum fc_rport_event event;
65952- struct fc_rport_operations *ops;
65953+ const struct fc_rport_operations *ops;
65954 struct list_head peers;
65955 struct work_struct event_work;
65956 u32 supported_classes;
65957diff -urNp linux-2.6.39.1/include/scsi/scsi_device.h linux-2.6.39.1/include/scsi/scsi_device.h
65958--- linux-2.6.39.1/include/scsi/scsi_device.h 2011-05-19 00:06:34.000000000 -0400
65959+++ linux-2.6.39.1/include/scsi/scsi_device.h 2011-05-22 19:36:33.000000000 -0400
65960@@ -161,9 +161,9 @@ struct scsi_device {
65961 unsigned int max_device_blocked; /* what device_blocked counts down from */
65962 #define SCSI_DEFAULT_DEVICE_BLOCKED 3
65963
65964- atomic_t iorequest_cnt;
65965- atomic_t iodone_cnt;
65966- atomic_t ioerr_cnt;
65967+ atomic_unchecked_t iorequest_cnt;
65968+ atomic_unchecked_t iodone_cnt;
65969+ atomic_unchecked_t ioerr_cnt;
65970
65971 struct device sdev_gendev,
65972 sdev_dev;
65973diff -urNp linux-2.6.39.1/include/sound/ac97_codec.h linux-2.6.39.1/include/sound/ac97_codec.h
65974--- linux-2.6.39.1/include/sound/ac97_codec.h 2011-05-19 00:06:34.000000000 -0400
65975+++ linux-2.6.39.1/include/sound/ac97_codec.h 2011-05-22 19:36:33.000000000 -0400
65976@@ -424,15 +424,15 @@
65977 struct snd_ac97;
65978
65979 struct snd_ac97_build_ops {
65980- int (*build_3d) (struct snd_ac97 *ac97);
65981- int (*build_specific) (struct snd_ac97 *ac97);
65982- int (*build_spdif) (struct snd_ac97 *ac97);
65983- int (*build_post_spdif) (struct snd_ac97 *ac97);
65984+ int (* const build_3d) (struct snd_ac97 *ac97);
65985+ int (* const build_specific) (struct snd_ac97 *ac97);
65986+ int (* const build_spdif) (struct snd_ac97 *ac97);
65987+ int (* const build_post_spdif) (struct snd_ac97 *ac97);
65988 #ifdef CONFIG_PM
65989- void (*suspend) (struct snd_ac97 *ac97);
65990- void (*resume) (struct snd_ac97 *ac97);
65991+ void (* const suspend) (struct snd_ac97 *ac97);
65992+ void (* const resume) (struct snd_ac97 *ac97);
65993 #endif
65994- void (*update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
65995+ void (* const update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
65996 };
65997
65998 struct snd_ac97_bus_ops {
65999@@ -446,7 +446,7 @@ struct snd_ac97_bus_ops {
66000
66001 struct snd_ac97_bus {
66002 /* -- lowlevel (hardware) driver specific -- */
66003- struct snd_ac97_bus_ops *ops;
66004+ const struct snd_ac97_bus_ops *ops;
66005 void *private_data;
66006 void (*private_free) (struct snd_ac97_bus *bus);
66007 /* --- */
66008@@ -556,7 +556,7 @@ static inline int ac97_can_spdif(struct
66009
66010 /* functions */
66011 /* create new AC97 bus */
66012-int snd_ac97_bus(struct snd_card *card, int num, struct snd_ac97_bus_ops *ops,
66013+int snd_ac97_bus(struct snd_card *card, int num, const struct snd_ac97_bus_ops *ops,
66014 void *private_data, struct snd_ac97_bus **rbus);
66015 /* create mixer controls */
66016 int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template,
66017diff -urNp linux-2.6.39.1/include/sound/core.h linux-2.6.39.1/include/sound/core.h
66018--- linux-2.6.39.1/include/sound/core.h 2011-05-19 00:06:34.000000000 -0400
66019+++ linux-2.6.39.1/include/sound/core.h 2011-05-22 19:36:33.000000000 -0400
66020@@ -88,7 +88,7 @@ struct snd_device {
66021 snd_device_state_t state; /* state of the device */
66022 snd_device_type_t type; /* device type */
66023 void *device_data; /* device structure */
66024- struct snd_device_ops *ops; /* operations */
66025+ const struct snd_device_ops *ops; /* operations */
66026 };
66027
66028 #define snd_device(n) list_entry(n, struct snd_device, list)
66029@@ -301,7 +301,7 @@ int snd_card_file_remove(struct snd_card
66030 /* device.c */
66031
66032 int snd_device_new(struct snd_card *card, snd_device_type_t type,
66033- void *device_data, struct snd_device_ops *ops);
66034+ void *device_data, const struct snd_device_ops *ops);
66035 int snd_device_register(struct snd_card *card, void *device_data);
66036 int snd_device_register_all(struct snd_card *card);
66037 int snd_device_disconnect(struct snd_card *card, void *device_data);
66038diff -urNp linux-2.6.39.1/include/sound/pcm.h linux-2.6.39.1/include/sound/pcm.h
66039--- linux-2.6.39.1/include/sound/pcm.h 2011-05-19 00:06:34.000000000 -0400
66040+++ linux-2.6.39.1/include/sound/pcm.h 2011-05-22 19:36:33.000000000 -0400
66041@@ -379,7 +379,7 @@ struct snd_pcm_substream {
66042 unsigned int dma_buf_id;
66043 size_t dma_max;
66044 /* -- hardware operations -- */
66045- struct snd_pcm_ops *ops;
66046+ const struct snd_pcm_ops *ops;
66047 /* -- runtime information -- */
66048 struct snd_pcm_runtime *runtime;
66049 /* -- timer section -- */
66050@@ -845,7 +845,7 @@ const unsigned char *snd_pcm_format_sile
66051 int snd_pcm_format_set_silence(snd_pcm_format_t format, void *buf, unsigned int frames);
66052 snd_pcm_format_t snd_pcm_build_linear_format(int width, int unsignd, int big_endian);
66053
66054-void snd_pcm_set_ops(struct snd_pcm * pcm, int direction, struct snd_pcm_ops *ops);
66055+void snd_pcm_set_ops(struct snd_pcm * pcm, int direction, const struct snd_pcm_ops *ops);
66056 void snd_pcm_set_sync(struct snd_pcm_substream *substream);
66057 int snd_pcm_lib_interleave_len(struct snd_pcm_substream *substream);
66058 int snd_pcm_lib_ioctl(struct snd_pcm_substream *substream,
66059diff -urNp linux-2.6.39.1/include/sound/rawmidi.h linux-2.6.39.1/include/sound/rawmidi.h
66060--- linux-2.6.39.1/include/sound/rawmidi.h 2011-05-19 00:06:34.000000000 -0400
66061+++ linux-2.6.39.1/include/sound/rawmidi.h 2011-05-22 19:36:33.000000000 -0400
66062@@ -100,7 +100,7 @@ struct snd_rawmidi_substream {
66063 struct snd_rawmidi_runtime *runtime;
66064 struct pid *pid;
66065 /* hardware layer */
66066- struct snd_rawmidi_ops *ops;
66067+ const struct snd_rawmidi_ops *ops;
66068 };
66069
66070 struct snd_rawmidi_file {
66071@@ -127,7 +127,7 @@ struct snd_rawmidi {
66072 int ossreg;
66073 #endif
66074
66075- struct snd_rawmidi_global_ops *ops;
66076+ const struct snd_rawmidi_global_ops *ops;
66077
66078 struct snd_rawmidi_str streams[2];
66079
66080@@ -151,7 +151,7 @@ int snd_rawmidi_new(struct snd_card *car
66081 int output_count, int input_count,
66082 struct snd_rawmidi **rmidi);
66083 void snd_rawmidi_set_ops(struct snd_rawmidi *rmidi, int stream,
66084- struct snd_rawmidi_ops *ops);
66085+ const struct snd_rawmidi_ops *ops);
66086
66087 /* callbacks */
66088
66089diff -urNp linux-2.6.39.1/include/sound/seq_device.h linux-2.6.39.1/include/sound/seq_device.h
66090--- linux-2.6.39.1/include/sound/seq_device.h 2011-05-19 00:06:34.000000000 -0400
66091+++ linux-2.6.39.1/include/sound/seq_device.h 2011-05-22 19:36:33.000000000 -0400
66092@@ -69,7 +69,7 @@ struct snd_seq_dev_ops {
66093 */
66094 void snd_seq_device_load_drivers(void);
66095 int snd_seq_device_new(struct snd_card *card, int device, char *id, int argsize, struct snd_seq_device **result);
66096-int snd_seq_device_register_driver(char *id, struct snd_seq_dev_ops *entry, int argsize);
66097+int snd_seq_device_register_driver(char *id, const struct snd_seq_dev_ops *entry, int argsize);
66098 int snd_seq_device_unregister_driver(char *id);
66099
66100 #define SNDRV_SEQ_DEVICE_ARGPTR(dev) (void *)((char *)(dev) + sizeof(struct snd_seq_device))
66101diff -urNp linux-2.6.39.1/include/sound/snd_wavefront.h linux-2.6.39.1/include/sound/snd_wavefront.h
66102--- linux-2.6.39.1/include/sound/snd_wavefront.h 2011-05-19 00:06:34.000000000 -0400
66103+++ linux-2.6.39.1/include/sound/snd_wavefront.h 2011-05-22 19:36:33.000000000 -0400
66104@@ -37,8 +37,8 @@ struct _snd_wavefront_midi {
66105 #define MPU_ACK 0xFE
66106 #define UART_MODE_ON 0x3F
66107
66108-extern struct snd_rawmidi_ops snd_wavefront_midi_output;
66109-extern struct snd_rawmidi_ops snd_wavefront_midi_input;
66110+extern const struct snd_rawmidi_ops snd_wavefront_midi_output;
66111+extern const struct snd_rawmidi_ops snd_wavefront_midi_input;
66112
66113 extern void snd_wavefront_midi_enable_virtual (snd_wavefront_card_t *);
66114 extern void snd_wavefront_midi_disable_virtual (snd_wavefront_card_t *);
66115diff -urNp linux-2.6.39.1/include/sound/soc.h linux-2.6.39.1/include/sound/soc.h
66116--- linux-2.6.39.1/include/sound/soc.h 2011-05-19 00:06:34.000000000 -0400
66117+++ linux-2.6.39.1/include/sound/soc.h 2011-05-22 19:36:33.000000000 -0400
66118@@ -245,7 +245,7 @@ struct snd_soc_jack_gpio;
66119
66120 typedef int (*hw_write_t)(void *,const char* ,int);
66121
66122-extern struct snd_ac97_bus_ops soc_ac97_ops;
66123+extern const struct snd_ac97_bus_ops soc_ac97_ops;
66124
66125 enum snd_soc_control_type {
66126 SND_SOC_CUSTOM,
66127diff -urNp linux-2.6.39.1/include/sound/ymfpci.h linux-2.6.39.1/include/sound/ymfpci.h
66128--- linux-2.6.39.1/include/sound/ymfpci.h 2011-05-19 00:06:34.000000000 -0400
66129+++ linux-2.6.39.1/include/sound/ymfpci.h 2011-05-22 19:36:33.000000000 -0400
66130@@ -358,7 +358,7 @@ struct snd_ymfpci {
66131 spinlock_t reg_lock;
66132 spinlock_t voice_lock;
66133 wait_queue_head_t interrupt_sleep;
66134- atomic_t interrupt_sleep_count;
66135+ atomic_unchecked_t interrupt_sleep_count;
66136 struct snd_info_entry *proc_entry;
66137 const struct firmware *dsp_microcode;
66138 const struct firmware *controller_microcode;
66139diff -urNp linux-2.6.39.1/include/target/target_core_base.h linux-2.6.39.1/include/target/target_core_base.h
66140--- linux-2.6.39.1/include/target/target_core_base.h 2011-06-03 00:04:14.000000000 -0400
66141+++ linux-2.6.39.1/include/target/target_core_base.h 2011-06-03 00:32:08.000000000 -0400
66142@@ -432,8 +432,8 @@ struct se_transport_task {
66143 atomic_t t_task_cdbs_left;
66144 atomic_t t_task_cdbs_ex_left;
66145 atomic_t t_task_cdbs_timeout_left;
66146- atomic_t t_task_cdbs_sent;
66147- atomic_t t_transport_aborted;
66148+ atomic_unchecked_t t_task_cdbs_sent;
66149+ atomic_unchecked_t t_transport_aborted;
66150 atomic_t t_transport_active;
66151 atomic_t t_transport_complete;
66152 atomic_t t_transport_queue_active;
66153@@ -774,7 +774,7 @@ struct se_device {
66154 atomic_t active_cmds;
66155 atomic_t simple_cmds;
66156 atomic_t depth_left;
66157- atomic_t dev_ordered_id;
66158+ atomic_unchecked_t dev_ordered_id;
66159 atomic_t dev_tur_active;
66160 atomic_t execute_tasks;
66161 atomic_t dev_status_thr_count;
66162diff -urNp linux-2.6.39.1/include/trace/events/irq.h linux-2.6.39.1/include/trace/events/irq.h
66163--- linux-2.6.39.1/include/trace/events/irq.h 2011-05-19 00:06:34.000000000 -0400
66164+++ linux-2.6.39.1/include/trace/events/irq.h 2011-05-22 19:36:33.000000000 -0400
66165@@ -36,7 +36,7 @@ struct softirq_action;
66166 */
66167 TRACE_EVENT(irq_handler_entry,
66168
66169- TP_PROTO(int irq, struct irqaction *action),
66170+ TP_PROTO(int irq, const struct irqaction *action),
66171
66172 TP_ARGS(irq, action),
66173
66174@@ -66,7 +66,7 @@ TRACE_EVENT(irq_handler_entry,
66175 */
66176 TRACE_EVENT(irq_handler_exit,
66177
66178- TP_PROTO(int irq, struct irqaction *action, int ret),
66179+ TP_PROTO(int irq, const struct irqaction *action, int ret),
66180
66181 TP_ARGS(irq, action, ret),
66182
66183diff -urNp linux-2.6.39.1/include/video/udlfb.h linux-2.6.39.1/include/video/udlfb.h
66184--- linux-2.6.39.1/include/video/udlfb.h 2011-05-19 00:06:34.000000000 -0400
66185+++ linux-2.6.39.1/include/video/udlfb.h 2011-05-22 19:36:33.000000000 -0400
66186@@ -51,10 +51,10 @@ struct dlfb_data {
66187 int base8;
66188 u32 pseudo_palette[256];
66189 /* blit-only rendering path metrics, exposed through sysfs */
66190- atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
66191- atomic_t bytes_identical; /* saved effort with backbuffer comparison */
66192- atomic_t bytes_sent; /* to usb, after compression including overhead */
66193- atomic_t cpu_kcycles_used; /* transpired during pixel processing */
66194+ atomic_unchecked_t bytes_rendered; /* raw pixel-bytes driver asked to render */
66195+ atomic_unchecked_t bytes_identical; /* saved effort with backbuffer comparison */
66196+ atomic_unchecked_t bytes_sent; /* to usb, after compression including overhead */
66197+ atomic_unchecked_t cpu_kcycles_used; /* transpired during pixel processing */
66198 };
66199
66200 #define NR_USB_REQUEST_I2C_SUB_IO 0x02
66201diff -urNp linux-2.6.39.1/include/video/uvesafb.h linux-2.6.39.1/include/video/uvesafb.h
66202--- linux-2.6.39.1/include/video/uvesafb.h 2011-05-19 00:06:34.000000000 -0400
66203+++ linux-2.6.39.1/include/video/uvesafb.h 2011-05-22 19:36:33.000000000 -0400
66204@@ -177,6 +177,7 @@ struct uvesafb_par {
66205 u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
66206 u8 pmi_setpal; /* PMI for palette changes */
66207 u16 *pmi_base; /* protected mode interface location */
66208+ u8 *pmi_code; /* protected mode code location */
66209 void *pmi_start;
66210 void *pmi_pal;
66211 u8 *vbe_state_orig; /*
66212diff -urNp linux-2.6.39.1/init/do_mounts.c linux-2.6.39.1/init/do_mounts.c
66213--- linux-2.6.39.1/init/do_mounts.c 2011-05-19 00:06:34.000000000 -0400
66214+++ linux-2.6.39.1/init/do_mounts.c 2011-05-22 19:36:33.000000000 -0400
66215@@ -287,7 +287,7 @@ static void __init get_fs_names(char *pa
66216
66217 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
66218 {
66219- int err = sys_mount(name, "/root", fs, flags, data);
66220+ int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
66221 if (err)
66222 return err;
66223
66224@@ -383,18 +383,18 @@ void __init change_floppy(char *fmt, ...
66225 va_start(args, fmt);
66226 vsprintf(buf, fmt, args);
66227 va_end(args);
66228- fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
66229+ fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
66230 if (fd >= 0) {
66231 sys_ioctl(fd, FDEJECT, 0);
66232 sys_close(fd);
66233 }
66234 printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
66235- fd = sys_open("/dev/console", O_RDWR, 0);
66236+ fd = sys_open((__force const char __user *)"/dev/console", O_RDWR, 0);
66237 if (fd >= 0) {
66238 sys_ioctl(fd, TCGETS, (long)&termios);
66239 termios.c_lflag &= ~ICANON;
66240 sys_ioctl(fd, TCSETSF, (long)&termios);
66241- sys_read(fd, &c, 1);
66242+ sys_read(fd, (char __user *)&c, 1);
66243 termios.c_lflag |= ICANON;
66244 sys_ioctl(fd, TCSETSF, (long)&termios);
66245 sys_close(fd);
66246@@ -488,6 +488,6 @@ void __init prepare_namespace(void)
66247 mount_root();
66248 out:
66249 devtmpfs_mount("dev");
66250- sys_mount(".", "/", NULL, MS_MOVE, NULL);
66251+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
66252 sys_chroot((const char __user __force *)".");
66253 }
66254diff -urNp linux-2.6.39.1/init/do_mounts.h linux-2.6.39.1/init/do_mounts.h
66255--- linux-2.6.39.1/init/do_mounts.h 2011-05-19 00:06:34.000000000 -0400
66256+++ linux-2.6.39.1/init/do_mounts.h 2011-05-22 19:36:33.000000000 -0400
66257@@ -15,15 +15,15 @@ extern int root_mountflags;
66258
66259 static inline int create_dev(char *name, dev_t dev)
66260 {
66261- sys_unlink(name);
66262- return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
66263+ sys_unlink((__force char __user *)name);
66264+ return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev));
66265 }
66266
66267 #if BITS_PER_LONG == 32
66268 static inline u32 bstat(char *name)
66269 {
66270 struct stat64 stat;
66271- if (sys_stat64(name, &stat) != 0)
66272+ if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0)
66273 return 0;
66274 if (!S_ISBLK(stat.st_mode))
66275 return 0;
66276diff -urNp linux-2.6.39.1/init/do_mounts_initrd.c linux-2.6.39.1/init/do_mounts_initrd.c
66277--- linux-2.6.39.1/init/do_mounts_initrd.c 2011-05-19 00:06:34.000000000 -0400
66278+++ linux-2.6.39.1/init/do_mounts_initrd.c 2011-05-22 19:36:33.000000000 -0400
66279@@ -44,13 +44,13 @@ static void __init handle_initrd(void)
66280 create_dev("/dev/root.old", Root_RAM0);
66281 /* mount initrd on rootfs' /root */
66282 mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
66283- sys_mkdir("/old", 0700);
66284- root_fd = sys_open("/", 0, 0);
66285- old_fd = sys_open("/old", 0, 0);
66286+ sys_mkdir((__force const char __user *)"/old", 0700);
66287+ root_fd = sys_open((__force const char __user *)"/", 0, 0);
66288+ old_fd = sys_open((__force const char __user *)"/old", 0, 0);
66289 /* move initrd over / and chdir/chroot in initrd root */
66290- sys_chdir("/root");
66291- sys_mount(".", "/", NULL, MS_MOVE, NULL);
66292- sys_chroot(".");
66293+ sys_chdir((__force const char __user *)"/root");
66294+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
66295+ sys_chroot((__force const char __user *)".");
66296
66297 /*
66298 * In case that a resume from disk is carried out by linuxrc or one of
66299@@ -67,15 +67,15 @@ static void __init handle_initrd(void)
66300
66301 /* move initrd to rootfs' /old */
66302 sys_fchdir(old_fd);
66303- sys_mount("/", ".", NULL, MS_MOVE, NULL);
66304+ sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL);
66305 /* switch root and cwd back to / of rootfs */
66306 sys_fchdir(root_fd);
66307- sys_chroot(".");
66308+ sys_chroot((__force const char __user *)".");
66309 sys_close(old_fd);
66310 sys_close(root_fd);
66311
66312 if (new_decode_dev(real_root_dev) == Root_RAM0) {
66313- sys_chdir("/old");
66314+ sys_chdir((__force const char __user *)"/old");
66315 return;
66316 }
66317
66318@@ -83,17 +83,17 @@ static void __init handle_initrd(void)
66319 mount_root();
66320
66321 printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
66322- error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
66323+ error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL);
66324 if (!error)
66325 printk("okay\n");
66326 else {
66327- int fd = sys_open("/dev/root.old", O_RDWR, 0);
66328+ int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0);
66329 if (error == -ENOENT)
66330 printk("/initrd does not exist. Ignored.\n");
66331 else
66332 printk("failed\n");
66333 printk(KERN_NOTICE "Unmounting old root\n");
66334- sys_umount("/old", MNT_DETACH);
66335+ sys_umount((__force char __user *)"/old", MNT_DETACH);
66336 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
66337 if (fd < 0) {
66338 error = fd;
66339@@ -116,11 +116,11 @@ int __init initrd_load(void)
66340 * mounted in the normal path.
66341 */
66342 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
66343- sys_unlink("/initrd.image");
66344+ sys_unlink((__force const char __user *)"/initrd.image");
66345 handle_initrd();
66346 return 1;
66347 }
66348 }
66349- sys_unlink("/initrd.image");
66350+ sys_unlink((__force const char __user *)"/initrd.image");
66351 return 0;
66352 }
66353diff -urNp linux-2.6.39.1/init/do_mounts_md.c linux-2.6.39.1/init/do_mounts_md.c
66354--- linux-2.6.39.1/init/do_mounts_md.c 2011-05-19 00:06:34.000000000 -0400
66355+++ linux-2.6.39.1/init/do_mounts_md.c 2011-05-22 19:36:33.000000000 -0400
66356@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
66357 partitioned ? "_d" : "", minor,
66358 md_setup_args[ent].device_names);
66359
66360- fd = sys_open(name, 0, 0);
66361+ fd = sys_open((__force char __user *)name, 0, 0);
66362 if (fd < 0) {
66363 printk(KERN_ERR "md: open failed - cannot start "
66364 "array %s\n", name);
66365@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
66366 * array without it
66367 */
66368 sys_close(fd);
66369- fd = sys_open(name, 0, 0);
66370+ fd = sys_open((__force char __user *)name, 0, 0);
66371 sys_ioctl(fd, BLKRRPART, 0);
66372 }
66373 sys_close(fd);
66374diff -urNp linux-2.6.39.1/init/initramfs.c linux-2.6.39.1/init/initramfs.c
66375--- linux-2.6.39.1/init/initramfs.c 2011-05-19 00:06:34.000000000 -0400
66376+++ linux-2.6.39.1/init/initramfs.c 2011-05-22 19:36:33.000000000 -0400
66377@@ -74,7 +74,7 @@ static void __init free_hash(void)
66378 }
66379 }
66380
66381-static long __init do_utime(char __user *filename, time_t mtime)
66382+static long __init do_utime(__force char __user *filename, time_t mtime)
66383 {
66384 struct timespec t[2];
66385
66386@@ -109,7 +109,7 @@ static void __init dir_utime(void)
66387 struct dir_entry *de, *tmp;
66388 list_for_each_entry_safe(de, tmp, &dir_list, list) {
66389 list_del(&de->list);
66390- do_utime(de->name, de->mtime);
66391+ do_utime((__force char __user *)de->name, de->mtime);
66392 kfree(de->name);
66393 kfree(de);
66394 }
66395@@ -271,7 +271,7 @@ static int __init maybe_link(void)
66396 if (nlink >= 2) {
66397 char *old = find_link(major, minor, ino, mode, collected);
66398 if (old)
66399- return (sys_link(old, collected) < 0) ? -1 : 1;
66400+ return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1;
66401 }
66402 return 0;
66403 }
66404@@ -280,11 +280,11 @@ static void __init clean_path(char *path
66405 {
66406 struct stat st;
66407
66408- if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
66409+ if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) {
66410 if (S_ISDIR(st.st_mode))
66411- sys_rmdir(path);
66412+ sys_rmdir((__force char __user *)path);
66413 else
66414- sys_unlink(path);
66415+ sys_unlink((__force char __user *)path);
66416 }
66417 }
66418
66419@@ -305,7 +305,7 @@ static int __init do_name(void)
66420 int openflags = O_WRONLY|O_CREAT;
66421 if (ml != 1)
66422 openflags |= O_TRUNC;
66423- wfd = sys_open(collected, openflags, mode);
66424+ wfd = sys_open((__force char __user *)collected, openflags, mode);
66425
66426 if (wfd >= 0) {
66427 sys_fchown(wfd, uid, gid);
66428@@ -317,17 +317,17 @@ static int __init do_name(void)
66429 }
66430 }
66431 } else if (S_ISDIR(mode)) {
66432- sys_mkdir(collected, mode);
66433- sys_chown(collected, uid, gid);
66434- sys_chmod(collected, mode);
66435+ sys_mkdir((__force char __user *)collected, mode);
66436+ sys_chown((__force char __user *)collected, uid, gid);
66437+ sys_chmod((__force char __user *)collected, mode);
66438 dir_add(collected, mtime);
66439 } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
66440 S_ISFIFO(mode) || S_ISSOCK(mode)) {
66441 if (maybe_link() == 0) {
66442- sys_mknod(collected, mode, rdev);
66443- sys_chown(collected, uid, gid);
66444- sys_chmod(collected, mode);
66445- do_utime(collected, mtime);
66446+ sys_mknod((__force char __user *)collected, mode, rdev);
66447+ sys_chown((__force char __user *)collected, uid, gid);
66448+ sys_chmod((__force char __user *)collected, mode);
66449+ do_utime((__force char __user *)collected, mtime);
66450 }
66451 }
66452 return 0;
66453@@ -336,15 +336,15 @@ static int __init do_name(void)
66454 static int __init do_copy(void)
66455 {
66456 if (count >= body_len) {
66457- sys_write(wfd, victim, body_len);
66458+ sys_write(wfd, (__force char __user *)victim, body_len);
66459 sys_close(wfd);
66460- do_utime(vcollected, mtime);
66461+ do_utime((__force char __user *)vcollected, mtime);
66462 kfree(vcollected);
66463 eat(body_len);
66464 state = SkipIt;
66465 return 0;
66466 } else {
66467- sys_write(wfd, victim, count);
66468+ sys_write(wfd, (__force char __user *)victim, count);
66469 body_len -= count;
66470 eat(count);
66471 return 1;
66472@@ -355,9 +355,9 @@ static int __init do_symlink(void)
66473 {
66474 collected[N_ALIGN(name_len) + body_len] = '\0';
66475 clean_path(collected, 0);
66476- sys_symlink(collected + N_ALIGN(name_len), collected);
66477- sys_lchown(collected, uid, gid);
66478- do_utime(collected, mtime);
66479+ sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected);
66480+ sys_lchown((__force char __user *)collected, uid, gid);
66481+ do_utime((__force char __user *)collected, mtime);
66482 state = SkipIt;
66483 next_state = Reset;
66484 return 0;
66485diff -urNp linux-2.6.39.1/init/Kconfig linux-2.6.39.1/init/Kconfig
66486--- linux-2.6.39.1/init/Kconfig 2011-05-19 00:06:34.000000000 -0400
66487+++ linux-2.6.39.1/init/Kconfig 2011-05-22 19:36:33.000000000 -0400
66488@@ -1202,7 +1202,7 @@ config SLUB_DEBUG
66489
66490 config COMPAT_BRK
66491 bool "Disable heap randomization"
66492- default y
66493+ default n
66494 help
66495 Randomizing heap placement makes heap exploits harder, but it
66496 also breaks ancient binaries (including anything libc5 based).
66497diff -urNp linux-2.6.39.1/init/main.c linux-2.6.39.1/init/main.c
66498--- linux-2.6.39.1/init/main.c 2011-06-03 00:04:14.000000000 -0400
66499+++ linux-2.6.39.1/init/main.c 2011-06-03 00:32:08.000000000 -0400
66500@@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void)
66501 extern void tc_init(void);
66502 #endif
66503
66504+extern void grsecurity_init(void);
66505+
66506 /*
66507 * Debug helper: via this flag we know that we are in 'early bootup code'
66508 * where only the boot processor is running with IRQ disabled. This means
66509@@ -149,6 +151,49 @@ static int __init set_reset_devices(char
66510
66511 __setup("reset_devices", set_reset_devices);
66512
66513+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
66514+extern char pax_enter_kernel_user[];
66515+extern char pax_exit_kernel_user[];
66516+extern pgdval_t clone_pgd_mask;
66517+#endif
66518+
66519+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
66520+static int __init setup_pax_nouderef(char *str)
66521+{
66522+#ifdef CONFIG_X86_32
66523+ unsigned int cpu;
66524+ struct desc_struct *gdt;
66525+
66526+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
66527+ gdt = get_cpu_gdt_table(cpu);
66528+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
66529+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
66530+ gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
66531+ gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
66532+ }
66533+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
66534+#else
66535+ memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
66536+ memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
66537+ clone_pgd_mask = ~(pgdval_t)0UL;
66538+#endif
66539+
66540+ return 0;
66541+}
66542+early_param("pax_nouderef", setup_pax_nouderef);
66543+#endif
66544+
66545+#ifdef CONFIG_PAX_SOFTMODE
66546+unsigned int pax_softmode;
66547+
66548+static int __init setup_pax_softmode(char *str)
66549+{
66550+ get_option(&str, &pax_softmode);
66551+ return 1;
66552+}
66553+__setup("pax_softmode=", setup_pax_softmode);
66554+#endif
66555+
66556 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
66557 const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
66558 static const char *panic_later, *panic_param;
66559@@ -663,6 +708,7 @@ int __init_or_module do_one_initcall(ini
66560 {
66561 int count = preempt_count();
66562 int ret;
66563+ const char *msg1 = "", *msg2 = "";
66564
66565 if (initcall_debug)
66566 ret = do_one_initcall_debug(fn);
66567@@ -675,15 +721,15 @@ int __init_or_module do_one_initcall(ini
66568 sprintf(msgbuf, "error code %d ", ret);
66569
66570 if (preempt_count() != count) {
66571- strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
66572+ msg1 = " preemption imbalance";
66573 preempt_count() = count;
66574 }
66575 if (irqs_disabled()) {
66576- strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
66577+ msg2 = " disabled interrupts";
66578 local_irq_enable();
66579 }
66580- if (msgbuf[0]) {
66581- printk("initcall %pF returned with %s\n", fn, msgbuf);
66582+ if (msgbuf[0] || *msg1 || *msg2) {
66583+ printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
66584 }
66585
66586 return ret;
66587@@ -801,7 +847,7 @@ static int __init kernel_init(void * unu
66588 do_basic_setup();
66589
66590 /* Open the /dev/console on the rootfs, this should never fail */
66591- if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
66592+ if (sys_open((__force const char __user *) "/dev/console", O_RDWR, 0) < 0)
66593 printk(KERN_WARNING "Warning: unable to open an initial console.\n");
66594
66595 (void) sys_dup(0);
66596@@ -814,11 +860,13 @@ static int __init kernel_init(void * unu
66597 if (!ramdisk_execute_command)
66598 ramdisk_execute_command = "/init";
66599
66600- if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
66601+ if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) {
66602 ramdisk_execute_command = NULL;
66603 prepare_namespace();
66604 }
66605
66606+ grsecurity_init();
66607+
66608 /*
66609 * Ok, we have completed the initial bootup, and
66610 * we're essentially up and running. Get rid of the
66611diff -urNp linux-2.6.39.1/ipc/mqueue.c linux-2.6.39.1/ipc/mqueue.c
66612--- linux-2.6.39.1/ipc/mqueue.c 2011-05-19 00:06:34.000000000 -0400
66613+++ linux-2.6.39.1/ipc/mqueue.c 2011-05-22 19:41:42.000000000 -0400
66614@@ -154,6 +154,7 @@ static struct inode *mqueue_get_inode(st
66615 mq_bytes = (mq_msg_tblsz +
66616 (info->attr.mq_maxmsg * info->attr.mq_msgsize));
66617
66618+ gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
66619 spin_lock(&mq_lock);
66620 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
66621 u->mq_bytes + mq_bytes >
66622diff -urNp linux-2.6.39.1/ipc/sem.c linux-2.6.39.1/ipc/sem.c
66623--- linux-2.6.39.1/ipc/sem.c 2011-05-19 00:06:34.000000000 -0400
66624+++ linux-2.6.39.1/ipc/sem.c 2011-05-22 19:36:33.000000000 -0400
66625@@ -854,6 +854,8 @@ static int semctl_main(struct ipc_namesp
66626 int nsems;
66627 struct list_head tasks;
66628
66629+ pax_track_stack();
66630+
66631 sma = sem_lock_check(ns, semid);
66632 if (IS_ERR(sma))
66633 return PTR_ERR(sma);
66634@@ -1301,6 +1303,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid,
66635 struct ipc_namespace *ns;
66636 struct list_head tasks;
66637
66638+ pax_track_stack();
66639+
66640 ns = current->nsproxy->ipc_ns;
66641
66642 if (nsops < 1 || semid < 0)
66643diff -urNp linux-2.6.39.1/ipc/shm.c linux-2.6.39.1/ipc/shm.c
66644--- linux-2.6.39.1/ipc/shm.c 2011-05-19 00:06:34.000000000 -0400
66645+++ linux-2.6.39.1/ipc/shm.c 2011-05-22 19:41:42.000000000 -0400
66646@@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_name
66647 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
66648 #endif
66649
66650+#ifdef CONFIG_GRKERNSEC
66651+extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
66652+ const time_t shm_createtime, const uid_t cuid,
66653+ const int shmid);
66654+extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
66655+ const time_t shm_createtime);
66656+#endif
66657+
66658 void shm_init_ns(struct ipc_namespace *ns)
66659 {
66660 ns->shm_ctlmax = SHMMAX;
66661@@ -401,6 +409,14 @@ static int newseg(struct ipc_namespace *
66662 shp->shm_lprid = 0;
66663 shp->shm_atim = shp->shm_dtim = 0;
66664 shp->shm_ctim = get_seconds();
66665+#ifdef CONFIG_GRKERNSEC
66666+ {
66667+ struct timespec timeval;
66668+ do_posix_clock_monotonic_gettime(&timeval);
66669+
66670+ shp->shm_createtime = timeval.tv_sec;
66671+ }
66672+#endif
66673 shp->shm_segsz = size;
66674 shp->shm_nattch = 0;
66675 shp->shm_file = file;
66676@@ -762,8 +778,6 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int,
66677 case SHM_LOCK:
66678 case SHM_UNLOCK:
66679 {
66680- struct file *uninitialized_var(shm_file);
66681-
66682 lru_add_drain_all(); /* drain pagevecs to lru lists */
66683
66684 shp = shm_lock_check(ns, shmid);
66685@@ -896,9 +910,21 @@ long do_shmat(int shmid, char __user *sh
66686 if (err)
66687 goto out_unlock;
66688
66689+#ifdef CONFIG_GRKERNSEC
66690+ if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
66691+ shp->shm_perm.cuid, shmid) ||
66692+ !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
66693+ err = -EACCES;
66694+ goto out_unlock;
66695+ }
66696+#endif
66697+
66698 path = shp->shm_file->f_path;
66699 path_get(&path);
66700 shp->shm_nattch++;
66701+#ifdef CONFIG_GRKERNSEC
66702+ shp->shm_lapid = current->pid;
66703+#endif
66704 size = i_size_read(path.dentry->d_inode);
66705 shm_unlock(shp);
66706
66707diff -urNp linux-2.6.39.1/kernel/acct.c linux-2.6.39.1/kernel/acct.c
66708--- linux-2.6.39.1/kernel/acct.c 2011-05-19 00:06:34.000000000 -0400
66709+++ linux-2.6.39.1/kernel/acct.c 2011-05-22 19:36:33.000000000 -0400
66710@@ -570,7 +570,7 @@ static void do_acct_process(struct bsd_a
66711 */
66712 flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
66713 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
66714- file->f_op->write(file, (char *)&ac,
66715+ file->f_op->write(file, (__force char __user *)&ac,
66716 sizeof(acct_t), &file->f_pos);
66717 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
66718 set_fs(fs);
66719diff -urNp linux-2.6.39.1/kernel/audit.c linux-2.6.39.1/kernel/audit.c
66720--- linux-2.6.39.1/kernel/audit.c 2011-05-19 00:06:34.000000000 -0400
66721+++ linux-2.6.39.1/kernel/audit.c 2011-05-22 19:36:33.000000000 -0400
66722@@ -112,7 +112,7 @@ u32 audit_sig_sid = 0;
66723 3) suppressed due to audit_rate_limit
66724 4) suppressed due to audit_backlog_limit
66725 */
66726-static atomic_t audit_lost = ATOMIC_INIT(0);
66727+static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
66728
66729 /* The netlink socket. */
66730 static struct sock *audit_sock;
66731@@ -234,7 +234,7 @@ void audit_log_lost(const char *message)
66732 unsigned long now;
66733 int print;
66734
66735- atomic_inc(&audit_lost);
66736+ atomic_inc_unchecked(&audit_lost);
66737
66738 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
66739
66740@@ -253,7 +253,7 @@ void audit_log_lost(const char *message)
66741 printk(KERN_WARNING
66742 "audit: audit_lost=%d audit_rate_limit=%d "
66743 "audit_backlog_limit=%d\n",
66744- atomic_read(&audit_lost),
66745+ atomic_read_unchecked(&audit_lost),
66746 audit_rate_limit,
66747 audit_backlog_limit);
66748 audit_panic(message);
66749@@ -686,7 +686,7 @@ static int audit_receive_msg(struct sk_b
66750 status_set.pid = audit_pid;
66751 status_set.rate_limit = audit_rate_limit;
66752 status_set.backlog_limit = audit_backlog_limit;
66753- status_set.lost = atomic_read(&audit_lost);
66754+ status_set.lost = atomic_read_unchecked(&audit_lost);
66755 status_set.backlog = skb_queue_len(&audit_skb_queue);
66756 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
66757 &status_set, sizeof(status_set));
66758diff -urNp linux-2.6.39.1/kernel/auditsc.c linux-2.6.39.1/kernel/auditsc.c
66759--- linux-2.6.39.1/kernel/auditsc.c 2011-05-19 00:06:34.000000000 -0400
66760+++ linux-2.6.39.1/kernel/auditsc.c 2011-05-22 19:36:33.000000000 -0400
66761@@ -2111,7 +2111,7 @@ int auditsc_get_stamp(struct audit_conte
66762 }
66763
66764 /* global counter which is incremented every time something logs in */
66765-static atomic_t session_id = ATOMIC_INIT(0);
66766+static atomic_unchecked_t session_id = ATOMIC_INIT(0);
66767
66768 /**
66769 * audit_set_loginuid - set a task's audit_context loginuid
66770@@ -2124,7 +2124,7 @@ static atomic_t session_id = ATOMIC_INIT
66771 */
66772 int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
66773 {
66774- unsigned int sessionid = atomic_inc_return(&session_id);
66775+ unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
66776 struct audit_context *context = task->audit_context;
66777
66778 if (context && context->in_syscall) {
66779diff -urNp linux-2.6.39.1/kernel/capability.c linux-2.6.39.1/kernel/capability.c
66780--- linux-2.6.39.1/kernel/capability.c 2011-05-19 00:06:34.000000000 -0400
66781+++ linux-2.6.39.1/kernel/capability.c 2011-05-22 21:02:23.000000000 -0400
66782@@ -206,6 +206,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_
66783 * before modification is attempted and the application
66784 * fails.
66785 */
66786+ if (tocopy > ARRAY_SIZE(kdata))
66787+ return -EFAULT;
66788+
66789 if (copy_to_user(dataptr, kdata, tocopy
66790 * sizeof(struct __user_cap_data_struct))) {
66791 return -EFAULT;
66792@@ -378,7 +381,7 @@ bool ns_capable(struct user_namespace *n
66793 BUG();
66794 }
66795
66796- if (security_capable(ns, current_cred(), cap) == 0) {
66797+ if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable(cap)) {
66798 current->flags |= PF_SUPERPRIV;
66799 return true;
66800 }
66801@@ -386,6 +389,27 @@ bool ns_capable(struct user_namespace *n
66802 }
66803 EXPORT_SYMBOL(ns_capable);
66804
66805+bool ns_capable_nolog(struct user_namespace *ns, int cap)
66806+{
66807+ if (unlikely(!cap_valid(cap))) {
66808+ printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
66809+ BUG();
66810+ }
66811+
66812+ if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable_nolog(cap)) {
66813+ current->flags |= PF_SUPERPRIV;
66814+ return true;
66815+ }
66816+ return false;
66817+}
66818+EXPORT_SYMBOL(ns_capable_nolog);
66819+
66820+bool capable_nolog(int cap)
66821+{
66822+ return ns_capable_nolog(&init_user_ns, cap);
66823+}
66824+EXPORT_SYMBOL(capable_nolog);
66825+
66826 /**
66827 * task_ns_capable - Determine whether current task has a superior
66828 * capability targeted at a specific task's user namespace.
66829@@ -400,6 +424,12 @@ bool task_ns_capable(struct task_struct
66830 }
66831 EXPORT_SYMBOL(task_ns_capable);
66832
66833+bool task_ns_capable_nolog(struct task_struct *t, int cap)
66834+{
66835+ return ns_capable_nolog(task_cred_xxx(t, user)->user_ns, cap);
66836+}
66837+EXPORT_SYMBOL(task_ns_capable_nolog);
66838+
66839 /**
66840 * nsown_capable - Check superior capability to one's own user_ns
66841 * @cap: The capability in question
66842diff -urNp linux-2.6.39.1/kernel/cgroup.c linux-2.6.39.1/kernel/cgroup.c
66843--- linux-2.6.39.1/kernel/cgroup.c 2011-05-19 00:06:34.000000000 -0400
66844+++ linux-2.6.39.1/kernel/cgroup.c 2011-05-22 19:36:33.000000000 -0400
66845@@ -598,6 +598,8 @@ static struct css_set *find_css_set(
66846 struct hlist_head *hhead;
66847 struct cg_cgroup_link *link;
66848
66849+ pax_track_stack();
66850+
66851 /* First see if we already have a cgroup group that matches
66852 * the desired set */
66853 read_lock(&css_set_lock);
66854diff -urNp linux-2.6.39.1/kernel/compat.c linux-2.6.39.1/kernel/compat.c
66855--- linux-2.6.39.1/kernel/compat.c 2011-05-19 00:06:34.000000000 -0400
66856+++ linux-2.6.39.1/kernel/compat.c 2011-05-22 19:41:42.000000000 -0400
66857@@ -13,6 +13,7 @@
66858
66859 #include <linux/linkage.h>
66860 #include <linux/compat.h>
66861+#include <linux/module.h>
66862 #include <linux/errno.h>
66863 #include <linux/time.h>
66864 #include <linux/signal.h>
66865diff -urNp linux-2.6.39.1/kernel/configs.c linux-2.6.39.1/kernel/configs.c
66866--- linux-2.6.39.1/kernel/configs.c 2011-05-19 00:06:34.000000000 -0400
66867+++ linux-2.6.39.1/kernel/configs.c 2011-05-22 19:41:42.000000000 -0400
66868@@ -74,8 +74,19 @@ static int __init ikconfig_init(void)
66869 struct proc_dir_entry *entry;
66870
66871 /* create the current config file */
66872+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
66873+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
66874+ entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
66875+ &ikconfig_file_ops);
66876+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
66877+ entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
66878+ &ikconfig_file_ops);
66879+#endif
66880+#else
66881 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
66882 &ikconfig_file_ops);
66883+#endif
66884+
66885 if (!entry)
66886 return -ENOMEM;
66887
66888diff -urNp linux-2.6.39.1/kernel/cred.c linux-2.6.39.1/kernel/cred.c
66889--- linux-2.6.39.1/kernel/cred.c 2011-05-19 00:06:34.000000000 -0400
66890+++ linux-2.6.39.1/kernel/cred.c 2011-05-22 19:41:42.000000000 -0400
66891@@ -158,6 +158,8 @@ static void put_cred_rcu(struct rcu_head
66892 */
66893 void __put_cred(struct cred *cred)
66894 {
66895+ pax_track_stack();
66896+
66897 kdebug("__put_cred(%p{%d,%d})", cred,
66898 atomic_read(&cred->usage),
66899 read_cred_subscribers(cred));
66900@@ -182,6 +184,8 @@ void exit_creds(struct task_struct *tsk)
66901 {
66902 struct cred *cred;
66903
66904+ pax_track_stack();
66905+
66906 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
66907 atomic_read(&tsk->cred->usage),
66908 read_cred_subscribers(tsk->cred));
66909@@ -220,6 +224,8 @@ const struct cred *get_task_cred(struct
66910 {
66911 const struct cred *cred;
66912
66913+ pax_track_stack();
66914+
66915 rcu_read_lock();
66916
66917 do {
66918@@ -239,6 +245,8 @@ struct cred *cred_alloc_blank(void)
66919 {
66920 struct cred *new;
66921
66922+ pax_track_stack();
66923+
66924 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
66925 if (!new)
66926 return NULL;
66927@@ -287,6 +295,8 @@ struct cred *prepare_creds(void)
66928 const struct cred *old;
66929 struct cred *new;
66930
66931+ pax_track_stack();
66932+
66933 validate_process_creds();
66934
66935 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
66936@@ -333,6 +343,8 @@ struct cred *prepare_exec_creds(void)
66937 struct thread_group_cred *tgcred = NULL;
66938 struct cred *new;
66939
66940+ pax_track_stack();
66941+
66942 #ifdef CONFIG_KEYS
66943 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
66944 if (!tgcred)
66945@@ -385,6 +397,8 @@ int copy_creds(struct task_struct *p, un
66946 struct cred *new;
66947 int ret;
66948
66949+ pax_track_stack();
66950+
66951 if (
66952 #ifdef CONFIG_KEYS
66953 !p->cred->thread_keyring &&
66954@@ -475,6 +489,8 @@ int commit_creds(struct cred *new)
66955 struct task_struct *task = current;
66956 const struct cred *old = task->real_cred;
66957
66958+ pax_track_stack();
66959+
66960 kdebug("commit_creds(%p{%d,%d})", new,
66961 atomic_read(&new->usage),
66962 read_cred_subscribers(new));
66963@@ -489,6 +505,8 @@ int commit_creds(struct cred *new)
66964
66965 get_cred(new); /* we will require a ref for the subj creds too */
66966
66967+ gr_set_role_label(task, new->uid, new->gid);
66968+
66969 /* dumpability changes */
66970 if (old->euid != new->euid ||
66971 old->egid != new->egid ||
66972@@ -551,6 +569,8 @@ EXPORT_SYMBOL(commit_creds);
66973 */
66974 void abort_creds(struct cred *new)
66975 {
66976+ pax_track_stack();
66977+
66978 kdebug("abort_creds(%p{%d,%d})", new,
66979 atomic_read(&new->usage),
66980 read_cred_subscribers(new));
66981@@ -574,6 +594,8 @@ const struct cred *override_creds(const
66982 {
66983 const struct cred *old = current->cred;
66984
66985+ pax_track_stack();
66986+
66987 kdebug("override_creds(%p{%d,%d})", new,
66988 atomic_read(&new->usage),
66989 read_cred_subscribers(new));
66990@@ -603,6 +625,8 @@ void revert_creds(const struct cred *old
66991 {
66992 const struct cred *override = current->cred;
66993
66994+ pax_track_stack();
66995+
66996 kdebug("revert_creds(%p{%d,%d})", old,
66997 atomic_read(&old->usage),
66998 read_cred_subscribers(old));
66999@@ -649,6 +673,8 @@ struct cred *prepare_kernel_cred(struct
67000 const struct cred *old;
67001 struct cred *new;
67002
67003+ pax_track_stack();
67004+
67005 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
67006 if (!new)
67007 return NULL;
67008@@ -703,6 +729,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
67009 */
67010 int set_security_override(struct cred *new, u32 secid)
67011 {
67012+ pax_track_stack();
67013+
67014 return security_kernel_act_as(new, secid);
67015 }
67016 EXPORT_SYMBOL(set_security_override);
67017@@ -722,6 +750,8 @@ int set_security_override_from_ctx(struc
67018 u32 secid;
67019 int ret;
67020
67021+ pax_track_stack();
67022+
67023 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
67024 if (ret < 0)
67025 return ret;
67026diff -urNp linux-2.6.39.1/kernel/debug/debug_core.c linux-2.6.39.1/kernel/debug/debug_core.c
67027--- linux-2.6.39.1/kernel/debug/debug_core.c 2011-05-19 00:06:34.000000000 -0400
67028+++ linux-2.6.39.1/kernel/debug/debug_core.c 2011-05-22 19:36:33.000000000 -0400
67029@@ -72,7 +72,7 @@ int kgdb_io_module_registered;
67030 /* Guard for recursive entry */
67031 static int exception_level;
67032
67033-struct kgdb_io *dbg_io_ops;
67034+const struct kgdb_io *dbg_io_ops;
67035 static DEFINE_SPINLOCK(kgdb_registration_lock);
67036
67037 /* kgdb console driver is loaded */
67038@@ -119,7 +119,7 @@ static DEFINE_RAW_SPINLOCK(dbg_slave_loc
67039 */
67040 static atomic_t masters_in_kgdb;
67041 static atomic_t slaves_in_kgdb;
67042-static atomic_t kgdb_break_tasklet_var;
67043+static atomic_unchecked_t kgdb_break_tasklet_var;
67044 atomic_t kgdb_setting_breakpoint;
67045
67046 struct task_struct *kgdb_usethread;
67047@@ -129,7 +129,7 @@ int kgdb_single_step;
67048 static pid_t kgdb_sstep_pid;
67049
67050 /* to keep track of the CPU which is doing the single stepping*/
67051-atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
67052+atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
67053
67054 /*
67055 * If you are debugging a problem where roundup (the collection of
67056@@ -542,7 +542,7 @@ return_normal:
67057 * kernel will only try for the value of sstep_tries before
67058 * giving up and continuing on.
67059 */
67060- if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
67061+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
67062 (kgdb_info[cpu].task &&
67063 kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
67064 atomic_set(&kgdb_active, -1);
67065@@ -636,8 +636,8 @@ cpu_master_loop:
67066 }
67067
67068 kgdb_restore:
67069- if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
67070- int sstep_cpu = atomic_read(&kgdb_cpu_doing_single_step);
67071+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
67072+ int sstep_cpu = atomic_read_unchecked(&kgdb_cpu_doing_single_step);
67073 if (kgdb_info[sstep_cpu].task)
67074 kgdb_sstep_pid = kgdb_info[sstep_cpu].task->pid;
67075 else
67076@@ -834,18 +834,18 @@ static void kgdb_unregister_callbacks(vo
67077 static void kgdb_tasklet_bpt(unsigned long ing)
67078 {
67079 kgdb_breakpoint();
67080- atomic_set(&kgdb_break_tasklet_var, 0);
67081+ atomic_set_unchecked(&kgdb_break_tasklet_var, 0);
67082 }
67083
67084 static DECLARE_TASKLET(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt, 0);
67085
67086 void kgdb_schedule_breakpoint(void)
67087 {
67088- if (atomic_read(&kgdb_break_tasklet_var) ||
67089+ if (atomic_read_unchecked(&kgdb_break_tasklet_var) ||
67090 atomic_read(&kgdb_active) != -1 ||
67091 atomic_read(&kgdb_setting_breakpoint))
67092 return;
67093- atomic_inc(&kgdb_break_tasklet_var);
67094+ atomic_inc_unchecked(&kgdb_break_tasklet_var);
67095 tasklet_schedule(&kgdb_tasklet_breakpoint);
67096 }
67097 EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint);
67098@@ -864,7 +864,7 @@ static void kgdb_initial_breakpoint(void
67099 *
67100 * Register it with the KGDB core.
67101 */
67102-int kgdb_register_io_module(struct kgdb_io *new_dbg_io_ops)
67103+int kgdb_register_io_module(const struct kgdb_io *new_dbg_io_ops)
67104 {
67105 int err;
67106
67107@@ -909,7 +909,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_modul
67108 *
67109 * Unregister it with the KGDB core.
67110 */
67111-void kgdb_unregister_io_module(struct kgdb_io *old_dbg_io_ops)
67112+void kgdb_unregister_io_module(const struct kgdb_io *old_dbg_io_ops)
67113 {
67114 BUG_ON(kgdb_connected);
67115
67116diff -urNp linux-2.6.39.1/kernel/debug/kdb/kdb_main.c linux-2.6.39.1/kernel/debug/kdb/kdb_main.c
67117--- linux-2.6.39.1/kernel/debug/kdb/kdb_main.c 2011-05-19 00:06:34.000000000 -0400
67118+++ linux-2.6.39.1/kernel/debug/kdb/kdb_main.c 2011-05-22 19:36:33.000000000 -0400
67119@@ -1980,7 +1980,7 @@ static int kdb_lsmod(int argc, const cha
67120 list_for_each_entry(mod, kdb_modules, list) {
67121
67122 kdb_printf("%-20s%8u 0x%p ", mod->name,
67123- mod->core_size, (void *)mod);
67124+ mod->core_size_rx + mod->core_size_rw, (void *)mod);
67125 #ifdef CONFIG_MODULE_UNLOAD
67126 kdb_printf("%4d ", module_refcount(mod));
67127 #endif
67128@@ -1990,7 +1990,7 @@ static int kdb_lsmod(int argc, const cha
67129 kdb_printf(" (Loading)");
67130 else
67131 kdb_printf(" (Live)");
67132- kdb_printf(" 0x%p", mod->module_core);
67133+ kdb_printf(" 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
67134
67135 #ifdef CONFIG_MODULE_UNLOAD
67136 {
67137diff -urNp linux-2.6.39.1/kernel/exit.c linux-2.6.39.1/kernel/exit.c
67138--- linux-2.6.39.1/kernel/exit.c 2011-05-19 00:06:34.000000000 -0400
67139+++ linux-2.6.39.1/kernel/exit.c 2011-05-22 20:02:30.000000000 -0400
67140@@ -57,6 +57,10 @@
67141 #include <asm/pgtable.h>
67142 #include <asm/mmu_context.h>
67143
67144+#ifdef CONFIG_GRKERNSEC
67145+extern rwlock_t grsec_exec_file_lock;
67146+#endif
67147+
67148 static void exit_mm(struct task_struct * tsk);
67149
67150 static void __unhash_process(struct task_struct *p, bool group_dead)
67151@@ -169,6 +173,8 @@ void release_task(struct task_struct * p
67152 struct task_struct *leader;
67153 int zap_leader;
67154 repeat:
67155+ gr_del_task_from_ip_table(p);
67156+
67157 tracehook_prepare_release_task(p);
67158 /* don't need to get the RCU readlock here - the process is dead and
67159 * can't be modifying its own credentials. But shut RCU-lockdep up */
67160@@ -338,11 +344,22 @@ static void reparent_to_kthreadd(void)
67161 {
67162 write_lock_irq(&tasklist_lock);
67163
67164+#ifdef CONFIG_GRKERNSEC
67165+ write_lock(&grsec_exec_file_lock);
67166+ if (current->exec_file) {
67167+ fput(current->exec_file);
67168+ current->exec_file = NULL;
67169+ }
67170+ write_unlock(&grsec_exec_file_lock);
67171+#endif
67172+
67173 ptrace_unlink(current);
67174 /* Reparent to init */
67175 current->real_parent = current->parent = kthreadd_task;
67176 list_move_tail(&current->sibling, &current->real_parent->children);
67177
67178+ gr_set_kernel_label(current);
67179+
67180 /* Set the exit signal to SIGCHLD so we signal init on exit */
67181 current->exit_signal = SIGCHLD;
67182
67183@@ -394,7 +411,7 @@ int allow_signal(int sig)
67184 * know it'll be handled, so that they don't get converted to
67185 * SIGKILL or just silently dropped.
67186 */
67187- current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
67188+ current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
67189 recalc_sigpending();
67190 spin_unlock_irq(&current->sighand->siglock);
67191 return 0;
67192@@ -430,6 +447,17 @@ void daemonize(const char *name, ...)
67193 vsnprintf(current->comm, sizeof(current->comm), name, args);
67194 va_end(args);
67195
67196+#ifdef CONFIG_GRKERNSEC
67197+ write_lock(&grsec_exec_file_lock);
67198+ if (current->exec_file) {
67199+ fput(current->exec_file);
67200+ current->exec_file = NULL;
67201+ }
67202+ write_unlock(&grsec_exec_file_lock);
67203+#endif
67204+
67205+ gr_set_kernel_label(current);
67206+
67207 /*
67208 * If we were started as result of loading a module, close all of the
67209 * user space pages. We don't need them, and if we didn't close them
67210@@ -905,15 +933,8 @@ NORET_TYPE void do_exit(long code)
67211 struct task_struct *tsk = current;
67212 int group_dead;
67213
67214- profile_task_exit(tsk);
67215-
67216- WARN_ON(atomic_read(&tsk->fs_excl));
67217- WARN_ON(blk_needs_flush_plug(tsk));
67218-
67219 if (unlikely(in_interrupt()))
67220 panic("Aiee, killing interrupt handler!");
67221- if (unlikely(!tsk->pid))
67222- panic("Attempted to kill the idle task!");
67223
67224 /*
67225 * If do_exit is called because this processes oopsed, it's possible
67226@@ -924,6 +945,14 @@ NORET_TYPE void do_exit(long code)
67227 */
67228 set_fs(USER_DS);
67229
67230+ profile_task_exit(tsk);
67231+
67232+ WARN_ON(atomic_read(&tsk->fs_excl));
67233+ WARN_ON(blk_needs_flush_plug(tsk));
67234+
67235+ if (unlikely(!tsk->pid))
67236+ panic("Attempted to kill the idle task!");
67237+
67238 tracehook_report_exit(&code);
67239
67240 validate_creds_for_do_exit(tsk);
67241@@ -984,6 +1013,9 @@ NORET_TYPE void do_exit(long code)
67242 tsk->exit_code = code;
67243 taskstats_exit(tsk, group_dead);
67244
67245+ gr_acl_handle_psacct(tsk, code);
67246+ gr_acl_handle_exit();
67247+
67248 exit_mm(tsk);
67249
67250 if (group_dead)
67251diff -urNp linux-2.6.39.1/kernel/fork.c linux-2.6.39.1/kernel/fork.c
67252--- linux-2.6.39.1/kernel/fork.c 2011-05-19 00:06:34.000000000 -0400
67253+++ linux-2.6.39.1/kernel/fork.c 2011-05-22 19:41:42.000000000 -0400
67254@@ -287,7 +287,7 @@ static struct task_struct *dup_task_stru
67255 *stackend = STACK_END_MAGIC; /* for overflow detection */
67256
67257 #ifdef CONFIG_CC_STACKPROTECTOR
67258- tsk->stack_canary = get_random_int();
67259+ tsk->stack_canary = pax_get_random_long();
67260 #endif
67261
67262 /* One for us, one for whoever does the "release_task()" (usually parent) */
67263@@ -309,13 +309,78 @@ out:
67264 }
67265
67266 #ifdef CONFIG_MMU
67267+static struct vm_area_struct *dup_vma(struct mm_struct *mm, struct vm_area_struct *mpnt)
67268+{
67269+ struct vm_area_struct *tmp;
67270+ unsigned long charge;
67271+ struct mempolicy *pol;
67272+ struct file *file;
67273+
67274+ charge = 0;
67275+ if (mpnt->vm_flags & VM_ACCOUNT) {
67276+ unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
67277+ if (security_vm_enough_memory(len))
67278+ goto fail_nomem;
67279+ charge = len;
67280+ }
67281+ tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
67282+ if (!tmp)
67283+ goto fail_nomem;
67284+ *tmp = *mpnt;
67285+ tmp->vm_mm = mm;
67286+ INIT_LIST_HEAD(&tmp->anon_vma_chain);
67287+ pol = mpol_dup(vma_policy(mpnt));
67288+ if (IS_ERR(pol))
67289+ goto fail_nomem_policy;
67290+ vma_set_policy(tmp, pol);
67291+ if (anon_vma_fork(tmp, mpnt))
67292+ goto fail_nomem_anon_vma_fork;
67293+ tmp->vm_flags &= ~VM_LOCKED;
67294+ tmp->vm_next = tmp->vm_prev = NULL;
67295+ tmp->vm_mirror = NULL;
67296+ file = tmp->vm_file;
67297+ if (file) {
67298+ struct inode *inode = file->f_path.dentry->d_inode;
67299+ struct address_space *mapping = file->f_mapping;
67300+
67301+ get_file(file);
67302+ if (tmp->vm_flags & VM_DENYWRITE)
67303+ atomic_dec(&inode->i_writecount);
67304+ spin_lock(&mapping->i_mmap_lock);
67305+ if (tmp->vm_flags & VM_SHARED)
67306+ mapping->i_mmap_writable++;
67307+ tmp->vm_truncate_count = mpnt->vm_truncate_count;
67308+ flush_dcache_mmap_lock(mapping);
67309+ /* insert tmp into the share list, just after mpnt */
67310+ vma_prio_tree_add(tmp, mpnt);
67311+ flush_dcache_mmap_unlock(mapping);
67312+ spin_unlock(&mapping->i_mmap_lock);
67313+ }
67314+
67315+ /*
67316+ * Clear hugetlb-related page reserves for children. This only
67317+ * affects MAP_PRIVATE mappings. Faults generated by the child
67318+ * are not guaranteed to succeed, even if read-only
67319+ */
67320+ if (is_vm_hugetlb_page(tmp))
67321+ reset_vma_resv_huge_pages(tmp);
67322+
67323+ return tmp;
67324+
67325+fail_nomem_anon_vma_fork:
67326+ mpol_put(pol);
67327+fail_nomem_policy:
67328+ kmem_cache_free(vm_area_cachep, tmp);
67329+fail_nomem:
67330+ vm_unacct_memory(charge);
67331+ return NULL;
67332+}
67333+
67334 static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
67335 {
67336 struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
67337 struct rb_node **rb_link, *rb_parent;
67338 int retval;
67339- unsigned long charge;
67340- struct mempolicy *pol;
67341
67342 down_write(&oldmm->mmap_sem);
67343 flush_cache_dup_mm(oldmm);
67344@@ -327,8 +392,8 @@ static int dup_mmap(struct mm_struct *mm
67345 mm->locked_vm = 0;
67346 mm->mmap = NULL;
67347 mm->mmap_cache = NULL;
67348- mm->free_area_cache = oldmm->mmap_base;
67349- mm->cached_hole_size = ~0UL;
67350+ mm->free_area_cache = oldmm->free_area_cache;
67351+ mm->cached_hole_size = oldmm->cached_hole_size;
67352 mm->map_count = 0;
67353 cpumask_clear(mm_cpumask(mm));
67354 mm->mm_rb = RB_ROOT;
67355@@ -344,8 +409,6 @@ static int dup_mmap(struct mm_struct *mm
67356
67357 prev = NULL;
67358 for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
67359- struct file *file;
67360-
67361 if (mpnt->vm_flags & VM_DONTCOPY) {
67362 long pages = vma_pages(mpnt);
67363 mm->total_vm -= pages;
67364@@ -353,56 +416,13 @@ static int dup_mmap(struct mm_struct *mm
67365 -pages);
67366 continue;
67367 }
67368- charge = 0;
67369- if (mpnt->vm_flags & VM_ACCOUNT) {
67370- unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
67371- if (security_vm_enough_memory(len))
67372- goto fail_nomem;
67373- charge = len;
67374- }
67375- tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
67376- if (!tmp)
67377- goto fail_nomem;
67378- *tmp = *mpnt;
67379- INIT_LIST_HEAD(&tmp->anon_vma_chain);
67380- pol = mpol_dup(vma_policy(mpnt));
67381- retval = PTR_ERR(pol);
67382- if (IS_ERR(pol))
67383- goto fail_nomem_policy;
67384- vma_set_policy(tmp, pol);
67385- tmp->vm_mm = mm;
67386- if (anon_vma_fork(tmp, mpnt))
67387- goto fail_nomem_anon_vma_fork;
67388- tmp->vm_flags &= ~VM_LOCKED;
67389- tmp->vm_next = tmp->vm_prev = NULL;
67390- file = tmp->vm_file;
67391- if (file) {
67392- struct inode *inode = file->f_path.dentry->d_inode;
67393- struct address_space *mapping = file->f_mapping;
67394-
67395- get_file(file);
67396- if (tmp->vm_flags & VM_DENYWRITE)
67397- atomic_dec(&inode->i_writecount);
67398- spin_lock(&mapping->i_mmap_lock);
67399- if (tmp->vm_flags & VM_SHARED)
67400- mapping->i_mmap_writable++;
67401- tmp->vm_truncate_count = mpnt->vm_truncate_count;
67402- flush_dcache_mmap_lock(mapping);
67403- /* insert tmp into the share list, just after mpnt */
67404- vma_prio_tree_add(tmp, mpnt);
67405- flush_dcache_mmap_unlock(mapping);
67406- spin_unlock(&mapping->i_mmap_lock);
67407+ tmp = dup_vma(mm, mpnt);
67408+ if (!tmp) {
67409+ retval = -ENOMEM;
67410+ goto out;
67411 }
67412
67413 /*
67414- * Clear hugetlb-related page reserves for children. This only
67415- * affects MAP_PRIVATE mappings. Faults generated by the child
67416- * are not guaranteed to succeed, even if read-only
67417- */
67418- if (is_vm_hugetlb_page(tmp))
67419- reset_vma_resv_huge_pages(tmp);
67420-
67421- /*
67422 * Link in the new vma and copy the page table entries.
67423 */
67424 *pprev = tmp;
67425@@ -423,6 +443,31 @@ static int dup_mmap(struct mm_struct *mm
67426 if (retval)
67427 goto out;
67428 }
67429+
67430+#ifdef CONFIG_PAX_SEGMEXEC
67431+ if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
67432+ struct vm_area_struct *mpnt_m;
67433+
67434+ for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
67435+ BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
67436+
67437+ if (!mpnt->vm_mirror)
67438+ continue;
67439+
67440+ if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
67441+ BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
67442+ mpnt->vm_mirror = mpnt_m;
67443+ } else {
67444+ BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
67445+ mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
67446+ mpnt_m->vm_mirror->vm_mirror = mpnt_m;
67447+ mpnt->vm_mirror->vm_mirror = mpnt;
67448+ }
67449+ }
67450+ BUG_ON(mpnt_m);
67451+ }
67452+#endif
67453+
67454 /* a new mm has just been created */
67455 arch_dup_mmap(oldmm, mm);
67456 retval = 0;
67457@@ -431,14 +476,6 @@ out:
67458 flush_tlb_mm(oldmm);
67459 up_write(&oldmm->mmap_sem);
67460 return retval;
67461-fail_nomem_anon_vma_fork:
67462- mpol_put(pol);
67463-fail_nomem_policy:
67464- kmem_cache_free(vm_area_cachep, tmp);
67465-fail_nomem:
67466- retval = -ENOMEM;
67467- vm_unacct_memory(charge);
67468- goto out;
67469 }
67470
67471 static inline int mm_alloc_pgd(struct mm_struct * mm)
67472@@ -785,13 +822,14 @@ static int copy_fs(unsigned long clone_f
67473 spin_unlock(&fs->lock);
67474 return -EAGAIN;
67475 }
67476- fs->users++;
67477+ atomic_inc(&fs->users);
67478 spin_unlock(&fs->lock);
67479 return 0;
67480 }
67481 tsk->fs = copy_fs_struct(fs);
67482 if (!tsk->fs)
67483 return -ENOMEM;
67484+ gr_set_chroot_entries(tsk, &tsk->fs->root);
67485 return 0;
67486 }
67487
67488@@ -1049,10 +1087,13 @@ static struct task_struct *copy_process(
67489 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
67490 #endif
67491 retval = -EAGAIN;
67492+
67493+ gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
67494+
67495 if (atomic_read(&p->real_cred->user->processes) >=
67496 task_rlimit(p, RLIMIT_NPROC)) {
67497- if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
67498- p->real_cred->user != INIT_USER)
67499+ if (p->real_cred->user != INIT_USER &&
67500+ !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE))
67501 goto bad_fork_free;
67502 }
67503
67504@@ -1200,6 +1241,8 @@ static struct task_struct *copy_process(
67505 goto bad_fork_free_pid;
67506 }
67507
67508+ gr_copy_label(p);
67509+
67510 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
67511 /*
67512 * Clear TID on mm_release()?
67513@@ -1360,6 +1403,8 @@ bad_fork_cleanup_count:
67514 bad_fork_free:
67515 free_task(p);
67516 fork_out:
67517+ gr_log_forkfail(retval);
67518+
67519 return ERR_PTR(retval);
67520 }
67521
67522@@ -1448,6 +1493,8 @@ long do_fork(unsigned long clone_flags,
67523 if (clone_flags & CLONE_PARENT_SETTID)
67524 put_user(nr, parent_tidptr);
67525
67526+ gr_handle_brute_check();
67527+
67528 if (clone_flags & CLONE_VFORK) {
67529 p->vfork_done = &vfork;
67530 init_completion(&vfork);
67531@@ -1549,7 +1596,7 @@ static int unshare_fs(unsigned long unsh
67532 return 0;
67533
67534 /* don't need lock here; in the worst case we'll do useless copy */
67535- if (fs->users == 1)
67536+ if (atomic_read(&fs->users) == 1)
67537 return 0;
67538
67539 *new_fsp = copy_fs_struct(fs);
67540@@ -1636,7 +1683,8 @@ SYSCALL_DEFINE1(unshare, unsigned long,
67541 fs = current->fs;
67542 spin_lock(&fs->lock);
67543 current->fs = new_fs;
67544- if (--fs->users)
67545+ gr_set_chroot_entries(current, &current->fs->root);
67546+ if (atomic_dec_return(&fs->users))
67547 new_fs = NULL;
67548 else
67549 new_fs = fs;
67550diff -urNp linux-2.6.39.1/kernel/futex.c linux-2.6.39.1/kernel/futex.c
67551--- linux-2.6.39.1/kernel/futex.c 2011-05-19 00:06:34.000000000 -0400
67552+++ linux-2.6.39.1/kernel/futex.c 2011-05-22 22:41:57.000000000 -0400
67553@@ -54,6 +54,7 @@
67554 #include <linux/mount.h>
67555 #include <linux/pagemap.h>
67556 #include <linux/syscalls.h>
67557+#include <linux/ptrace.h>
67558 #include <linux/signal.h>
67559 #include <linux/module.h>
67560 #include <linux/magic.h>
67561@@ -236,6 +237,11 @@ get_futex_key(u32 __user *uaddr, int fsh
67562 struct page *page, *page_head;
67563 int err;
67564
67565+#ifdef CONFIG_PAX_SEGMEXEC
67566+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
67567+ return -EFAULT;
67568+#endif
67569+
67570 /*
67571 * The futex address must be "naturally" aligned.
67572 */
67573@@ -1833,6 +1839,8 @@ static int futex_wait(u32 __user *uaddr,
67574 struct futex_q q = futex_q_init;
67575 int ret;
67576
67577+ pax_track_stack();
67578+
67579 if (!bitset)
67580 return -EINVAL;
67581 q.bitset = bitset;
67582@@ -2229,6 +2237,8 @@ static int futex_wait_requeue_pi(u32 __u
67583 struct futex_q q = futex_q_init;
67584 int res, ret;
67585
67586+ pax_track_stack();
67587+
67588 if (!bitset)
67589 return -EINVAL;
67590
67591@@ -2401,7 +2411,9 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
67592 {
67593 struct robust_list_head __user *head;
67594 unsigned long ret;
67595+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
67596 const struct cred *cred = current_cred(), *pcred;
67597+#endif
67598
67599 if (!futex_cmpxchg_enabled)
67600 return -ENOSYS;
67601@@ -2417,6 +2429,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
67602 if (!p)
67603 goto err_unlock;
67604 ret = -EPERM;
67605+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
67606+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
67607+ goto err_unlock;
67608+#else
67609 pcred = __task_cred(p);
67610 /* If victim is in different user_ns, then uids are not
67611 comparable, so we must have CAP_SYS_PTRACE */
67612@@ -2431,6 +2447,7 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
67613 !ns_capable(pcred->user->user_ns, CAP_SYS_PTRACE))
67614 goto err_unlock;
67615 ok:
67616+#endif
67617 head = p->robust_list;
67618 rcu_read_unlock();
67619 }
67620@@ -2682,6 +2699,7 @@ static int __init futex_init(void)
67621 {
67622 u32 curval;
67623 int i;
67624+ mm_segment_t oldfs;
67625
67626 /*
67627 * This will fail and we want it. Some arch implementations do
67628@@ -2693,8 +2711,11 @@ static int __init futex_init(void)
67629 * implementation, the non-functional ones will return
67630 * -ENOSYS.
67631 */
67632+ oldfs = get_fs();
67633+ set_fs(USER_DS);
67634 if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT)
67635 futex_cmpxchg_enabled = 1;
67636+ set_fs(oldfs);
67637
67638 for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
67639 plist_head_init(&futex_queues[i].chain, &futex_queues[i].lock);
67640diff -urNp linux-2.6.39.1/kernel/futex_compat.c linux-2.6.39.1/kernel/futex_compat.c
67641--- linux-2.6.39.1/kernel/futex_compat.c 2011-05-19 00:06:34.000000000 -0400
67642+++ linux-2.6.39.1/kernel/futex_compat.c 2011-05-22 22:42:09.000000000 -0400
67643@@ -10,6 +10,7 @@
67644 #include <linux/compat.h>
67645 #include <linux/nsproxy.h>
67646 #include <linux/futex.h>
67647+#include <linux/ptrace.h>
67648
67649 #include <asm/uaccess.h>
67650
67651@@ -136,7 +137,10 @@ compat_sys_get_robust_list(int pid, comp
67652 {
67653 struct compat_robust_list_head __user *head;
67654 unsigned long ret;
67655- const struct cred *cred = current_cred(), *pcred;
67656+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
67657+ const struct cred *cred = current_cred();
67658+ const struct cred *pcred;
67659+#endif
67660
67661 if (!futex_cmpxchg_enabled)
67662 return -ENOSYS;
67663@@ -152,6 +156,10 @@ compat_sys_get_robust_list(int pid, comp
67664 if (!p)
67665 goto err_unlock;
67666 ret = -EPERM;
67667+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
67668+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
67669+ goto err_unlock;
67670+#else
67671 pcred = __task_cred(p);
67672 /* If victim is in different user_ns, then uids are not
67673 comparable, so we must have CAP_SYS_PTRACE */
67674@@ -166,6 +174,7 @@ compat_sys_get_robust_list(int pid, comp
67675 !ns_capable(pcred->user->user_ns, CAP_SYS_PTRACE))
67676 goto err_unlock;
67677 ok:
67678+#endif
67679 head = p->compat_robust_list;
67680 rcu_read_unlock();
67681 }
67682diff -urNp linux-2.6.39.1/kernel/gcov/base.c linux-2.6.39.1/kernel/gcov/base.c
67683--- linux-2.6.39.1/kernel/gcov/base.c 2011-05-19 00:06:34.000000000 -0400
67684+++ linux-2.6.39.1/kernel/gcov/base.c 2011-05-22 19:36:33.000000000 -0400
67685@@ -102,11 +102,6 @@ void gcov_enable_events(void)
67686 }
67687
67688 #ifdef CONFIG_MODULES
67689-static inline int within(void *addr, void *start, unsigned long size)
67690-{
67691- return ((addr >= start) && (addr < start + size));
67692-}
67693-
67694 /* Update list and generate events when modules are unloaded. */
67695 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
67696 void *data)
67697@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
67698 prev = NULL;
67699 /* Remove entries located in module from linked list. */
67700 for (info = gcov_info_head; info; info = info->next) {
67701- if (within(info, mod->module_core, mod->core_size)) {
67702+ if (within_module_core_rw((unsigned long)info, mod)) {
67703 if (prev)
67704 prev->next = info->next;
67705 else
67706diff -urNp linux-2.6.39.1/kernel/hrtimer.c linux-2.6.39.1/kernel/hrtimer.c
67707--- linux-2.6.39.1/kernel/hrtimer.c 2011-05-19 00:06:34.000000000 -0400
67708+++ linux-2.6.39.1/kernel/hrtimer.c 2011-05-22 19:36:33.000000000 -0400
67709@@ -1383,7 +1383,7 @@ void hrtimer_peek_ahead_timers(void)
67710 local_irq_restore(flags);
67711 }
67712
67713-static void run_hrtimer_softirq(struct softirq_action *h)
67714+static void run_hrtimer_softirq(void)
67715 {
67716 hrtimer_peek_ahead_timers();
67717 }
67718diff -urNp linux-2.6.39.1/kernel/jump_label.c linux-2.6.39.1/kernel/jump_label.c
67719--- linux-2.6.39.1/kernel/jump_label.c 2011-05-19 00:06:34.000000000 -0400
67720+++ linux-2.6.39.1/kernel/jump_label.c 2011-05-22 19:36:33.000000000 -0400
67721@@ -49,6 +49,17 @@ void jump_label_unlock(void)
67722 mutex_unlock(&jump_label_mutex);
67723 }
67724
67725+static void jump_label_swap(void *a, void *b, int size)
67726+{
67727+ struct jump_entry t;
67728+
67729+ t = *(struct jump_entry *)a;
67730+ pax_open_kernel();
67731+ *(struct jump_entry *)a = *(struct jump_entry *)b;
67732+ *(struct jump_entry *)b = t;
67733+ pax_close_kernel();
67734+}
67735+
67736 static int jump_label_cmp(const void *a, const void *b)
67737 {
67738 const struct jump_entry *jea = a;
67739@@ -70,7 +81,7 @@ sort_jump_label_entries(struct jump_entr
67740
67741 size = (((unsigned long)stop - (unsigned long)start)
67742 / sizeof(struct jump_entry));
67743- sort(start, size, sizeof(struct jump_entry), jump_label_cmp, NULL);
67744+ sort(start, size, sizeof(struct jump_entry), jump_label_cmp, jump_label_swap);
67745 }
67746
67747 static struct jump_label_entry *get_jump_label_entry(jump_label_t key)
67748@@ -407,8 +418,11 @@ static void remove_jump_label_module_ini
67749 count = e_module->nr_entries;
67750 iter = e_module->table;
67751 while (count--) {
67752- if (within_module_init(iter->code, mod))
67753+ if (within_module_init(iter->code, mod)) {
67754+ pax_open_kernel();
67755 iter->key = 0;
67756+ pax_close_kernel();
67757+ }
67758 iter++;
67759 }
67760 }
67761diff -urNp linux-2.6.39.1/kernel/kallsyms.c linux-2.6.39.1/kernel/kallsyms.c
67762--- linux-2.6.39.1/kernel/kallsyms.c 2011-05-19 00:06:34.000000000 -0400
67763+++ linux-2.6.39.1/kernel/kallsyms.c 2011-05-22 19:41:42.000000000 -0400
67764@@ -11,6 +11,9 @@
67765 * Changed the compression method from stem compression to "table lookup"
67766 * compression (see scripts/kallsyms.c for a more complete description)
67767 */
67768+#ifdef CONFIG_GRKERNSEC_HIDESYM
67769+#define __INCLUDED_BY_HIDESYM 1
67770+#endif
67771 #include <linux/kallsyms.h>
67772 #include <linux/module.h>
67773 #include <linux/init.h>
67774@@ -53,12 +56,33 @@ extern const unsigned long kallsyms_mark
67775
67776 static inline int is_kernel_inittext(unsigned long addr)
67777 {
67778+ if (system_state != SYSTEM_BOOTING)
67779+ return 0;
67780+
67781 if (addr >= (unsigned long)_sinittext
67782 && addr <= (unsigned long)_einittext)
67783 return 1;
67784 return 0;
67785 }
67786
67787+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67788+#ifdef CONFIG_MODULES
67789+static inline int is_module_text(unsigned long addr)
67790+{
67791+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
67792+ return 1;
67793+
67794+ addr = ktla_ktva(addr);
67795+ return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
67796+}
67797+#else
67798+static inline int is_module_text(unsigned long addr)
67799+{
67800+ return 0;
67801+}
67802+#endif
67803+#endif
67804+
67805 static inline int is_kernel_text(unsigned long addr)
67806 {
67807 if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
67808@@ -69,13 +93,28 @@ static inline int is_kernel_text(unsigne
67809
67810 static inline int is_kernel(unsigned long addr)
67811 {
67812+
67813+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67814+ if (is_kernel_text(addr) || is_kernel_inittext(addr))
67815+ return 1;
67816+
67817+ if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
67818+#else
67819 if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
67820+#endif
67821+
67822 return 1;
67823 return in_gate_area_no_mm(addr);
67824 }
67825
67826 static int is_ksym_addr(unsigned long addr)
67827 {
67828+
67829+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67830+ if (is_module_text(addr))
67831+ return 0;
67832+#endif
67833+
67834 if (all_var)
67835 return is_kernel(addr);
67836
67837@@ -454,7 +493,6 @@ static unsigned long get_ksymbol_core(st
67838
67839 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
67840 {
67841- iter->name[0] = '\0';
67842 iter->nameoff = get_symbol_offset(new_pos);
67843 iter->pos = new_pos;
67844 }
67845@@ -502,6 +540,11 @@ static int s_show(struct seq_file *m, vo
67846 {
67847 struct kallsym_iter *iter = m->private;
67848
67849+#ifdef CONFIG_GRKERNSEC_HIDESYM
67850+ if (current_uid())
67851+ return 0;
67852+#endif
67853+
67854 /* Some debugging symbols have no name. Ignore them. */
67855 if (!iter->name[0])
67856 return 0;
67857@@ -540,7 +583,7 @@ static int kallsyms_open(struct inode *i
67858 struct kallsym_iter *iter;
67859 int ret;
67860
67861- iter = kmalloc(sizeof(*iter), GFP_KERNEL);
67862+ iter = kzalloc(sizeof(*iter), GFP_KERNEL);
67863 if (!iter)
67864 return -ENOMEM;
67865 reset_iter(iter, 0);
67866diff -urNp linux-2.6.39.1/kernel/kmod.c linux-2.6.39.1/kernel/kmod.c
67867--- linux-2.6.39.1/kernel/kmod.c 2011-05-19 00:06:34.000000000 -0400
67868+++ linux-2.6.39.1/kernel/kmod.c 2011-05-22 19:41:42.000000000 -0400
67869@@ -65,13 +65,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sb
67870 * If module auto-loading support is disabled then this function
67871 * becomes a no-operation.
67872 */
67873-int __request_module(bool wait, const char *fmt, ...)
67874+static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
67875 {
67876- va_list args;
67877 char module_name[MODULE_NAME_LEN];
67878 unsigned int max_modprobes;
67879 int ret;
67880- char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
67881+ char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
67882 static char *envp[] = { "HOME=/",
67883 "TERM=linux",
67884 "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
67885@@ -80,9 +79,7 @@ int __request_module(bool wait, const ch
67886 #define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */
67887 static int kmod_loop_msg;
67888
67889- va_start(args, fmt);
67890- ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
67891- va_end(args);
67892+ ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
67893 if (ret >= MODULE_NAME_LEN)
67894 return -ENAMETOOLONG;
67895
67896@@ -90,6 +87,20 @@ int __request_module(bool wait, const ch
67897 if (ret)
67898 return ret;
67899
67900+#ifdef CONFIG_GRKERNSEC_MODHARDEN
67901+ if (!current_uid()) {
67902+ /* hack to workaround consolekit/udisks stupidity */
67903+ read_lock(&tasklist_lock);
67904+ if (!strcmp(current->comm, "mount") &&
67905+ current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
67906+ read_unlock(&tasklist_lock);
67907+ printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
67908+ return -EPERM;
67909+ }
67910+ read_unlock(&tasklist_lock);
67911+ }
67912+#endif
67913+
67914 /* If modprobe needs a service that is in a module, we get a recursive
67915 * loop. Limit the number of running kmod threads to max_threads/2 or
67916 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
67917@@ -123,6 +134,47 @@ int __request_module(bool wait, const ch
67918 atomic_dec(&kmod_concurrent);
67919 return ret;
67920 }
67921+
67922+int ___request_module(bool wait, char *module_param, const char *fmt, ...)
67923+{
67924+ va_list args;
67925+ int ret;
67926+
67927+ va_start(args, fmt);
67928+ ret = ____request_module(wait, module_param, fmt, args);
67929+ va_end(args);
67930+
67931+ return ret;
67932+}
67933+
67934+int __request_module(bool wait, const char *fmt, ...)
67935+{
67936+ va_list args;
67937+ int ret;
67938+
67939+#ifdef CONFIG_GRKERNSEC_MODHARDEN
67940+ if (current_uid()) {
67941+ char module_param[MODULE_NAME_LEN];
67942+
67943+ memset(module_param, 0, sizeof(module_param));
67944+
67945+ snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
67946+
67947+ va_start(args, fmt);
67948+ ret = ____request_module(wait, module_param, fmt, args);
67949+ va_end(args);
67950+
67951+ return ret;
67952+ }
67953+#endif
67954+
67955+ va_start(args, fmt);
67956+ ret = ____request_module(wait, NULL, fmt, args);
67957+ va_end(args);
67958+
67959+ return ret;
67960+}
67961+
67962 EXPORT_SYMBOL(__request_module);
67963 #endif /* CONFIG_MODULES */
67964
67965diff -urNp linux-2.6.39.1/kernel/kprobes.c linux-2.6.39.1/kernel/kprobes.c
67966--- linux-2.6.39.1/kernel/kprobes.c 2011-05-19 00:06:34.000000000 -0400
67967+++ linux-2.6.39.1/kernel/kprobes.c 2011-05-22 19:36:33.000000000 -0400
67968@@ -185,7 +185,7 @@ static kprobe_opcode_t __kprobes *__get_
67969 * kernel image and loaded module images reside. This is required
67970 * so x86_64 can correctly handle the %rip-relative fixups.
67971 */
67972- kip->insns = module_alloc(PAGE_SIZE);
67973+ kip->insns = module_alloc_exec(PAGE_SIZE);
67974 if (!kip->insns) {
67975 kfree(kip);
67976 return NULL;
67977@@ -225,7 +225,7 @@ static int __kprobes collect_one_slot(st
67978 */
67979 if (!list_is_singular(&kip->list)) {
67980 list_del(&kip->list);
67981- module_free(NULL, kip->insns);
67982+ module_free_exec(NULL, kip->insns);
67983 kfree(kip);
67984 }
67985 return 1;
67986@@ -1936,7 +1936,7 @@ static int __init init_kprobes(void)
67987 {
67988 int i, err = 0;
67989 unsigned long offset = 0, size = 0;
67990- char *modname, namebuf[128];
67991+ char *modname, namebuf[KSYM_NAME_LEN];
67992 const char *symbol_name;
67993 void *addr;
67994 struct kprobe_blackpoint *kb;
67995@@ -2062,7 +2062,7 @@ static int __kprobes show_kprobe_addr(st
67996 const char *sym = NULL;
67997 unsigned int i = *(loff_t *) v;
67998 unsigned long offset = 0;
67999- char *modname, namebuf[128];
68000+ char *modname, namebuf[KSYM_NAME_LEN];
68001
68002 head = &kprobe_table[i];
68003 preempt_disable();
68004diff -urNp linux-2.6.39.1/kernel/lockdep.c linux-2.6.39.1/kernel/lockdep.c
68005--- linux-2.6.39.1/kernel/lockdep.c 2011-05-19 00:06:34.000000000 -0400
68006+++ linux-2.6.39.1/kernel/lockdep.c 2011-05-22 19:36:33.000000000 -0400
68007@@ -571,6 +571,10 @@ static int static_obj(void *obj)
68008 end = (unsigned long) &_end,
68009 addr = (unsigned long) obj;
68010
68011+#ifdef CONFIG_PAX_KERNEXEC
68012+ start = ktla_ktva(start);
68013+#endif
68014+
68015 /*
68016 * static variable?
68017 */
68018@@ -706,6 +710,7 @@ register_lock_class(struct lockdep_map *
68019 if (!static_obj(lock->key)) {
68020 debug_locks_off();
68021 printk("INFO: trying to register non-static key.\n");
68022+ printk("lock:%pS key:%pS.\n", lock, lock->key);
68023 printk("the code is fine but needs lockdep annotation.\n");
68024 printk("turning off the locking correctness validator.\n");
68025 dump_stack();
68026@@ -2752,7 +2757,7 @@ static int __lock_acquire(struct lockdep
68027 if (!class)
68028 return 0;
68029 }
68030- atomic_inc((atomic_t *)&class->ops);
68031+ atomic_inc_unchecked((atomic_unchecked_t *)&class->ops);
68032 if (very_verbose(class)) {
68033 printk("\nacquire class [%p] %s", class->key, class->name);
68034 if (class->name_version > 1)
68035diff -urNp linux-2.6.39.1/kernel/lockdep_proc.c linux-2.6.39.1/kernel/lockdep_proc.c
68036--- linux-2.6.39.1/kernel/lockdep_proc.c 2011-05-19 00:06:34.000000000 -0400
68037+++ linux-2.6.39.1/kernel/lockdep_proc.c 2011-05-22 19:36:33.000000000 -0400
68038@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
68039
68040 static void print_name(struct seq_file *m, struct lock_class *class)
68041 {
68042- char str[128];
68043+ char str[KSYM_NAME_LEN];
68044 const char *name = class->name;
68045
68046 if (!name) {
68047diff -urNp linux-2.6.39.1/kernel/module.c linux-2.6.39.1/kernel/module.c
68048--- linux-2.6.39.1/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
68049+++ linux-2.6.39.1/kernel/module.c 2011-05-22 19:41:42.000000000 -0400
68050@@ -57,6 +57,7 @@
68051 #include <linux/kmemleak.h>
68052 #include <linux/jump_label.h>
68053 #include <linux/pfn.h>
68054+#include <linux/grsecurity.h>
68055
68056 #define CREATE_TRACE_POINTS
68057 #include <trace/events/module.h>
68058@@ -118,7 +119,8 @@ static BLOCKING_NOTIFIER_HEAD(module_not
68059
68060 /* Bounds of module allocation, for speeding __module_address.
68061 * Protected by module_mutex. */
68062-static unsigned long module_addr_min = -1UL, module_addr_max = 0;
68063+static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
68064+static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
68065
68066 int register_module_notifier(struct notifier_block * nb)
68067 {
68068@@ -282,7 +284,7 @@ bool each_symbol(bool (*fn)(const struct
68069 return true;
68070
68071 list_for_each_entry_rcu(mod, &modules, list) {
68072- struct symsearch arr[] = {
68073+ struct symsearch modarr[] = {
68074 { mod->syms, mod->syms + mod->num_syms, mod->crcs,
68075 NOT_GPL_ONLY, false },
68076 { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
68077@@ -304,7 +306,7 @@ bool each_symbol(bool (*fn)(const struct
68078 #endif
68079 };
68080
68081- if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
68082+ if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
68083 return true;
68084 }
68085 return false;
68086@@ -415,7 +417,7 @@ static inline void __percpu *mod_percpu(
68087 static int percpu_modalloc(struct module *mod,
68088 unsigned long size, unsigned long align)
68089 {
68090- if (align > PAGE_SIZE) {
68091+ if (align-1 >= PAGE_SIZE) {
68092 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
68093 mod->name, align, PAGE_SIZE);
68094 align = PAGE_SIZE;
68095@@ -1143,7 +1145,7 @@ resolve_symbol_wait(struct module *mod,
68096 */
68097 #ifdef CONFIG_SYSFS
68098
68099-#ifdef CONFIG_KALLSYMS
68100+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
68101 static inline bool sect_empty(const Elf_Shdr *sect)
68102 {
68103 return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0;
68104@@ -1612,17 +1614,17 @@ void unset_section_ro_nx(struct module *
68105 {
68106 unsigned long total_pages;
68107
68108- if (mod->module_core == module_region) {
68109+ if (mod->module_core_rx == module_region) {
68110 /* Set core as NX+RW */
68111- total_pages = MOD_NUMBER_OF_PAGES(mod->module_core, mod->core_size);
68112- set_memory_nx((unsigned long)mod->module_core, total_pages);
68113- set_memory_rw((unsigned long)mod->module_core, total_pages);
68114+ total_pages = MOD_NUMBER_OF_PAGES(mod->module_core_rx, mod->core_size_rx);
68115+ set_memory_nx((unsigned long)mod->module_core_rx, total_pages);
68116+ set_memory_rw((unsigned long)mod->module_core_rx, total_pages);
68117
68118- } else if (mod->module_init == module_region) {
68119+ } else if (mod->module_init_rx == module_region) {
68120 /* Set init as NX+RW */
68121- total_pages = MOD_NUMBER_OF_PAGES(mod->module_init, mod->init_size);
68122- set_memory_nx((unsigned long)mod->module_init, total_pages);
68123- set_memory_rw((unsigned long)mod->module_init, total_pages);
68124+ total_pages = MOD_NUMBER_OF_PAGES(mod->module_init_rx, mod->init_size_rx);
68125+ set_memory_nx((unsigned long)mod->module_init_rx, total_pages);
68126+ set_memory_rw((unsigned long)mod->module_init_rx, total_pages);
68127 }
68128 }
68129
68130@@ -1633,14 +1635,14 @@ void set_all_modules_text_rw()
68131
68132 mutex_lock(&module_mutex);
68133 list_for_each_entry_rcu(mod, &modules, list) {
68134- if ((mod->module_core) && (mod->core_text_size)) {
68135- set_page_attributes(mod->module_core,
68136- mod->module_core + mod->core_text_size,
68137+ if ((mod->module_core_rx) && (mod->core_size_rx)) {
68138+ set_page_attributes(mod->module_core_rx,
68139+ mod->module_core_rx + mod->core_size_rx,
68140 set_memory_rw);
68141 }
68142- if ((mod->module_init) && (mod->init_text_size)) {
68143- set_page_attributes(mod->module_init,
68144- mod->module_init + mod->init_text_size,
68145+ if ((mod->module_init_rx) && (mod->init_size_rx)) {
68146+ set_page_attributes(mod->module_init_rx,
68147+ mod->module_init_rx + mod->init_size_rx,
68148 set_memory_rw);
68149 }
68150 }
68151@@ -1654,14 +1656,14 @@ void set_all_modules_text_ro()
68152
68153 mutex_lock(&module_mutex);
68154 list_for_each_entry_rcu(mod, &modules, list) {
68155- if ((mod->module_core) && (mod->core_text_size)) {
68156- set_page_attributes(mod->module_core,
68157- mod->module_core + mod->core_text_size,
68158+ if ((mod->module_core_rx) && (mod->core_size_rx)) {
68159+ set_page_attributes(mod->module_core_rx,
68160+ mod->module_core_rx + mod->core_size_rx,
68161 set_memory_ro);
68162 }
68163- if ((mod->module_init) && (mod->init_text_size)) {
68164- set_page_attributes(mod->module_init,
68165- mod->module_init + mod->init_text_size,
68166+ if ((mod->module_init_rx) && (mod->init_size_rx)) {
68167+ set_page_attributes(mod->module_init_rx,
68168+ mod->module_init_rx + mod->init_size_rx,
68169 set_memory_ro);
68170 }
68171 }
68172@@ -1696,17 +1698,20 @@ static void free_module(struct module *m
68173 destroy_params(mod->kp, mod->num_kp);
68174
68175 /* This may be NULL, but that's OK */
68176- unset_section_ro_nx(mod, mod->module_init);
68177- module_free(mod, mod->module_init);
68178+ unset_section_ro_nx(mod, mod->module_init_rx);
68179+ module_free(mod, mod->module_init_rw);
68180+ module_free_exec(mod, mod->module_init_rx);
68181 kfree(mod->args);
68182 percpu_modfree(mod);
68183
68184 /* Free lock-classes: */
68185- lockdep_free_key_range(mod->module_core, mod->core_size);
68186+ lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
68187+ lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
68188
68189 /* Finally, free the core (containing the module structure) */
68190- unset_section_ro_nx(mod, mod->module_core);
68191- module_free(mod, mod->module_core);
68192+ unset_section_ro_nx(mod, mod->module_core_rx);
68193+ module_free_exec(mod, mod->module_core_rx);
68194+ module_free(mod, mod->module_core_rw);
68195
68196 #ifdef CONFIG_MPU
68197 update_protections(current->mm);
68198@@ -1775,10 +1780,31 @@ static int simplify_symbols(struct modul
68199 unsigned int i;
68200 int ret = 0;
68201 const struct kernel_symbol *ksym;
68202+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68203+ int is_fs_load = 0;
68204+ int register_filesystem_found = 0;
68205+ char *p;
68206+
68207+ p = strstr(mod->args, "grsec_modharden_fs");
68208+ if (p) {
68209+ char *endptr = p + strlen("grsec_modharden_fs");
68210+ /* copy \0 as well */
68211+ memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
68212+ is_fs_load = 1;
68213+ }
68214+#endif
68215
68216 for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
68217 const char *name = info->strtab + sym[i].st_name;
68218
68219+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68220+ /* it's a real shame this will never get ripped and copied
68221+ upstream! ;(
68222+ */
68223+ if (is_fs_load && !strcmp(name, "register_filesystem"))
68224+ register_filesystem_found = 1;
68225+#endif
68226+
68227 switch (sym[i].st_shndx) {
68228 case SHN_COMMON:
68229 /* We compiled with -fno-common. These are not
68230@@ -1799,7 +1825,9 @@ static int simplify_symbols(struct modul
68231 ksym = resolve_symbol_wait(mod, info, name);
68232 /* Ok if resolved. */
68233 if (ksym && !IS_ERR(ksym)) {
68234+ pax_open_kernel();
68235 sym[i].st_value = ksym->value;
68236+ pax_close_kernel();
68237 break;
68238 }
68239
68240@@ -1818,11 +1846,20 @@ static int simplify_symbols(struct modul
68241 secbase = (unsigned long)mod_percpu(mod);
68242 else
68243 secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
68244+ pax_open_kernel();
68245 sym[i].st_value += secbase;
68246+ pax_close_kernel();
68247 break;
68248 }
68249 }
68250
68251+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68252+ if (is_fs_load && !register_filesystem_found) {
68253+ printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
68254+ ret = -EPERM;
68255+ }
68256+#endif
68257+
68258 return ret;
68259 }
68260
68261@@ -1906,22 +1943,12 @@ static void layout_sections(struct modul
68262 || s->sh_entsize != ~0UL
68263 || strstarts(sname, ".init"))
68264 continue;
68265- s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
68266+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
68267+ s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
68268+ else
68269+ s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
68270 DEBUGP("\t%s\n", name);
68271 }
68272- switch (m) {
68273- case 0: /* executable */
68274- mod->core_size = debug_align(mod->core_size);
68275- mod->core_text_size = mod->core_size;
68276- break;
68277- case 1: /* RO: text and ro-data */
68278- mod->core_size = debug_align(mod->core_size);
68279- mod->core_ro_size = mod->core_size;
68280- break;
68281- case 3: /* whole core */
68282- mod->core_size = debug_align(mod->core_size);
68283- break;
68284- }
68285 }
68286
68287 DEBUGP("Init section allocation order:\n");
68288@@ -1935,23 +1962,13 @@ static void layout_sections(struct modul
68289 || s->sh_entsize != ~0UL
68290 || !strstarts(sname, ".init"))
68291 continue;
68292- s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
68293- | INIT_OFFSET_MASK);
68294+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
68295+ s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
68296+ else
68297+ s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
68298+ s->sh_entsize |= INIT_OFFSET_MASK;
68299 DEBUGP("\t%s\n", sname);
68300 }
68301- switch (m) {
68302- case 0: /* executable */
68303- mod->init_size = debug_align(mod->init_size);
68304- mod->init_text_size = mod->init_size;
68305- break;
68306- case 1: /* RO: text and ro-data */
68307- mod->init_size = debug_align(mod->init_size);
68308- mod->init_ro_size = mod->init_size;
68309- break;
68310- case 3: /* whole init */
68311- mod->init_size = debug_align(mod->init_size);
68312- break;
68313- }
68314 }
68315 }
68316
68317@@ -2119,7 +2136,7 @@ static void layout_symtab(struct module
68318
68319 /* Put symbol section at end of init part of module. */
68320 symsect->sh_flags |= SHF_ALLOC;
68321- symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
68322+ symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
68323 info->index.sym) | INIT_OFFSET_MASK;
68324 DEBUGP("\t%s\n", info->secstrings + symsect->sh_name);
68325
68326@@ -2136,19 +2153,19 @@ static void layout_symtab(struct module
68327 }
68328
68329 /* Append room for core symbols at end of core part. */
68330- info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
68331- mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym);
68332+ info->symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
68333+ mod->core_size_rx = info->symoffs + ndst * sizeof(Elf_Sym);
68334
68335 /* Put string table section at end of init part of module. */
68336 strsect->sh_flags |= SHF_ALLOC;
68337- strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
68338+ strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
68339 info->index.str) | INIT_OFFSET_MASK;
68340 DEBUGP("\t%s\n", info->secstrings + strsect->sh_name);
68341
68342 /* Append room for core symbols' strings at end of core part. */
68343- info->stroffs = mod->core_size;
68344+ info->stroffs = mod->core_size_rx;
68345 __set_bit(0, info->strmap);
68346- mod->core_size += bitmap_weight(info->strmap, strsect->sh_size);
68347+ mod->core_size_rx += bitmap_weight(info->strmap, strsect->sh_size);
68348 }
68349
68350 static void add_kallsyms(struct module *mod, const struct load_info *info)
68351@@ -2164,11 +2181,13 @@ static void add_kallsyms(struct module *
68352 /* Make sure we get permanent strtab: don't use info->strtab. */
68353 mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
68354
68355+ pax_open_kernel();
68356+
68357 /* Set types up while we still have access to sections. */
68358 for (i = 0; i < mod->num_symtab; i++)
68359 mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
68360
68361- mod->core_symtab = dst = mod->module_core + info->symoffs;
68362+ mod->core_symtab = dst = mod->module_core_rx + info->symoffs;
68363 src = mod->symtab;
68364 *dst = *src;
68365 for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
68366@@ -2181,10 +2200,12 @@ static void add_kallsyms(struct module *
68367 }
68368 mod->core_num_syms = ndst;
68369
68370- mod->core_strtab = s = mod->module_core + info->stroffs;
68371+ mod->core_strtab = s = mod->module_core_rx + info->stroffs;
68372 for (*s = 0, i = 1; i < info->sechdrs[info->index.str].sh_size; ++i)
68373 if (test_bit(i, info->strmap))
68374 *++s = mod->strtab[i];
68375+
68376+ pax_close_kernel();
68377 }
68378 #else
68379 static inline void layout_symtab(struct module *mod, struct load_info *info)
68380@@ -2213,17 +2234,33 @@ static void dynamic_debug_remove(struct
68381 ddebug_remove_module(debug->modname);
68382 }
68383
68384-static void *module_alloc_update_bounds(unsigned long size)
68385+static void *module_alloc_update_bounds_rw(unsigned long size)
68386 {
68387 void *ret = module_alloc(size);
68388
68389 if (ret) {
68390 mutex_lock(&module_mutex);
68391 /* Update module bounds. */
68392- if ((unsigned long)ret < module_addr_min)
68393- module_addr_min = (unsigned long)ret;
68394- if ((unsigned long)ret + size > module_addr_max)
68395- module_addr_max = (unsigned long)ret + size;
68396+ if ((unsigned long)ret < module_addr_min_rw)
68397+ module_addr_min_rw = (unsigned long)ret;
68398+ if ((unsigned long)ret + size > module_addr_max_rw)
68399+ module_addr_max_rw = (unsigned long)ret + size;
68400+ mutex_unlock(&module_mutex);
68401+ }
68402+ return ret;
68403+}
68404+
68405+static void *module_alloc_update_bounds_rx(unsigned long size)
68406+{
68407+ void *ret = module_alloc_exec(size);
68408+
68409+ if (ret) {
68410+ mutex_lock(&module_mutex);
68411+ /* Update module bounds. */
68412+ if ((unsigned long)ret < module_addr_min_rx)
68413+ module_addr_min_rx = (unsigned long)ret;
68414+ if ((unsigned long)ret + size > module_addr_max_rx)
68415+ module_addr_max_rx = (unsigned long)ret + size;
68416 mutex_unlock(&module_mutex);
68417 }
68418 return ret;
68419@@ -2516,7 +2553,7 @@ static int move_module(struct module *mo
68420 void *ptr;
68421
68422 /* Do the allocs. */
68423- ptr = module_alloc_update_bounds(mod->core_size);
68424+ ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
68425 /*
68426 * The pointer to this block is stored in the module structure
68427 * which is inside the block. Just mark it as not being a
68428@@ -2526,23 +2563,50 @@ static int move_module(struct module *mo
68429 if (!ptr)
68430 return -ENOMEM;
68431
68432- memset(ptr, 0, mod->core_size);
68433- mod->module_core = ptr;
68434+ memset(ptr, 0, mod->core_size_rw);
68435+ mod->module_core_rw = ptr;
68436
68437- ptr = module_alloc_update_bounds(mod->init_size);
68438+ ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
68439 /*
68440 * The pointer to this block is stored in the module structure
68441 * which is inside the block. This block doesn't need to be
68442 * scanned as it contains data and code that will be freed
68443 * after the module is initialized.
68444 */
68445- kmemleak_ignore(ptr);
68446- if (!ptr && mod->init_size) {
68447- module_free(mod, mod->module_core);
68448+ kmemleak_not_leak(ptr);
68449+ if (!ptr && mod->init_size_rw) {
68450+ module_free(mod, mod->module_core_rw);
68451 return -ENOMEM;
68452 }
68453- memset(ptr, 0, mod->init_size);
68454- mod->module_init = ptr;
68455+ memset(ptr, 0, mod->init_size_rw);
68456+ mod->module_init_rw = ptr;
68457+
68458+ ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
68459+ kmemleak_not_leak(ptr);
68460+ if (!ptr) {
68461+ module_free(mod, mod->module_init_rw);
68462+ module_free(mod, mod->module_core_rw);
68463+ return -ENOMEM;
68464+ }
68465+
68466+ pax_open_kernel();
68467+ memset(ptr, 0, mod->core_size_rx);
68468+ pax_close_kernel();
68469+ mod->module_core_rx = ptr;
68470+
68471+ ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
68472+ kmemleak_not_leak(ptr);
68473+ if (!ptr && mod->init_size_rx) {
68474+ module_free_exec(mod, mod->module_core_rx);
68475+ module_free(mod, mod->module_init_rw);
68476+ module_free(mod, mod->module_core_rw);
68477+ return -ENOMEM;
68478+ }
68479+
68480+ pax_open_kernel();
68481+ memset(ptr, 0, mod->init_size_rx);
68482+ pax_close_kernel();
68483+ mod->module_init_rx = ptr;
68484
68485 /* Transfer each section which specifies SHF_ALLOC */
68486 DEBUGP("final section addresses:\n");
68487@@ -2553,16 +2617,45 @@ static int move_module(struct module *mo
68488 if (!(shdr->sh_flags & SHF_ALLOC))
68489 continue;
68490
68491- if (shdr->sh_entsize & INIT_OFFSET_MASK)
68492- dest = mod->module_init
68493- + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
68494- else
68495- dest = mod->module_core + shdr->sh_entsize;
68496+ if (shdr->sh_entsize & INIT_OFFSET_MASK) {
68497+ if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
68498+ dest = mod->module_init_rw
68499+ + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
68500+ else
68501+ dest = mod->module_init_rx
68502+ + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
68503+ } else {
68504+ if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
68505+ dest = mod->module_core_rw + shdr->sh_entsize;
68506+ else
68507+ dest = mod->module_core_rx + shdr->sh_entsize;
68508+ }
68509+
68510+ if (shdr->sh_type != SHT_NOBITS) {
68511+
68512+#ifdef CONFIG_PAX_KERNEXEC
68513+#ifdef CONFIG_X86_64
68514+ if ((shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_EXECINSTR))
68515+ set_memory_x((unsigned long)dest, (shdr->sh_size + PAGE_SIZE) >> PAGE_SHIFT);
68516+#endif
68517+ if (!(shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_ALLOC)) {
68518+ pax_open_kernel();
68519+ memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
68520+ pax_close_kernel();
68521+ } else
68522+#endif
68523
68524- if (shdr->sh_type != SHT_NOBITS)
68525 memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
68526+ }
68527 /* Update sh_addr to point to copy in image. */
68528- shdr->sh_addr = (unsigned long)dest;
68529+
68530+#ifdef CONFIG_PAX_KERNEXEC
68531+ if (shdr->sh_flags & SHF_EXECINSTR)
68532+ shdr->sh_addr = ktva_ktla((unsigned long)dest);
68533+ else
68534+#endif
68535+
68536+ shdr->sh_addr = (unsigned long)dest;
68537 DEBUGP("\t0x%lx %s\n",
68538 shdr->sh_addr, info->secstrings + shdr->sh_name);
68539 }
68540@@ -2613,12 +2706,12 @@ static void flush_module_icache(const st
68541 * Do it before processing of module parameters, so the module
68542 * can provide parameter accessor functions of its own.
68543 */
68544- if (mod->module_init)
68545- flush_icache_range((unsigned long)mod->module_init,
68546- (unsigned long)mod->module_init
68547- + mod->init_size);
68548- flush_icache_range((unsigned long)mod->module_core,
68549- (unsigned long)mod->module_core + mod->core_size);
68550+ if (mod->module_init_rx)
68551+ flush_icache_range((unsigned long)mod->module_init_rx,
68552+ (unsigned long)mod->module_init_rx
68553+ + mod->init_size_rx);
68554+ flush_icache_range((unsigned long)mod->module_core_rx,
68555+ (unsigned long)mod->module_core_rx + mod->core_size_rx);
68556
68557 set_fs(old_fs);
68558 }
68559@@ -2690,8 +2783,10 @@ static void module_deallocate(struct mod
68560 {
68561 kfree(info->strmap);
68562 percpu_modfree(mod);
68563- module_free(mod, mod->module_init);
68564- module_free(mod, mod->module_core);
68565+ module_free_exec(mod, mod->module_init_rx);
68566+ module_free_exec(mod, mod->module_core_rx);
68567+ module_free(mod, mod->module_init_rw);
68568+ module_free(mod, mod->module_core_rw);
68569 }
68570
68571 static int post_relocation(struct module *mod, const struct load_info *info)
68572@@ -2748,9 +2843,38 @@ static struct module *load_module(void _
68573 if (err)
68574 goto free_unload;
68575
68576+ /* Now copy in args */
68577+ mod->args = strndup_user(uargs, ~0UL >> 1);
68578+ if (IS_ERR(mod->args)) {
68579+ err = PTR_ERR(mod->args);
68580+ goto free_unload;
68581+ }
68582+
68583 /* Set up MODINFO_ATTR fields */
68584 setup_modinfo(mod, &info);
68585
68586+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68587+ {
68588+ char *p, *p2;
68589+
68590+ if (strstr(mod->args, "grsec_modharden_netdev")) {
68591+ printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
68592+ err = -EPERM;
68593+ goto free_modinfo;
68594+ } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
68595+ p += strlen("grsec_modharden_normal");
68596+ p2 = strstr(p, "_");
68597+ if (p2) {
68598+ *p2 = '\0';
68599+ printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
68600+ *p2 = '_';
68601+ }
68602+ err = -EPERM;
68603+ goto free_modinfo;
68604+ }
68605+ }
68606+#endif
68607+
68608 /* Fix up syms, so that st_value is a pointer to location. */
68609 err = simplify_symbols(mod, &info);
68610 if (err < 0)
68611@@ -2766,13 +2890,6 @@ static struct module *load_module(void _
68612
68613 flush_module_icache(mod);
68614
68615- /* Now copy in args */
68616- mod->args = strndup_user(uargs, ~0UL >> 1);
68617- if (IS_ERR(mod->args)) {
68618- err = PTR_ERR(mod->args);
68619- goto free_arch_cleanup;
68620- }
68621-
68622 /* Mark state as coming so strong_try_module_get() ignores us. */
68623 mod->state = MODULE_STATE_COMING;
68624
68625@@ -2832,11 +2949,10 @@ static struct module *load_module(void _
68626 unlock:
68627 mutex_unlock(&module_mutex);
68628 synchronize_sched();
68629- kfree(mod->args);
68630- free_arch_cleanup:
68631 module_arch_cleanup(mod);
68632 free_modinfo:
68633 free_modinfo(mod);
68634+ kfree(mod->args);
68635 free_unload:
68636 module_unload_free(mod);
68637 free_module:
68638@@ -2877,16 +2993,16 @@ SYSCALL_DEFINE3(init_module, void __user
68639 MODULE_STATE_COMING, mod);
68640
68641 /* Set RO and NX regions for core */
68642- set_section_ro_nx(mod->module_core,
68643- mod->core_text_size,
68644- mod->core_ro_size,
68645- mod->core_size);
68646+ set_section_ro_nx(mod->module_core_rx,
68647+ mod->core_size_rx,
68648+ mod->core_size_rx,
68649+ mod->core_size_rx);
68650
68651 /* Set RO and NX regions for init */
68652- set_section_ro_nx(mod->module_init,
68653- mod->init_text_size,
68654- mod->init_ro_size,
68655- mod->init_size);
68656+ set_section_ro_nx(mod->module_init_rx,
68657+ mod->init_size_rx,
68658+ mod->init_size_rx,
68659+ mod->init_size_rx);
68660
68661 do_mod_ctors(mod);
68662 /* Start the module */
68663@@ -2931,11 +3047,13 @@ SYSCALL_DEFINE3(init_module, void __user
68664 mod->symtab = mod->core_symtab;
68665 mod->strtab = mod->core_strtab;
68666 #endif
68667- unset_section_ro_nx(mod, mod->module_init);
68668- module_free(mod, mod->module_init);
68669- mod->module_init = NULL;
68670- mod->init_size = 0;
68671- mod->init_text_size = 0;
68672+ unset_section_ro_nx(mod, mod->module_init_rx);
68673+ module_free(mod, mod->module_init_rw);
68674+ module_free_exec(mod, mod->module_init_rx);
68675+ mod->module_init_rw = NULL;
68676+ mod->module_init_rx = NULL;
68677+ mod->init_size_rw = 0;
68678+ mod->init_size_rx = 0;
68679 mutex_unlock(&module_mutex);
68680
68681 return 0;
68682@@ -2966,10 +3084,16 @@ static const char *get_ksymbol(struct mo
68683 unsigned long nextval;
68684
68685 /* At worse, next value is at end of module */
68686- if (within_module_init(addr, mod))
68687- nextval = (unsigned long)mod->module_init+mod->init_text_size;
68688+ if (within_module_init_rx(addr, mod))
68689+ nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
68690+ else if (within_module_init_rw(addr, mod))
68691+ nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
68692+ else if (within_module_core_rx(addr, mod))
68693+ nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
68694+ else if (within_module_core_rw(addr, mod))
68695+ nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
68696 else
68697- nextval = (unsigned long)mod->module_core+mod->core_text_size;
68698+ return NULL;
68699
68700 /* Scan for closest preceding symbol, and next symbol. (ELF
68701 starts real symbols at 1). */
68702@@ -3215,7 +3339,7 @@ static int m_show(struct seq_file *m, vo
68703 char buf[8];
68704
68705 seq_printf(m, "%s %u",
68706- mod->name, mod->init_size + mod->core_size);
68707+ mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
68708 print_unload_info(m, mod);
68709
68710 /* Informative for users. */
68711@@ -3224,7 +3348,7 @@ static int m_show(struct seq_file *m, vo
68712 mod->state == MODULE_STATE_COMING ? "Loading":
68713 "Live");
68714 /* Used by oprofile and other similar tools. */
68715- seq_printf(m, " 0x%pK", mod->module_core);
68716+ seq_printf(m, " 0x%pK 0x%pK", mod->module_core_rx, mod->module_core_rw);
68717
68718 /* Taints info */
68719 if (mod->taints)
68720@@ -3260,7 +3384,17 @@ static const struct file_operations proc
68721
68722 static int __init proc_modules_init(void)
68723 {
68724+#ifndef CONFIG_GRKERNSEC_HIDESYM
68725+#ifdef CONFIG_GRKERNSEC_PROC_USER
68726+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
68727+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
68728+ proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
68729+#else
68730 proc_create("modules", 0, NULL, &proc_modules_operations);
68731+#endif
68732+#else
68733+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
68734+#endif
68735 return 0;
68736 }
68737 module_init(proc_modules_init);
68738@@ -3319,12 +3453,12 @@ struct module *__module_address(unsigned
68739 {
68740 struct module *mod;
68741
68742- if (addr < module_addr_min || addr > module_addr_max)
68743+ if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
68744+ (addr < module_addr_min_rw || addr > module_addr_max_rw))
68745 return NULL;
68746
68747 list_for_each_entry_rcu(mod, &modules, list)
68748- if (within_module_core(addr, mod)
68749- || within_module_init(addr, mod))
68750+ if (within_module_init(addr, mod) || within_module_core(addr, mod))
68751 return mod;
68752 return NULL;
68753 }
68754@@ -3358,11 +3492,20 @@ bool is_module_text_address(unsigned lon
68755 */
68756 struct module *__module_text_address(unsigned long addr)
68757 {
68758- struct module *mod = __module_address(addr);
68759+ struct module *mod;
68760+
68761+#ifdef CONFIG_X86_32
68762+ addr = ktla_ktva(addr);
68763+#endif
68764+
68765+ if (addr < module_addr_min_rx || addr > module_addr_max_rx)
68766+ return NULL;
68767+
68768+ mod = __module_address(addr);
68769+
68770 if (mod) {
68771 /* Make sure it's within the text section. */
68772- if (!within(addr, mod->module_init, mod->init_text_size)
68773- && !within(addr, mod->module_core, mod->core_text_size))
68774+ if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
68775 mod = NULL;
68776 }
68777 return mod;
68778diff -urNp linux-2.6.39.1/kernel/mutex.c linux-2.6.39.1/kernel/mutex.c
68779--- linux-2.6.39.1/kernel/mutex.c 2011-05-19 00:06:34.000000000 -0400
68780+++ linux-2.6.39.1/kernel/mutex.c 2011-05-22 19:36:33.000000000 -0400
68781@@ -160,7 +160,7 @@ __mutex_lock_common(struct mutex *lock,
68782 */
68783
68784 for (;;) {
68785- struct thread_info *owner;
68786+ struct task_struct *owner;
68787
68788 /*
68789 * If we own the BKL, then don't spin. The owner of
68790@@ -205,7 +205,7 @@ __mutex_lock_common(struct mutex *lock,
68791 spin_lock_mutex(&lock->wait_lock, flags);
68792
68793 debug_mutex_lock_common(lock, &waiter);
68794- debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
68795+ debug_mutex_add_waiter(lock, &waiter, task);
68796
68797 /* add waiting tasks to the end of the waitqueue (FIFO): */
68798 list_add_tail(&waiter.list, &lock->wait_list);
68799@@ -234,8 +234,7 @@ __mutex_lock_common(struct mutex *lock,
68800 * TASK_UNINTERRUPTIBLE case.)
68801 */
68802 if (unlikely(signal_pending_state(state, task))) {
68803- mutex_remove_waiter(lock, &waiter,
68804- task_thread_info(task));
68805+ mutex_remove_waiter(lock, &waiter, task);
68806 mutex_release(&lock->dep_map, 1, ip);
68807 spin_unlock_mutex(&lock->wait_lock, flags);
68808
68809@@ -256,7 +255,7 @@ __mutex_lock_common(struct mutex *lock,
68810 done:
68811 lock_acquired(&lock->dep_map, ip);
68812 /* got the lock - rejoice! */
68813- mutex_remove_waiter(lock, &waiter, current_thread_info());
68814+ mutex_remove_waiter(lock, &waiter, task);
68815 mutex_set_owner(lock);
68816
68817 /* set it to 0 if there are no waiters left: */
68818diff -urNp linux-2.6.39.1/kernel/mutex-debug.c linux-2.6.39.1/kernel/mutex-debug.c
68819--- linux-2.6.39.1/kernel/mutex-debug.c 2011-05-19 00:06:34.000000000 -0400
68820+++ linux-2.6.39.1/kernel/mutex-debug.c 2011-05-22 19:36:33.000000000 -0400
68821@@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mute
68822 }
68823
68824 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68825- struct thread_info *ti)
68826+ struct task_struct *task)
68827 {
68828 SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
68829
68830 /* Mark the current thread as blocked on the lock: */
68831- ti->task->blocked_on = waiter;
68832+ task->blocked_on = waiter;
68833 }
68834
68835 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68836- struct thread_info *ti)
68837+ struct task_struct *task)
68838 {
68839 DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
68840- DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
68841- DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
68842- ti->task->blocked_on = NULL;
68843+ DEBUG_LOCKS_WARN_ON(waiter->task != task);
68844+ DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
68845+ task->blocked_on = NULL;
68846
68847 list_del_init(&waiter->list);
68848 waiter->task = NULL;
68849@@ -75,7 +75,7 @@ void debug_mutex_unlock(struct mutex *lo
68850 return;
68851
68852 DEBUG_LOCKS_WARN_ON(lock->magic != lock);
68853- DEBUG_LOCKS_WARN_ON(lock->owner != current_thread_info());
68854+ DEBUG_LOCKS_WARN_ON(lock->owner != current);
68855 DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
68856 mutex_clear_owner(lock);
68857 }
68858diff -urNp linux-2.6.39.1/kernel/mutex-debug.h linux-2.6.39.1/kernel/mutex-debug.h
68859--- linux-2.6.39.1/kernel/mutex-debug.h 2011-05-19 00:06:34.000000000 -0400
68860+++ linux-2.6.39.1/kernel/mutex-debug.h 2011-05-22 19:36:33.000000000 -0400
68861@@ -20,16 +20,16 @@ extern void debug_mutex_wake_waiter(stru
68862 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
68863 extern void debug_mutex_add_waiter(struct mutex *lock,
68864 struct mutex_waiter *waiter,
68865- struct thread_info *ti);
68866+ struct task_struct *task);
68867 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68868- struct thread_info *ti);
68869+ struct task_struct *task);
68870 extern void debug_mutex_unlock(struct mutex *lock);
68871 extern void debug_mutex_init(struct mutex *lock, const char *name,
68872 struct lock_class_key *key);
68873
68874 static inline void mutex_set_owner(struct mutex *lock)
68875 {
68876- lock->owner = current_thread_info();
68877+ lock->owner = current;
68878 }
68879
68880 static inline void mutex_clear_owner(struct mutex *lock)
68881diff -urNp linux-2.6.39.1/kernel/mutex.h linux-2.6.39.1/kernel/mutex.h
68882--- linux-2.6.39.1/kernel/mutex.h 2011-05-19 00:06:34.000000000 -0400
68883+++ linux-2.6.39.1/kernel/mutex.h 2011-05-22 19:36:33.000000000 -0400
68884@@ -19,7 +19,7 @@
68885 #ifdef CONFIG_SMP
68886 static inline void mutex_set_owner(struct mutex *lock)
68887 {
68888- lock->owner = current_thread_info();
68889+ lock->owner = current;
68890 }
68891
68892 static inline void mutex_clear_owner(struct mutex *lock)
68893diff -urNp linux-2.6.39.1/kernel/padata.c linux-2.6.39.1/kernel/padata.c
68894--- linux-2.6.39.1/kernel/padata.c 2011-05-19 00:06:34.000000000 -0400
68895+++ linux-2.6.39.1/kernel/padata.c 2011-05-22 19:36:33.000000000 -0400
68896@@ -132,10 +132,10 @@ int padata_do_parallel(struct padata_ins
68897 padata->pd = pd;
68898 padata->cb_cpu = cb_cpu;
68899
68900- if (unlikely(atomic_read(&pd->seq_nr) == pd->max_seq_nr))
68901- atomic_set(&pd->seq_nr, -1);
68902+ if (unlikely(atomic_read_unchecked(&pd->seq_nr) == pd->max_seq_nr))
68903+ atomic_set_unchecked(&pd->seq_nr, -1);
68904
68905- padata->seq_nr = atomic_inc_return(&pd->seq_nr);
68906+ padata->seq_nr = atomic_inc_return_unchecked(&pd->seq_nr);
68907
68908 target_cpu = padata_cpu_hash(padata);
68909 queue = per_cpu_ptr(pd->pqueue, target_cpu);
68910@@ -444,7 +444,7 @@ static struct parallel_data *padata_allo
68911 padata_init_pqueues(pd);
68912 padata_init_squeues(pd);
68913 setup_timer(&pd->timer, padata_reorder_timer, (unsigned long)pd);
68914- atomic_set(&pd->seq_nr, -1);
68915+ atomic_set_unchecked(&pd->seq_nr, -1);
68916 atomic_set(&pd->reorder_objects, 0);
68917 atomic_set(&pd->refcnt, 0);
68918 pd->pinst = pinst;
68919diff -urNp linux-2.6.39.1/kernel/panic.c linux-2.6.39.1/kernel/panic.c
68920--- linux-2.6.39.1/kernel/panic.c 2011-05-19 00:06:34.000000000 -0400
68921+++ linux-2.6.39.1/kernel/panic.c 2011-05-22 19:41:42.000000000 -0400
68922@@ -369,7 +369,7 @@ static void warn_slowpath_common(const c
68923 const char *board;
68924
68925 printk(KERN_WARNING "------------[ cut here ]------------\n");
68926- printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
68927+ printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
68928 board = dmi_get_system_info(DMI_PRODUCT_NAME);
68929 if (board)
68930 printk(KERN_WARNING "Hardware name: %s\n", board);
68931@@ -424,7 +424,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
68932 */
68933 void __stack_chk_fail(void)
68934 {
68935- panic("stack-protector: Kernel stack is corrupted in: %p\n",
68936+ dump_stack();
68937+ panic("stack-protector: Kernel stack is corrupted in: %pA\n",
68938 __builtin_return_address(0));
68939 }
68940 EXPORT_SYMBOL(__stack_chk_fail);
68941diff -urNp linux-2.6.39.1/kernel/params.c linux-2.6.39.1/kernel/params.c
68942--- linux-2.6.39.1/kernel/params.c 2011-05-19 00:06:34.000000000 -0400
68943+++ linux-2.6.39.1/kernel/params.c 2011-05-22 19:36:33.000000000 -0400
68944@@ -234,7 +234,7 @@ int parse_args(const char *name,
68945 { \
68946 return sprintf(buffer, format, *((type *)kp->arg)); \
68947 } \
68948- struct kernel_param_ops param_ops_##name = { \
68949+ const struct kernel_param_ops param_ops_##name = { \
68950 .set = param_set_##name, \
68951 .get = param_get_##name, \
68952 }; \
68953@@ -286,7 +286,7 @@ static void param_free_charp(void *arg)
68954 maybe_kfree_parameter(*((char **)arg));
68955 }
68956
68957-struct kernel_param_ops param_ops_charp = {
68958+const struct kernel_param_ops param_ops_charp = {
68959 .set = param_set_charp,
68960 .get = param_get_charp,
68961 .free = param_free_charp,
68962@@ -334,7 +334,7 @@ int param_get_bool(char *buffer, const s
68963 }
68964 EXPORT_SYMBOL(param_get_bool);
68965
68966-struct kernel_param_ops param_ops_bool = {
68967+const struct kernel_param_ops param_ops_bool = {
68968 .set = param_set_bool,
68969 .get = param_get_bool,
68970 };
68971@@ -362,7 +362,7 @@ int param_get_invbool(char *buffer, cons
68972 }
68973 EXPORT_SYMBOL(param_get_invbool);
68974
68975-struct kernel_param_ops param_ops_invbool = {
68976+const struct kernel_param_ops param_ops_invbool = {
68977 .set = param_set_invbool,
68978 .get = param_get_invbool,
68979 };
68980@@ -460,7 +460,7 @@ static void param_array_free(void *arg)
68981 arr->ops->free(arr->elem + arr->elemsize * i);
68982 }
68983
68984-struct kernel_param_ops param_array_ops = {
68985+const struct kernel_param_ops param_array_ops = {
68986 .set = param_array_set,
68987 .get = param_array_get,
68988 .free = param_array_free,
68989@@ -488,7 +488,7 @@ int param_get_string(char *buffer, const
68990 }
68991 EXPORT_SYMBOL(param_get_string);
68992
68993-struct kernel_param_ops param_ops_string = {
68994+const struct kernel_param_ops param_ops_string = {
68995 .set = param_set_copystring,
68996 .get = param_get_string,
68997 };
68998diff -urNp linux-2.6.39.1/kernel/perf_event.c linux-2.6.39.1/kernel/perf_event.c
68999--- linux-2.6.39.1/kernel/perf_event.c 2011-05-19 00:06:34.000000000 -0400
69000+++ linux-2.6.39.1/kernel/perf_event.c 2011-05-22 19:36:33.000000000 -0400
69001@@ -170,7 +170,7 @@ int perf_proc_update_handler(struct ctl_
69002 return 0;
69003 }
69004
69005-static atomic64_t perf_event_id;
69006+static atomic64_unchecked_t perf_event_id;
69007
69008 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
69009 enum event_type_t event_type);
69010@@ -2496,7 +2496,7 @@ static void __perf_event_read(void *info
69011
69012 static inline u64 perf_event_count(struct perf_event *event)
69013 {
69014- return local64_read(&event->count) + atomic64_read(&event->child_count);
69015+ return local64_read(&event->count) + atomic64_read_unchecked(&event->child_count);
69016 }
69017
69018 static u64 perf_event_read(struct perf_event *event)
69019@@ -3031,9 +3031,9 @@ u64 perf_event_read_value(struct perf_ev
69020 mutex_lock(&event->child_mutex);
69021 total += perf_event_read(event);
69022 *enabled += event->total_time_enabled +
69023- atomic64_read(&event->child_total_time_enabled);
69024+ atomic64_read_unchecked(&event->child_total_time_enabled);
69025 *running += event->total_time_running +
69026- atomic64_read(&event->child_total_time_running);
69027+ atomic64_read_unchecked(&event->child_total_time_running);
69028
69029 list_for_each_entry(child, &event->child_list, child_list) {
69030 total += perf_event_read(child);
69031@@ -3396,10 +3396,10 @@ void perf_event_update_userpage(struct p
69032 userpg->offset -= local64_read(&event->hw.prev_count);
69033
69034 userpg->time_enabled = event->total_time_enabled +
69035- atomic64_read(&event->child_total_time_enabled);
69036+ atomic64_read_unchecked(&event->child_total_time_enabled);
69037
69038 userpg->time_running = event->total_time_running +
69039- atomic64_read(&event->child_total_time_running);
69040+ atomic64_read_unchecked(&event->child_total_time_running);
69041
69042 barrier();
69043 ++userpg->lock;
69044@@ -3884,16 +3884,16 @@ static void perf_pending_event(struct ir
69045 * Later on, we might change it to a list if there is
69046 * another virtualization implementation supporting the callbacks.
69047 */
69048-struct perf_guest_info_callbacks *perf_guest_cbs;
69049+const struct perf_guest_info_callbacks *perf_guest_cbs;
69050
69051-int perf_register_guest_info_callbacks(struct perf_guest_info_callbacks *cbs)
69052+int perf_register_guest_info_callbacks(const struct perf_guest_info_callbacks *cbs)
69053 {
69054 perf_guest_cbs = cbs;
69055 return 0;
69056 }
69057 EXPORT_SYMBOL_GPL(perf_register_guest_info_callbacks);
69058
69059-int perf_unregister_guest_info_callbacks(struct perf_guest_info_callbacks *cbs)
69060+int perf_unregister_guest_info_callbacks(const struct perf_guest_info_callbacks *cbs)
69061 {
69062 perf_guest_cbs = NULL;
69063 return 0;
69064@@ -4196,11 +4196,11 @@ static void perf_output_read_one(struct
69065 values[n++] = perf_event_count(event);
69066 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
69067 values[n++] = enabled +
69068- atomic64_read(&event->child_total_time_enabled);
69069+ atomic64_read_unchecked(&event->child_total_time_enabled);
69070 }
69071 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
69072 values[n++] = running +
69073- atomic64_read(&event->child_total_time_running);
69074+ atomic64_read_unchecked(&event->child_total_time_running);
69075 }
69076 if (read_format & PERF_FORMAT_ID)
69077 values[n++] = primary_event_id(event);
69078@@ -6201,7 +6201,7 @@ perf_event_alloc(struct perf_event_attr
69079 event->parent = parent_event;
69080
69081 event->ns = get_pid_ns(current->nsproxy->pid_ns);
69082- event->id = atomic64_inc_return(&perf_event_id);
69083+ event->id = atomic64_inc_return_unchecked(&perf_event_id);
69084
69085 event->state = PERF_EVENT_STATE_INACTIVE;
69086
69087@@ -6724,10 +6724,10 @@ static void sync_child_event(struct perf
69088 /*
69089 * Add back the child's count to the parent's count:
69090 */
69091- atomic64_add(child_val, &parent_event->child_count);
69092- atomic64_add(child_event->total_time_enabled,
69093+ atomic64_add_unchecked(child_val, &parent_event->child_count);
69094+ atomic64_add_unchecked(child_event->total_time_enabled,
69095 &parent_event->child_total_time_enabled);
69096- atomic64_add(child_event->total_time_running,
69097+ atomic64_add_unchecked(child_event->total_time_running,
69098 &parent_event->child_total_time_running);
69099
69100 /*
69101diff -urNp linux-2.6.39.1/kernel/pid.c linux-2.6.39.1/kernel/pid.c
69102--- linux-2.6.39.1/kernel/pid.c 2011-05-19 00:06:34.000000000 -0400
69103+++ linux-2.6.39.1/kernel/pid.c 2011-05-22 19:41:42.000000000 -0400
69104@@ -33,6 +33,7 @@
69105 #include <linux/rculist.h>
69106 #include <linux/bootmem.h>
69107 #include <linux/hash.h>
69108+#include <linux/security.h>
69109 #include <linux/pid_namespace.h>
69110 #include <linux/init_task.h>
69111 #include <linux/syscalls.h>
69112@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
69113
69114 int pid_max = PID_MAX_DEFAULT;
69115
69116-#define RESERVED_PIDS 300
69117+#define RESERVED_PIDS 500
69118
69119 int pid_max_min = RESERVED_PIDS + 1;
69120 int pid_max_max = PID_MAX_LIMIT;
69121@@ -419,8 +420,15 @@ EXPORT_SYMBOL(pid_task);
69122 */
69123 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
69124 {
69125+ struct task_struct *task;
69126+
69127 rcu_lockdep_assert(rcu_read_lock_held());
69128- return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
69129+ task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
69130+
69131+ if (gr_pid_is_chrooted(task))
69132+ return NULL;
69133+
69134+ return task;
69135 }
69136
69137 struct task_struct *find_task_by_vpid(pid_t vnr)
69138diff -urNp linux-2.6.39.1/kernel/posix-cpu-timers.c linux-2.6.39.1/kernel/posix-cpu-timers.c
69139--- linux-2.6.39.1/kernel/posix-cpu-timers.c 2011-05-19 00:06:34.000000000 -0400
69140+++ linux-2.6.39.1/kernel/posix-cpu-timers.c 2011-05-22 19:41:42.000000000 -0400
69141@@ -6,6 +6,7 @@
69142 #include <linux/posix-timers.h>
69143 #include <linux/errno.h>
69144 #include <linux/math64.h>
69145+#include <linux/security.h>
69146 #include <asm/uaccess.h>
69147 #include <linux/kernel_stat.h>
69148 #include <trace/events/timer.h>
69149@@ -1590,7 +1591,7 @@ static int thread_cpu_timer_create(struc
69150 return posix_cpu_timer_create(timer);
69151 }
69152
69153-struct k_clock clock_posix_cpu = {
69154+const struct k_clock clock_posix_cpu = {
69155 .clock_getres = posix_cpu_clock_getres,
69156 .clock_set = posix_cpu_clock_set,
69157 .clock_get = posix_cpu_clock_get,
69158@@ -1604,14 +1605,14 @@ struct k_clock clock_posix_cpu = {
69159
69160 static __init int init_posix_cpu_timers(void)
69161 {
69162- struct k_clock process = {
69163+ const struct k_clock process = {
69164 .clock_getres = process_cpu_clock_getres,
69165 .clock_get = process_cpu_clock_get,
69166 .timer_create = process_cpu_timer_create,
69167 .nsleep = process_cpu_nsleep,
69168 .nsleep_restart = process_cpu_nsleep_restart,
69169 };
69170- struct k_clock thread = {
69171+ const struct k_clock thread = {
69172 .clock_getres = thread_cpu_clock_getres,
69173 .clock_get = thread_cpu_clock_get,
69174 .timer_create = thread_cpu_timer_create,
69175diff -urNp linux-2.6.39.1/kernel/posix-timers.c linux-2.6.39.1/kernel/posix-timers.c
69176--- linux-2.6.39.1/kernel/posix-timers.c 2011-05-19 00:06:34.000000000 -0400
69177+++ linux-2.6.39.1/kernel/posix-timers.c 2011-05-22 20:13:41.000000000 -0400
69178@@ -43,6 +43,7 @@
69179 #include <linux/idr.h>
69180 #include <linux/posix-clock.h>
69181 #include <linux/posix-timers.h>
69182+#include <linux/grsecurity.h>
69183 #include <linux/syscalls.h>
69184 #include <linux/wait.h>
69185 #include <linux/workqueue.h>
69186@@ -227,7 +228,7 @@ static int posix_get_boottime(const cloc
69187 */
69188 static __init int init_posix_timers(void)
69189 {
69190- struct k_clock clock_realtime = {
69191+ const struct k_clock clock_realtime = {
69192 .clock_getres = hrtimer_get_res,
69193 .clock_get = posix_clock_realtime_get,
69194 .clock_set = posix_clock_realtime_set,
69195@@ -239,7 +240,7 @@ static __init int init_posix_timers(void
69196 .timer_get = common_timer_get,
69197 .timer_del = common_timer_del,
69198 };
69199- struct k_clock clock_monotonic = {
69200+ const struct k_clock clock_monotonic = {
69201 .clock_getres = hrtimer_get_res,
69202 .clock_get = posix_ktime_get_ts,
69203 .nsleep = common_nsleep,
69204@@ -249,19 +250,19 @@ static __init int init_posix_timers(void
69205 .timer_get = common_timer_get,
69206 .timer_del = common_timer_del,
69207 };
69208- struct k_clock clock_monotonic_raw = {
69209+ const struct k_clock clock_monotonic_raw = {
69210 .clock_getres = hrtimer_get_res,
69211 .clock_get = posix_get_monotonic_raw,
69212 };
69213- struct k_clock clock_realtime_coarse = {
69214+ const struct k_clock clock_realtime_coarse = {
69215 .clock_getres = posix_get_coarse_res,
69216 .clock_get = posix_get_realtime_coarse,
69217 };
69218- struct k_clock clock_monotonic_coarse = {
69219+ const struct k_clock clock_monotonic_coarse = {
69220 .clock_getres = posix_get_coarse_res,
69221 .clock_get = posix_get_monotonic_coarse,
69222 };
69223- struct k_clock clock_boottime = {
69224+ const struct k_clock clock_boottime = {
69225 .clock_getres = hrtimer_get_res,
69226 .clock_get = posix_get_boottime,
69227 .nsleep = common_nsleep,
69228@@ -272,6 +273,8 @@ static __init int init_posix_timers(void
69229 .timer_del = common_timer_del,
69230 };
69231
69232+ pax_track_stack();
69233+
69234 posix_timers_register_clock(CLOCK_REALTIME, &clock_realtime);
69235 posix_timers_register_clock(CLOCK_MONOTONIC, &clock_monotonic);
69236 posix_timers_register_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
69237@@ -454,7 +457,7 @@ static struct pid *good_sigevent(sigeven
69238 }
69239
69240 void posix_timers_register_clock(const clockid_t clock_id,
69241- struct k_clock *new_clock)
69242+ const struct k_clock *new_clock)
69243 {
69244 if ((unsigned) clock_id >= MAX_CLOCKS) {
69245 printk(KERN_WARNING "POSIX clock register failed for clock_id %d\n",
69246@@ -506,7 +509,7 @@ static void release_posix_timer(struct k
69247 kmem_cache_free(posix_timers_cache, tmr);
69248 }
69249
69250-static struct k_clock *clockid_to_kclock(const clockid_t id)
69251+static const struct k_clock *clockid_to_kclock(const clockid_t id)
69252 {
69253 if (id < 0)
69254 return (id & CLOCKFD_MASK) == CLOCKFD ?
69255@@ -529,7 +532,7 @@ SYSCALL_DEFINE3(timer_create, const cloc
69256 struct sigevent __user *, timer_event_spec,
69257 timer_t __user *, created_timer_id)
69258 {
69259- struct k_clock *kc = clockid_to_kclock(which_clock);
69260+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69261 struct k_itimer *new_timer;
69262 int error, new_timer_id;
69263 sigevent_t event;
69264@@ -714,7 +717,7 @@ SYSCALL_DEFINE2(timer_gettime, timer_t,
69265 {
69266 struct itimerspec cur_setting;
69267 struct k_itimer *timr;
69268- struct k_clock *kc;
69269+ const struct k_clock *kc;
69270 unsigned long flags;
69271 int ret = 0;
69272
69273@@ -822,7 +825,7 @@ SYSCALL_DEFINE4(timer_settime, timer_t,
69274 int error = 0;
69275 unsigned long flag;
69276 struct itimerspec *rtn = old_setting ? &old_spec : NULL;
69277- struct k_clock *kc;
69278+ const struct k_clock *kc;
69279
69280 if (!new_setting)
69281 return -EINVAL;
69282@@ -868,7 +871,7 @@ static int common_timer_del(struct k_iti
69283
69284 static inline int timer_delete_hook(struct k_itimer *timer)
69285 {
69286- struct k_clock *kc = clockid_to_kclock(timer->it_clock);
69287+ const struct k_clock *kc = clockid_to_kclock(timer->it_clock);
69288
69289 if (WARN_ON_ONCE(!kc || !kc->timer_del))
69290 return -EINVAL;
69291@@ -947,7 +950,7 @@ void exit_itimers(struct signal_struct *
69292 SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
69293 const struct timespec __user *, tp)
69294 {
69295- struct k_clock *kc = clockid_to_kclock(which_clock);
69296+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69297 struct timespec new_tp;
69298
69299 if (!kc || !kc->clock_set)
69300@@ -956,13 +959,20 @@ SYSCALL_DEFINE2(clock_settime, const clo
69301 if (copy_from_user(&new_tp, tp, sizeof (*tp)))
69302 return -EFAULT;
69303
69304+ /* only the CLOCK_REALTIME clock can be set, all other clocks
69305+ have their clock_set fptr set to a nosettime dummy function
69306+ CLOCK_REALTIME has a NULL clock_set fptr which causes it to
69307+ call common_clock_set, which calls do_sys_settimeofday, which
69308+ we hook
69309+ */
69310+
69311 return kc->clock_set(which_clock, &new_tp);
69312 }
69313
69314 SYSCALL_DEFINE2(clock_gettime, const clockid_t, which_clock,
69315 struct timespec __user *,tp)
69316 {
69317- struct k_clock *kc = clockid_to_kclock(which_clock);
69318+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69319 struct timespec kernel_tp;
69320 int error;
69321
69322@@ -980,7 +990,7 @@ SYSCALL_DEFINE2(clock_gettime, const clo
69323 SYSCALL_DEFINE2(clock_adjtime, const clockid_t, which_clock,
69324 struct timex __user *, utx)
69325 {
69326- struct k_clock *kc = clockid_to_kclock(which_clock);
69327+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69328 struct timex ktx;
69329 int err;
69330
69331@@ -1003,7 +1013,7 @@ SYSCALL_DEFINE2(clock_adjtime, const clo
69332 SYSCALL_DEFINE2(clock_getres, const clockid_t, which_clock,
69333 struct timespec __user *, tp)
69334 {
69335- struct k_clock *kc = clockid_to_kclock(which_clock);
69336+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69337 struct timespec rtn_tp;
69338 int error;
69339
69340@@ -1033,7 +1043,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const c
69341 const struct timespec __user *, rqtp,
69342 struct timespec __user *, rmtp)
69343 {
69344- struct k_clock *kc = clockid_to_kclock(which_clock);
69345+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69346 struct timespec t;
69347
69348 if (!kc)
69349@@ -1057,7 +1067,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const c
69350 long clock_nanosleep_restart(struct restart_block *restart_block)
69351 {
69352 clockid_t which_clock = restart_block->nanosleep.index;
69353- struct k_clock *kc = clockid_to_kclock(which_clock);
69354+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69355
69356 if (WARN_ON_ONCE(!kc || !kc->nsleep_restart))
69357 return -EINVAL;
69358diff -urNp linux-2.6.39.1/kernel/power/poweroff.c linux-2.6.39.1/kernel/power/poweroff.c
69359--- linux-2.6.39.1/kernel/power/poweroff.c 2011-05-19 00:06:34.000000000 -0400
69360+++ linux-2.6.39.1/kernel/power/poweroff.c 2011-05-22 19:36:33.000000000 -0400
69361@@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_powerof
69362 .enable_mask = SYSRQ_ENABLE_BOOT,
69363 };
69364
69365-static int pm_sysrq_init(void)
69366+static int __init pm_sysrq_init(void)
69367 {
69368 register_sysrq_key('o', &sysrq_poweroff_op);
69369 return 0;
69370diff -urNp linux-2.6.39.1/kernel/power/process.c linux-2.6.39.1/kernel/power/process.c
69371--- linux-2.6.39.1/kernel/power/process.c 2011-05-19 00:06:34.000000000 -0400
69372+++ linux-2.6.39.1/kernel/power/process.c 2011-05-22 19:36:33.000000000 -0400
69373@@ -41,6 +41,7 @@ static int try_to_freeze_tasks(bool sig_
69374 u64 elapsed_csecs64;
69375 unsigned int elapsed_csecs;
69376 bool wakeup = false;
69377+ bool timedout = false;
69378
69379 do_gettimeofday(&start);
69380
69381@@ -51,6 +52,8 @@ static int try_to_freeze_tasks(bool sig_
69382
69383 while (true) {
69384 todo = 0;
69385+ if (time_after(jiffies, end_time))
69386+ timedout = true;
69387 read_lock(&tasklist_lock);
69388 do_each_thread(g, p) {
69389 if (frozen(p) || !freezable(p))
69390@@ -71,9 +74,13 @@ static int try_to_freeze_tasks(bool sig_
69391 * try_to_stop() after schedule() in ptrace/signal
69392 * stop sees TIF_FREEZE.
69393 */
69394- if (!task_is_stopped_or_traced(p) &&
69395- !freezer_should_skip(p))
69396+ if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
69397 todo++;
69398+ if (timedout) {
69399+ printk(KERN_ERR "Task refusing to freeze:\n");
69400+ sched_show_task(p);
69401+ }
69402+ }
69403 } while_each_thread(g, p);
69404 read_unlock(&tasklist_lock);
69405
69406@@ -82,7 +89,7 @@ static int try_to_freeze_tasks(bool sig_
69407 todo += wq_busy;
69408 }
69409
69410- if (!todo || time_after(jiffies, end_time))
69411+ if (!todo || timedout)
69412 break;
69413
69414 if (pm_wakeup_pending()) {
69415diff -urNp linux-2.6.39.1/kernel/printk.c linux-2.6.39.1/kernel/printk.c
69416--- linux-2.6.39.1/kernel/printk.c 2011-05-19 00:06:34.000000000 -0400
69417+++ linux-2.6.39.1/kernel/printk.c 2011-05-22 19:41:42.000000000 -0400
69418@@ -284,12 +284,17 @@ static int check_syslog_permissions(int
69419 if (from_file && type != SYSLOG_ACTION_OPEN)
69420 return 0;
69421
69422+#ifdef CONFIG_GRKERNSEC_DMESG
69423+ if (grsec_enable_dmesg && !capable(CAP_SYSLOG) && !capable_nolog(CAP_SYS_ADMIN))
69424+ return -EPERM;
69425+#endif
69426+
69427 if (syslog_action_restricted(type)) {
69428 if (capable(CAP_SYSLOG))
69429 return 0;
69430 /* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */
69431 if (capable(CAP_SYS_ADMIN)) {
69432- WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
69433+ printk_once(KERN_WARNING "Attempt to access syslog with CAP_SYS_ADMIN "
69434 "but no CAP_SYSLOG (deprecated).\n");
69435 return 0;
69436 }
69437diff -urNp linux-2.6.39.1/kernel/profile.c linux-2.6.39.1/kernel/profile.c
69438--- linux-2.6.39.1/kernel/profile.c 2011-05-19 00:06:34.000000000 -0400
69439+++ linux-2.6.39.1/kernel/profile.c 2011-05-22 19:36:33.000000000 -0400
69440@@ -39,7 +39,7 @@ struct profile_hit {
69441 /* Oprofile timer tick hook */
69442 static int (*timer_hook)(struct pt_regs *) __read_mostly;
69443
69444-static atomic_t *prof_buffer;
69445+static atomic_unchecked_t *prof_buffer;
69446 static unsigned long prof_len, prof_shift;
69447
69448 int prof_on __read_mostly;
69449@@ -283,7 +283,7 @@ static void profile_flip_buffers(void)
69450 hits[i].pc = 0;
69451 continue;
69452 }
69453- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
69454+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
69455 hits[i].hits = hits[i].pc = 0;
69456 }
69457 }
69458@@ -346,9 +346,9 @@ void profile_hits(int type, void *__pc,
69459 * Add the current hit(s) and flush the write-queue out
69460 * to the global buffer:
69461 */
69462- atomic_add(nr_hits, &prof_buffer[pc]);
69463+ atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
69464 for (i = 0; i < NR_PROFILE_HIT; ++i) {
69465- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
69466+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
69467 hits[i].pc = hits[i].hits = 0;
69468 }
69469 out:
69470@@ -426,7 +426,7 @@ void profile_hits(int type, void *__pc,
69471 if (prof_on != type || !prof_buffer)
69472 return;
69473 pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
69474- atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
69475+ atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
69476 }
69477 #endif /* !CONFIG_SMP */
69478 EXPORT_SYMBOL_GPL(profile_hits);
69479@@ -517,7 +517,7 @@ read_profile(struct file *file, char __u
69480 return -EFAULT;
69481 buf++; p++; count--; read++;
69482 }
69483- pnt = (char *)prof_buffer + p - sizeof(atomic_t);
69484+ pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
69485 if (copy_to_user(buf, (void *)pnt, count))
69486 return -EFAULT;
69487 read += count;
69488@@ -548,7 +548,7 @@ static ssize_t write_profile(struct file
69489 }
69490 #endif
69491 profile_discard_flip_buffers();
69492- memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
69493+ memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
69494 return count;
69495 }
69496
69497diff -urNp linux-2.6.39.1/kernel/ptrace.c linux-2.6.39.1/kernel/ptrace.c
69498--- linux-2.6.39.1/kernel/ptrace.c 2011-05-19 00:06:34.000000000 -0400
69499+++ linux-2.6.39.1/kernel/ptrace.c 2011-05-23 17:07:00.000000000 -0400
69500@@ -117,7 +117,8 @@ int ptrace_check_attach(struct task_stru
69501 return ret;
69502 }
69503
69504-int __ptrace_may_access(struct task_struct *task, unsigned int mode)
69505+static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
69506+ unsigned int log)
69507 {
69508 const struct cred *cred = current_cred(), *tcred;
69509
69510@@ -143,7 +144,8 @@ int __ptrace_may_access(struct task_stru
69511 cred->gid == tcred->sgid &&
69512 cred->gid == tcred->gid))
69513 goto ok;
69514- if (ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE))
69515+ if ((!log && ns_capable_nolog(tcred->user->user_ns, CAP_SYS_PTRACE)) ||
69516+ (log && ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE)))
69517 goto ok;
69518 rcu_read_unlock();
69519 return -EPERM;
69520@@ -152,7 +154,9 @@ ok:
69521 smp_rmb();
69522 if (task->mm)
69523 dumpable = get_dumpable(task->mm);
69524- if (!dumpable && !task_ns_capable(task, CAP_SYS_PTRACE))
69525+ if (!dumpable &&
69526+ ((!log && !task_ns_capable_nolog(task, CAP_SYS_PTRACE)) ||
69527+ (log && !task_ns_capable(task, CAP_SYS_PTRACE))))
69528 return -EPERM;
69529
69530 return security_ptrace_access_check(task, mode);
69531@@ -162,7 +166,16 @@ bool ptrace_may_access(struct task_struc
69532 {
69533 int err;
69534 task_lock(task);
69535- err = __ptrace_may_access(task, mode);
69536+ err = __ptrace_may_access(task, mode, 0);
69537+ task_unlock(task);
69538+ return !err;
69539+}
69540+
69541+bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
69542+{
69543+ int err;
69544+ task_lock(task);
69545+ err = __ptrace_may_access(task, mode, 1);
69546 task_unlock(task);
69547 return !err;
69548 }
69549@@ -189,7 +202,7 @@ static int ptrace_attach(struct task_str
69550 goto out;
69551
69552 task_lock(task);
69553- retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
69554+ retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
69555 task_unlock(task);
69556 if (retval)
69557 goto unlock_creds;
69558@@ -202,7 +215,7 @@ static int ptrace_attach(struct task_str
69559 goto unlock_tasklist;
69560
69561 task->ptrace = PT_PTRACED;
69562- if (task_ns_capable(task, CAP_SYS_PTRACE))
69563+ if (task_ns_capable_nolog(task, CAP_SYS_PTRACE))
69564 task->ptrace |= PT_PTRACE_CAP;
69565
69566 __ptrace_link(task, current);
69567@@ -362,6 +375,8 @@ int ptrace_readdata(struct task_struct *
69568 {
69569 int copied = 0;
69570
69571+ pax_track_stack();
69572+
69573 while (len > 0) {
69574 char buf[128];
69575 int this_len, retval;
69576@@ -373,7 +388,7 @@ int ptrace_readdata(struct task_struct *
69577 break;
69578 return -EIO;
69579 }
69580- if (copy_to_user(dst, buf, retval))
69581+ if (retval > sizeof(buf) || copy_to_user(dst, buf, retval))
69582 return -EFAULT;
69583 copied += retval;
69584 src += retval;
69585@@ -387,6 +402,8 @@ int ptrace_writedata(struct task_struct
69586 {
69587 int copied = 0;
69588
69589+ pax_track_stack();
69590+
69591 while (len > 0) {
69592 char buf[128];
69593 int this_len, retval;
69594@@ -569,9 +586,11 @@ int ptrace_request(struct task_struct *c
69595 {
69596 int ret = -EIO;
69597 siginfo_t siginfo;
69598- void __user *datavp = (void __user *) data;
69599+ void __user *datavp = (__force void __user *) data;
69600 unsigned long __user *datalp = datavp;
69601
69602+ pax_track_stack();
69603+
69604 switch (request) {
69605 case PTRACE_PEEKTEXT:
69606 case PTRACE_PEEKDATA:
69607@@ -717,14 +736,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
69608 goto out;
69609 }
69610
69611+ if (gr_handle_ptrace(child, request)) {
69612+ ret = -EPERM;
69613+ goto out_put_task_struct;
69614+ }
69615+
69616 if (request == PTRACE_ATTACH) {
69617 ret = ptrace_attach(child);
69618 /*
69619 * Some architectures need to do book-keeping after
69620 * a ptrace attach.
69621 */
69622- if (!ret)
69623+ if (!ret) {
69624 arch_ptrace_attach(child);
69625+ gr_audit_ptrace(child);
69626+ }
69627 goto out_put_task_struct;
69628 }
69629
69630@@ -749,7 +775,7 @@ int generic_ptrace_peekdata(struct task_
69631 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
69632 if (copied != sizeof(tmp))
69633 return -EIO;
69634- return put_user(tmp, (unsigned long __user *)data);
69635+ return put_user(tmp, (__force unsigned long __user *)data);
69636 }
69637
69638 int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
69639@@ -772,6 +798,8 @@ int compat_ptrace_request(struct task_st
69640 siginfo_t siginfo;
69641 int ret;
69642
69643+ pax_track_stack();
69644+
69645 switch (request) {
69646 case PTRACE_PEEKTEXT:
69647 case PTRACE_PEEKDATA:
69648@@ -859,14 +887,21 @@ asmlinkage long compat_sys_ptrace(compat
69649 goto out;
69650 }
69651
69652+ if (gr_handle_ptrace(child, request)) {
69653+ ret = -EPERM;
69654+ goto out_put_task_struct;
69655+ }
69656+
69657 if (request == PTRACE_ATTACH) {
69658 ret = ptrace_attach(child);
69659 /*
69660 * Some architectures need to do book-keeping after
69661 * a ptrace attach.
69662 */
69663- if (!ret)
69664+ if (!ret) {
69665 arch_ptrace_attach(child);
69666+ gr_audit_ptrace(child);
69667+ }
69668 goto out_put_task_struct;
69669 }
69670
69671diff -urNp linux-2.6.39.1/kernel/rcutorture.c linux-2.6.39.1/kernel/rcutorture.c
69672--- linux-2.6.39.1/kernel/rcutorture.c 2011-05-19 00:06:34.000000000 -0400
69673+++ linux-2.6.39.1/kernel/rcutorture.c 2011-05-22 19:36:33.000000000 -0400
69674@@ -138,12 +138,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_
69675 { 0 };
69676 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
69677 { 0 };
69678-static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
69679-static atomic_t n_rcu_torture_alloc;
69680-static atomic_t n_rcu_torture_alloc_fail;
69681-static atomic_t n_rcu_torture_free;
69682-static atomic_t n_rcu_torture_mberror;
69683-static atomic_t n_rcu_torture_error;
69684+static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
69685+static atomic_unchecked_t n_rcu_torture_alloc;
69686+static atomic_unchecked_t n_rcu_torture_alloc_fail;
69687+static atomic_unchecked_t n_rcu_torture_free;
69688+static atomic_unchecked_t n_rcu_torture_mberror;
69689+static atomic_unchecked_t n_rcu_torture_error;
69690 static long n_rcu_torture_boost_ktrerror;
69691 static long n_rcu_torture_boost_rterror;
69692 static long n_rcu_torture_boost_allocerror;
69693@@ -225,11 +225,11 @@ rcu_torture_alloc(void)
69694
69695 spin_lock_bh(&rcu_torture_lock);
69696 if (list_empty(&rcu_torture_freelist)) {
69697- atomic_inc(&n_rcu_torture_alloc_fail);
69698+ atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
69699 spin_unlock_bh(&rcu_torture_lock);
69700 return NULL;
69701 }
69702- atomic_inc(&n_rcu_torture_alloc);
69703+ atomic_inc_unchecked(&n_rcu_torture_alloc);
69704 p = rcu_torture_freelist.next;
69705 list_del_init(p);
69706 spin_unlock_bh(&rcu_torture_lock);
69707@@ -242,7 +242,7 @@ rcu_torture_alloc(void)
69708 static void
69709 rcu_torture_free(struct rcu_torture *p)
69710 {
69711- atomic_inc(&n_rcu_torture_free);
69712+ atomic_inc_unchecked(&n_rcu_torture_free);
69713 spin_lock_bh(&rcu_torture_lock);
69714 list_add_tail(&p->rtort_free, &rcu_torture_freelist);
69715 spin_unlock_bh(&rcu_torture_lock);
69716@@ -362,7 +362,7 @@ rcu_torture_cb(struct rcu_head *p)
69717 i = rp->rtort_pipe_count;
69718 if (i > RCU_TORTURE_PIPE_LEN)
69719 i = RCU_TORTURE_PIPE_LEN;
69720- atomic_inc(&rcu_torture_wcount[i]);
69721+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
69722 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
69723 rp->rtort_mbtest = 0;
69724 rcu_torture_free(rp);
69725@@ -409,7 +409,7 @@ static void rcu_sync_torture_deferred_fr
69726 i = rp->rtort_pipe_count;
69727 if (i > RCU_TORTURE_PIPE_LEN)
69728 i = RCU_TORTURE_PIPE_LEN;
69729- atomic_inc(&rcu_torture_wcount[i]);
69730+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
69731 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
69732 rp->rtort_mbtest = 0;
69733 list_del(&rp->rtort_free);
69734@@ -882,7 +882,7 @@ rcu_torture_writer(void *arg)
69735 i = old_rp->rtort_pipe_count;
69736 if (i > RCU_TORTURE_PIPE_LEN)
69737 i = RCU_TORTURE_PIPE_LEN;
69738- atomic_inc(&rcu_torture_wcount[i]);
69739+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
69740 old_rp->rtort_pipe_count++;
69741 cur_ops->deferred_free(old_rp);
69742 }
69743@@ -951,7 +951,7 @@ static void rcu_torture_timer(unsigned l
69744 return;
69745 }
69746 if (p->rtort_mbtest == 0)
69747- atomic_inc(&n_rcu_torture_mberror);
69748+ atomic_inc_unchecked(&n_rcu_torture_mberror);
69749 spin_lock(&rand_lock);
69750 cur_ops->read_delay(&rand);
69751 n_rcu_torture_timers++;
69752@@ -1013,7 +1013,7 @@ rcu_torture_reader(void *arg)
69753 continue;
69754 }
69755 if (p->rtort_mbtest == 0)
69756- atomic_inc(&n_rcu_torture_mberror);
69757+ atomic_inc_unchecked(&n_rcu_torture_mberror);
69758 cur_ops->read_delay(&rand);
69759 preempt_disable();
69760 pipe_count = p->rtort_pipe_count;
69761@@ -1072,10 +1072,10 @@ rcu_torture_printk(char *page)
69762 rcu_torture_current,
69763 rcu_torture_current_version,
69764 list_empty(&rcu_torture_freelist),
69765- atomic_read(&n_rcu_torture_alloc),
69766- atomic_read(&n_rcu_torture_alloc_fail),
69767- atomic_read(&n_rcu_torture_free),
69768- atomic_read(&n_rcu_torture_mberror),
69769+ atomic_read_unchecked(&n_rcu_torture_alloc),
69770+ atomic_read_unchecked(&n_rcu_torture_alloc_fail),
69771+ atomic_read_unchecked(&n_rcu_torture_free),
69772+ atomic_read_unchecked(&n_rcu_torture_mberror),
69773 n_rcu_torture_boost_ktrerror,
69774 n_rcu_torture_boost_rterror,
69775 n_rcu_torture_boost_allocerror,
69776@@ -1083,7 +1083,7 @@ rcu_torture_printk(char *page)
69777 n_rcu_torture_boost_failure,
69778 n_rcu_torture_boosts,
69779 n_rcu_torture_timers);
69780- if (atomic_read(&n_rcu_torture_mberror) != 0 ||
69781+ if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0 ||
69782 n_rcu_torture_boost_ktrerror != 0 ||
69783 n_rcu_torture_boost_rterror != 0 ||
69784 n_rcu_torture_boost_allocerror != 0 ||
69785@@ -1093,7 +1093,7 @@ rcu_torture_printk(char *page)
69786 cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
69787 if (i > 1) {
69788 cnt += sprintf(&page[cnt], "!!! ");
69789- atomic_inc(&n_rcu_torture_error);
69790+ atomic_inc_unchecked(&n_rcu_torture_error);
69791 WARN_ON_ONCE(1);
69792 }
69793 cnt += sprintf(&page[cnt], "Reader Pipe: ");
69794@@ -1107,7 +1107,7 @@ rcu_torture_printk(char *page)
69795 cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
69796 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
69797 cnt += sprintf(&page[cnt], " %d",
69798- atomic_read(&rcu_torture_wcount[i]));
69799+ atomic_read_unchecked(&rcu_torture_wcount[i]));
69800 }
69801 cnt += sprintf(&page[cnt], "\n");
69802 if (cur_ops->stats)
69803@@ -1415,7 +1415,7 @@ rcu_torture_cleanup(void)
69804
69805 if (cur_ops->cleanup)
69806 cur_ops->cleanup();
69807- if (atomic_read(&n_rcu_torture_error))
69808+ if (atomic_read_unchecked(&n_rcu_torture_error))
69809 rcu_torture_print_module_parms(cur_ops, "End of test: FAILURE");
69810 else
69811 rcu_torture_print_module_parms(cur_ops, "End of test: SUCCESS");
69812@@ -1479,11 +1479,11 @@ rcu_torture_init(void)
69813
69814 rcu_torture_current = NULL;
69815 rcu_torture_current_version = 0;
69816- atomic_set(&n_rcu_torture_alloc, 0);
69817- atomic_set(&n_rcu_torture_alloc_fail, 0);
69818- atomic_set(&n_rcu_torture_free, 0);
69819- atomic_set(&n_rcu_torture_mberror, 0);
69820- atomic_set(&n_rcu_torture_error, 0);
69821+ atomic_set_unchecked(&n_rcu_torture_alloc, 0);
69822+ atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
69823+ atomic_set_unchecked(&n_rcu_torture_free, 0);
69824+ atomic_set_unchecked(&n_rcu_torture_mberror, 0);
69825+ atomic_set_unchecked(&n_rcu_torture_error, 0);
69826 n_rcu_torture_boost_ktrerror = 0;
69827 n_rcu_torture_boost_rterror = 0;
69828 n_rcu_torture_boost_allocerror = 0;
69829@@ -1491,7 +1491,7 @@ rcu_torture_init(void)
69830 n_rcu_torture_boost_failure = 0;
69831 n_rcu_torture_boosts = 0;
69832 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
69833- atomic_set(&rcu_torture_wcount[i], 0);
69834+ atomic_set_unchecked(&rcu_torture_wcount[i], 0);
69835 for_each_possible_cpu(cpu) {
69836 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
69837 per_cpu(rcu_torture_count, cpu)[i] = 0;
69838diff -urNp linux-2.6.39.1/kernel/rcutree.c linux-2.6.39.1/kernel/rcutree.c
69839--- linux-2.6.39.1/kernel/rcutree.c 2011-05-19 00:06:34.000000000 -0400
69840+++ linux-2.6.39.1/kernel/rcutree.c 2011-05-22 19:36:33.000000000 -0400
69841@@ -1389,7 +1389,7 @@ __rcu_process_callbacks(struct rcu_state
69842 /*
69843 * Do softirq processing for the current CPU.
69844 */
69845-static void rcu_process_callbacks(struct softirq_action *unused)
69846+static void rcu_process_callbacks(void)
69847 {
69848 /*
69849 * Memory references from any prior RCU read-side critical sections
69850diff -urNp linux-2.6.39.1/kernel/rcutree_plugin.h linux-2.6.39.1/kernel/rcutree_plugin.h
69851--- linux-2.6.39.1/kernel/rcutree_plugin.h 2011-05-19 00:06:34.000000000 -0400
69852+++ linux-2.6.39.1/kernel/rcutree_plugin.h 2011-05-22 19:36:33.000000000 -0400
69853@@ -730,7 +730,7 @@ void synchronize_rcu_expedited(void)
69854
69855 /* Clean up and exit. */
69856 smp_mb(); /* ensure expedited GP seen before counter increment. */
69857- ACCESS_ONCE(sync_rcu_preempt_exp_count)++;
69858+ ACCESS_ONCE_RW(sync_rcu_preempt_exp_count)++;
69859 unlock_mb_ret:
69860 mutex_unlock(&sync_rcu_preempt_exp_mutex);
69861 mb_ret:
69862@@ -1025,8 +1025,8 @@ EXPORT_SYMBOL_GPL(synchronize_sched_expe
69863
69864 #else /* #ifndef CONFIG_SMP */
69865
69866-static atomic_t sync_sched_expedited_started = ATOMIC_INIT(0);
69867-static atomic_t sync_sched_expedited_done = ATOMIC_INIT(0);
69868+static atomic_unchecked_t sync_sched_expedited_started = ATOMIC_INIT(0);
69869+static atomic_unchecked_t sync_sched_expedited_done = ATOMIC_INIT(0);
69870
69871 static int synchronize_sched_expedited_cpu_stop(void *data)
69872 {
69873@@ -1081,7 +1081,7 @@ void synchronize_sched_expedited(void)
69874 int firstsnap, s, snap, trycount = 0;
69875
69876 /* Note that atomic_inc_return() implies full memory barrier. */
69877- firstsnap = snap = atomic_inc_return(&sync_sched_expedited_started);
69878+ firstsnap = snap = atomic_inc_return_unchecked(&sync_sched_expedited_started);
69879 get_online_cpus();
69880
69881 /*
69882@@ -1102,7 +1102,7 @@ void synchronize_sched_expedited(void)
69883 }
69884
69885 /* Check to see if someone else did our work for us. */
69886- s = atomic_read(&sync_sched_expedited_done);
69887+ s = atomic_read_unchecked(&sync_sched_expedited_done);
69888 if (UINT_CMP_GE((unsigned)s, (unsigned)firstsnap)) {
69889 smp_mb(); /* ensure test happens before caller kfree */
69890 return;
69891@@ -1117,7 +1117,7 @@ void synchronize_sched_expedited(void)
69892 * grace period works for us.
69893 */
69894 get_online_cpus();
69895- snap = atomic_read(&sync_sched_expedited_started) - 1;
69896+ snap = atomic_read_unchecked(&sync_sched_expedited_started) - 1;
69897 smp_mb(); /* ensure read is before try_stop_cpus(). */
69898 }
69899
69900@@ -1128,12 +1128,12 @@ void synchronize_sched_expedited(void)
69901 * than we did beat us to the punch.
69902 */
69903 do {
69904- s = atomic_read(&sync_sched_expedited_done);
69905+ s = atomic_read_unchecked(&sync_sched_expedited_done);
69906 if (UINT_CMP_GE((unsigned)s, (unsigned)snap)) {
69907 smp_mb(); /* ensure test happens before caller kfree */
69908 break;
69909 }
69910- } while (atomic_cmpxchg(&sync_sched_expedited_done, s, snap) != s);
69911+ } while (atomic_cmpxchg_unchecked(&sync_sched_expedited_done, s, snap) != s);
69912
69913 put_online_cpus();
69914 }
69915diff -urNp linux-2.6.39.1/kernel/relay.c linux-2.6.39.1/kernel/relay.c
69916--- linux-2.6.39.1/kernel/relay.c 2011-05-19 00:06:34.000000000 -0400
69917+++ linux-2.6.39.1/kernel/relay.c 2011-05-22 19:36:33.000000000 -0400
69918@@ -1236,6 +1236,8 @@ static ssize_t subbuf_splice_actor(struc
69919 };
69920 ssize_t ret;
69921
69922+ pax_track_stack();
69923+
69924 if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
69925 return 0;
69926 if (splice_grow_spd(pipe, &spd))
69927diff -urNp linux-2.6.39.1/kernel/resource.c linux-2.6.39.1/kernel/resource.c
69928--- linux-2.6.39.1/kernel/resource.c 2011-05-19 00:06:34.000000000 -0400
69929+++ linux-2.6.39.1/kernel/resource.c 2011-05-22 19:41:42.000000000 -0400
69930@@ -133,8 +133,18 @@ static const struct file_operations proc
69931
69932 static int __init ioresources_init(void)
69933 {
69934+#ifdef CONFIG_GRKERNSEC_PROC_ADD
69935+#ifdef CONFIG_GRKERNSEC_PROC_USER
69936+ proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
69937+ proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
69938+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
69939+ proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
69940+ proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
69941+#endif
69942+#else
69943 proc_create("ioports", 0, NULL, &proc_ioports_operations);
69944 proc_create("iomem", 0, NULL, &proc_iomem_operations);
69945+#endif
69946 return 0;
69947 }
69948 __initcall(ioresources_init);
69949diff -urNp linux-2.6.39.1/kernel/rtmutex-tester.c linux-2.6.39.1/kernel/rtmutex-tester.c
69950--- linux-2.6.39.1/kernel/rtmutex-tester.c 2011-05-19 00:06:34.000000000 -0400
69951+++ linux-2.6.39.1/kernel/rtmutex-tester.c 2011-05-22 19:36:33.000000000 -0400
69952@@ -20,7 +20,7 @@
69953 #define MAX_RT_TEST_MUTEXES 8
69954
69955 static spinlock_t rttest_lock;
69956-static atomic_t rttest_event;
69957+static atomic_unchecked_t rttest_event;
69958
69959 struct test_thread_data {
69960 int opcode;
69961@@ -61,7 +61,7 @@ static int handle_op(struct test_thread_
69962
69963 case RTTEST_LOCKCONT:
69964 td->mutexes[td->opdata] = 1;
69965- td->event = atomic_add_return(1, &rttest_event);
69966+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69967 return 0;
69968
69969 case RTTEST_RESET:
69970@@ -74,7 +74,7 @@ static int handle_op(struct test_thread_
69971 return 0;
69972
69973 case RTTEST_RESETEVENT:
69974- atomic_set(&rttest_event, 0);
69975+ atomic_set_unchecked(&rttest_event, 0);
69976 return 0;
69977
69978 default:
69979@@ -91,9 +91,9 @@ static int handle_op(struct test_thread_
69980 return ret;
69981
69982 td->mutexes[id] = 1;
69983- td->event = atomic_add_return(1, &rttest_event);
69984+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69985 rt_mutex_lock(&mutexes[id]);
69986- td->event = atomic_add_return(1, &rttest_event);
69987+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69988 td->mutexes[id] = 4;
69989 return 0;
69990
69991@@ -104,9 +104,9 @@ static int handle_op(struct test_thread_
69992 return ret;
69993
69994 td->mutexes[id] = 1;
69995- td->event = atomic_add_return(1, &rttest_event);
69996+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69997 ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
69998- td->event = atomic_add_return(1, &rttest_event);
69999+ td->event = atomic_add_return_unchecked(1, &rttest_event);
70000 td->mutexes[id] = ret ? 0 : 4;
70001 return ret ? -EINTR : 0;
70002
70003@@ -115,9 +115,9 @@ static int handle_op(struct test_thread_
70004 if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
70005 return ret;
70006
70007- td->event = atomic_add_return(1, &rttest_event);
70008+ td->event = atomic_add_return_unchecked(1, &rttest_event);
70009 rt_mutex_unlock(&mutexes[id]);
70010- td->event = atomic_add_return(1, &rttest_event);
70011+ td->event = atomic_add_return_unchecked(1, &rttest_event);
70012 td->mutexes[id] = 0;
70013 return 0;
70014
70015@@ -164,7 +164,7 @@ void schedule_rt_mutex_test(struct rt_mu
70016 break;
70017
70018 td->mutexes[dat] = 2;
70019- td->event = atomic_add_return(1, &rttest_event);
70020+ td->event = atomic_add_return_unchecked(1, &rttest_event);
70021 break;
70022
70023 default:
70024@@ -184,7 +184,7 @@ void schedule_rt_mutex_test(struct rt_mu
70025 return;
70026
70027 td->mutexes[dat] = 3;
70028- td->event = atomic_add_return(1, &rttest_event);
70029+ td->event = atomic_add_return_unchecked(1, &rttest_event);
70030 break;
70031
70032 case RTTEST_LOCKNOWAIT:
70033@@ -196,7 +196,7 @@ void schedule_rt_mutex_test(struct rt_mu
70034 return;
70035
70036 td->mutexes[dat] = 1;
70037- td->event = atomic_add_return(1, &rttest_event);
70038+ td->event = atomic_add_return_unchecked(1, &rttest_event);
70039 return;
70040
70041 default:
70042diff -urNp linux-2.6.39.1/kernel/sched_autogroup.c linux-2.6.39.1/kernel/sched_autogroup.c
70043--- linux-2.6.39.1/kernel/sched_autogroup.c 2011-05-19 00:06:34.000000000 -0400
70044+++ linux-2.6.39.1/kernel/sched_autogroup.c 2011-05-22 19:36:33.000000000 -0400
70045@@ -7,7 +7,7 @@
70046
70047 unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
70048 static struct autogroup autogroup_default;
70049-static atomic_t autogroup_seq_nr;
70050+static atomic_unchecked_t autogroup_seq_nr;
70051
70052 static void __init autogroup_init(struct task_struct *init_task)
70053 {
70054@@ -78,7 +78,7 @@ static inline struct autogroup *autogrou
70055
70056 kref_init(&ag->kref);
70057 init_rwsem(&ag->lock);
70058- ag->id = atomic_inc_return(&autogroup_seq_nr);
70059+ ag->id = atomic_inc_return_unchecked(&autogroup_seq_nr);
70060 ag->tg = tg;
70061 #ifdef CONFIG_RT_GROUP_SCHED
70062 /*
70063diff -urNp linux-2.6.39.1/kernel/sched.c linux-2.6.39.1/kernel/sched.c
70064--- linux-2.6.39.1/kernel/sched.c 2011-05-19 00:06:34.000000000 -0400
70065+++ linux-2.6.39.1/kernel/sched.c 2011-05-23 17:07:00.000000000 -0400
70066@@ -4078,6 +4078,8 @@ asmlinkage void __sched schedule(void)
70067 struct rq *rq;
70068 int cpu;
70069
70070+ pax_track_stack();
70071+
70072 need_resched:
70073 preempt_disable();
70074 cpu = smp_processor_id();
70075@@ -4165,7 +4167,7 @@ EXPORT_SYMBOL(schedule);
70076 * Look out! "owner" is an entirely speculative pointer
70077 * access and not reliable.
70078 */
70079-int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
70080+int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner)
70081 {
70082 unsigned int cpu;
70083 struct rq *rq;
70084@@ -4179,10 +4181,10 @@ int mutex_spin_on_owner(struct mutex *lo
70085 * DEBUG_PAGEALLOC could have unmapped it if
70086 * the mutex owner just released it and exited.
70087 */
70088- if (probe_kernel_address(&owner->cpu, cpu))
70089+ if (probe_kernel_address(&task_thread_info(owner)->cpu, cpu))
70090 return 0;
70091 #else
70092- cpu = owner->cpu;
70093+ cpu = task_thread_info(owner)->cpu;
70094 #endif
70095
70096 /*
70097@@ -4219,7 +4221,7 @@ int mutex_spin_on_owner(struct mutex *lo
70098 /*
70099 * Is that owner really running on that cpu?
70100 */
70101- if (task_thread_info(rq->curr) != owner || need_resched())
70102+ if (rq->curr != owner || need_resched())
70103 return 0;
70104
70105 arch_mutex_cpu_relax();
70106@@ -4778,6 +4780,8 @@ int can_nice(const struct task_struct *p
70107 /* convert nice value [19,-20] to rlimit style value [1,40] */
70108 int nice_rlim = 20 - nice;
70109
70110+ gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
70111+
70112 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
70113 capable(CAP_SYS_NICE));
70114 }
70115@@ -4811,7 +4815,8 @@ SYSCALL_DEFINE1(nice, int, increment)
70116 if (nice > 19)
70117 nice = 19;
70118
70119- if (increment < 0 && !can_nice(current, nice))
70120+ if (increment < 0 && (!can_nice(current, nice) ||
70121+ gr_handle_chroot_nice()))
70122 return -EPERM;
70123
70124 retval = security_task_setnice(current, nice);
70125@@ -4957,6 +4962,7 @@ recheck:
70126 unsigned long rlim_rtprio =
70127 task_rlimit(p, RLIMIT_RTPRIO);
70128
70129+ gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
70130 /* can't set/change the rt policy */
70131 if (policy != p->policy && !rlim_rtprio)
70132 return -EPERM;
70133@@ -7164,7 +7170,7 @@ static void init_sched_groups_power(int
70134 long power;
70135 int weight;
70136
70137- WARN_ON(!sd || !sd->groups);
70138+ BUG_ON(!sd || !sd->groups);
70139
70140 if (cpu != group_first_cpu(sd->groups))
70141 return;
70142diff -urNp linux-2.6.39.1/kernel/sched_fair.c linux-2.6.39.1/kernel/sched_fair.c
70143--- linux-2.6.39.1/kernel/sched_fair.c 2011-05-19 00:06:34.000000000 -0400
70144+++ linux-2.6.39.1/kernel/sched_fair.c 2011-05-22 19:36:33.000000000 -0400
70145@@ -3999,7 +3999,7 @@ static void nohz_idle_balance(int this_c
70146 * run_rebalance_domains is triggered when needed from the scheduler tick.
70147 * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
70148 */
70149-static void run_rebalance_domains(struct softirq_action *h)
70150+static void run_rebalance_domains(void)
70151 {
70152 int this_cpu = smp_processor_id();
70153 struct rq *this_rq = cpu_rq(this_cpu);
70154diff -urNp linux-2.6.39.1/kernel/signal.c linux-2.6.39.1/kernel/signal.c
70155--- linux-2.6.39.1/kernel/signal.c 2011-05-19 00:06:34.000000000 -0400
70156+++ linux-2.6.39.1/kernel/signal.c 2011-05-23 17:07:00.000000000 -0400
70157@@ -45,12 +45,12 @@ static struct kmem_cache *sigqueue_cache
70158
70159 int print_fatal_signals __read_mostly;
70160
70161-static void __user *sig_handler(struct task_struct *t, int sig)
70162+static __sighandler_t sig_handler(struct task_struct *t, int sig)
70163 {
70164 return t->sighand->action[sig - 1].sa.sa_handler;
70165 }
70166
70167-static int sig_handler_ignored(void __user *handler, int sig)
70168+static int sig_handler_ignored(__sighandler_t handler, int sig)
70169 {
70170 /* Is it explicitly or implicitly ignored? */
70171 return handler == SIG_IGN ||
70172@@ -60,7 +60,7 @@ static int sig_handler_ignored(void __us
70173 static int sig_task_ignored(struct task_struct *t, int sig,
70174 int from_ancestor_ns)
70175 {
70176- void __user *handler;
70177+ __sighandler_t handler;
70178
70179 handler = sig_handler(t, sig);
70180
70181@@ -243,6 +243,9 @@ __sigqueue_alloc(int sig, struct task_st
70182 atomic_inc(&user->sigpending);
70183 rcu_read_unlock();
70184
70185+ if (!override_rlimit)
70186+ gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
70187+
70188 if (override_rlimit ||
70189 atomic_read(&user->sigpending) <=
70190 task_rlimit(t, RLIMIT_SIGPENDING)) {
70191@@ -367,7 +370,7 @@ flush_signal_handlers(struct task_struct
70192
70193 int unhandled_signal(struct task_struct *tsk, int sig)
70194 {
70195- void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
70196+ __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
70197 if (is_global_init(tsk))
70198 return 1;
70199 if (handler != SIG_IGN && handler != SIG_DFL)
70200@@ -693,6 +696,9 @@ static int check_kill_permission(int sig
70201 }
70202 }
70203
70204+ if (gr_handle_signal(t, sig))
70205+ return -EPERM;
70206+
70207 return security_task_kill(t, info, sig, 0);
70208 }
70209
70210@@ -1041,7 +1047,7 @@ __group_send_sig_info(int sig, struct si
70211 return send_signal(sig, info, p, 1);
70212 }
70213
70214-static int
70215+int
70216 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
70217 {
70218 return send_signal(sig, info, t, 0);
70219@@ -1078,6 +1084,7 @@ force_sig_info(int sig, struct siginfo *
70220 unsigned long int flags;
70221 int ret, blocked, ignored;
70222 struct k_sigaction *action;
70223+ int is_unhandled = 0;
70224
70225 spin_lock_irqsave(&t->sighand->siglock, flags);
70226 action = &t->sighand->action[sig-1];
70227@@ -1092,9 +1099,18 @@ force_sig_info(int sig, struct siginfo *
70228 }
70229 if (action->sa.sa_handler == SIG_DFL)
70230 t->signal->flags &= ~SIGNAL_UNKILLABLE;
70231+ if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
70232+ is_unhandled = 1;
70233 ret = specific_send_sig_info(sig, info, t);
70234 spin_unlock_irqrestore(&t->sighand->siglock, flags);
70235
70236+ /* only deal with unhandled signals, java etc trigger SIGSEGV during
70237+ normal operation */
70238+ if (is_unhandled) {
70239+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
70240+ gr_handle_crash(t, sig);
70241+ }
70242+
70243 return ret;
70244 }
70245
70246@@ -1153,8 +1169,11 @@ int group_send_sig_info(int sig, struct
70247 ret = check_kill_permission(sig, info, p);
70248 rcu_read_unlock();
70249
70250- if (!ret && sig)
70251+ if (!ret && sig) {
70252 ret = do_send_sig_info(sig, info, p, true);
70253+ if (!ret)
70254+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
70255+ }
70256
70257 return ret;
70258 }
70259@@ -1718,6 +1737,8 @@ void ptrace_notify(int exit_code)
70260 {
70261 siginfo_t info;
70262
70263+ pax_track_stack();
70264+
70265 BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
70266
70267 memset(&info, 0, sizeof info);
70268diff -urNp linux-2.6.39.1/kernel/smp.c linux-2.6.39.1/kernel/smp.c
70269--- linux-2.6.39.1/kernel/smp.c 2011-05-19 00:06:34.000000000 -0400
70270+++ linux-2.6.39.1/kernel/smp.c 2011-05-22 19:36:33.000000000 -0400
70271@@ -583,22 +583,22 @@ int smp_call_function(smp_call_func_t fu
70272 }
70273 EXPORT_SYMBOL(smp_call_function);
70274
70275-void ipi_call_lock(void)
70276+void ipi_call_lock(void) __acquires(call_function.lock)
70277 {
70278 raw_spin_lock(&call_function.lock);
70279 }
70280
70281-void ipi_call_unlock(void)
70282+void ipi_call_unlock(void) __releases(call_function.lock)
70283 {
70284 raw_spin_unlock(&call_function.lock);
70285 }
70286
70287-void ipi_call_lock_irq(void)
70288+void ipi_call_lock_irq(void) __acquires(call_function.lock)
70289 {
70290 raw_spin_lock_irq(&call_function.lock);
70291 }
70292
70293-void ipi_call_unlock_irq(void)
70294+void ipi_call_unlock_irq(void) __releases(call_function.lock)
70295 {
70296 raw_spin_unlock_irq(&call_function.lock);
70297 }
70298diff -urNp linux-2.6.39.1/kernel/softirq.c linux-2.6.39.1/kernel/softirq.c
70299--- linux-2.6.39.1/kernel/softirq.c 2011-05-19 00:06:34.000000000 -0400
70300+++ linux-2.6.39.1/kernel/softirq.c 2011-05-22 19:36:33.000000000 -0400
70301@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
70302
70303 DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
70304
70305-char *softirq_to_name[NR_SOFTIRQS] = {
70306+const char * const softirq_to_name[NR_SOFTIRQS] = {
70307 "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
70308 "TASKLET", "SCHED", "HRTIMER", "RCU"
70309 };
70310@@ -206,7 +206,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
70311
70312 asmlinkage void __do_softirq(void)
70313 {
70314- struct softirq_action *h;
70315+ const struct softirq_action *h;
70316 __u32 pending;
70317 int max_restart = MAX_SOFTIRQ_RESTART;
70318 int cpu;
70319@@ -235,7 +235,7 @@ restart:
70320 kstat_incr_softirqs_this_cpu(vec_nr);
70321
70322 trace_softirq_entry(vec_nr);
70323- h->action(h);
70324+ h->action();
70325 trace_softirq_exit(vec_nr);
70326 if (unlikely(prev_count != preempt_count())) {
70327 printk(KERN_ERR "huh, entered softirq %u %s %p"
70328@@ -377,7 +377,7 @@ void raise_softirq(unsigned int nr)
70329 local_irq_restore(flags);
70330 }
70331
70332-void open_softirq(int nr, void (*action)(struct softirq_action *))
70333+void open_softirq(int nr, void (*action)(void))
70334 {
70335 softirq_vec[nr].action = action;
70336 }
70337@@ -433,7 +433,7 @@ void __tasklet_hi_schedule_first(struct
70338
70339 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
70340
70341-static void tasklet_action(struct softirq_action *a)
70342+static void tasklet_action(void)
70343 {
70344 struct tasklet_struct *list;
70345
70346@@ -468,7 +468,7 @@ static void tasklet_action(struct softir
70347 }
70348 }
70349
70350-static void tasklet_hi_action(struct softirq_action *a)
70351+static void tasklet_hi_action(void)
70352 {
70353 struct tasklet_struct *list;
70354
70355diff -urNp linux-2.6.39.1/kernel/sys.c linux-2.6.39.1/kernel/sys.c
70356--- linux-2.6.39.1/kernel/sys.c 2011-05-19 00:06:34.000000000 -0400
70357+++ linux-2.6.39.1/kernel/sys.c 2011-05-22 21:08:10.000000000 -0400
70358@@ -154,6 +154,12 @@ static int set_one_prio(struct task_stru
70359 error = -EACCES;
70360 goto out;
70361 }
70362+
70363+ if (gr_handle_chroot_setpriority(p, niceval)) {
70364+ error = -EACCES;
70365+ goto out;
70366+ }
70367+
70368 no_nice = security_task_setnice(p, niceval);
70369 if (no_nice) {
70370 error = no_nice;
70371@@ -538,6 +544,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
70372 goto error;
70373 }
70374
70375+ if (gr_check_group_change(new->gid, new->egid, -1))
70376+ goto error;
70377+
70378 if (rgid != (gid_t) -1 ||
70379 (egid != (gid_t) -1 && egid != old->gid))
70380 new->sgid = new->egid;
70381@@ -567,6 +576,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
70382 old = current_cred();
70383
70384 retval = -EPERM;
70385+
70386+ if (gr_check_group_change(gid, gid, gid))
70387+ goto error;
70388+
70389 if (nsown_capable(CAP_SETGID))
70390 new->gid = new->egid = new->sgid = new->fsgid = gid;
70391 else if (gid == old->gid || gid == old->sgid)
70392@@ -647,6 +660,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
70393 goto error;
70394 }
70395
70396+ if (gr_check_user_change(new->uid, new->euid, -1))
70397+ goto error;
70398+
70399 if (new->uid != old->uid) {
70400 retval = set_user(new);
70401 if (retval < 0)
70402@@ -691,6 +707,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
70403 old = current_cred();
70404
70405 retval = -EPERM;
70406+
70407+ if (gr_check_crash_uid(uid))
70408+ goto error;
70409+ if (gr_check_user_change(uid, uid, uid))
70410+ goto error;
70411+
70412 if (nsown_capable(CAP_SETUID)) {
70413 new->suid = new->uid = uid;
70414 if (uid != old->uid) {
70415@@ -745,6 +767,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid,
70416 goto error;
70417 }
70418
70419+ if (gr_check_user_change(ruid, euid, -1))
70420+ goto error;
70421+
70422 if (ruid != (uid_t) -1) {
70423 new->uid = ruid;
70424 if (ruid != old->uid) {
70425@@ -809,6 +834,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid,
70426 goto error;
70427 }
70428
70429+ if (gr_check_group_change(rgid, egid, -1))
70430+ goto error;
70431+
70432 if (rgid != (gid_t) -1)
70433 new->gid = rgid;
70434 if (egid != (gid_t) -1)
70435@@ -855,6 +883,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
70436 old = current_cred();
70437 old_fsuid = old->fsuid;
70438
70439+ if (gr_check_user_change(-1, -1, uid))
70440+ goto error;
70441+
70442 if (uid == old->uid || uid == old->euid ||
70443 uid == old->suid || uid == old->fsuid ||
70444 nsown_capable(CAP_SETUID)) {
70445@@ -865,6 +896,7 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
70446 }
70447 }
70448
70449+error:
70450 abort_creds(new);
70451 return old_fsuid;
70452
70453@@ -891,12 +923,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
70454 if (gid == old->gid || gid == old->egid ||
70455 gid == old->sgid || gid == old->fsgid ||
70456 nsown_capable(CAP_SETGID)) {
70457+ if (gr_check_group_change(-1, -1, gid))
70458+ goto error;
70459+
70460 if (gid != old_fsgid) {
70461 new->fsgid = gid;
70462 goto change_okay;
70463 }
70464 }
70465
70466+error:
70467 abort_creds(new);
70468 return old_fsgid;
70469
70470@@ -1643,7 +1679,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
70471 error = get_dumpable(me->mm);
70472 break;
70473 case PR_SET_DUMPABLE:
70474- if (arg2 < 0 || arg2 > 1) {
70475+ if (arg2 > 1) {
70476 error = -EINVAL;
70477 break;
70478 }
70479diff -urNp linux-2.6.39.1/kernel/sysctl.c linux-2.6.39.1/kernel/sysctl.c
70480--- linux-2.6.39.1/kernel/sysctl.c 2011-05-19 00:06:34.000000000 -0400
70481+++ linux-2.6.39.1/kernel/sysctl.c 2011-05-22 20:23:10.000000000 -0400
70482@@ -84,6 +84,13 @@
70483
70484
70485 #if defined(CONFIG_SYSCTL)
70486+#include <linux/grsecurity.h>
70487+#include <linux/grinternal.h>
70488+
70489+extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
70490+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
70491+ const int op);
70492+extern int gr_handle_chroot_sysctl(const int op);
70493
70494 /* External variables not in a header file. */
70495 extern int sysctl_overcommit_memory;
70496@@ -196,6 +203,7 @@ static int sysrq_sysctl_handler(ctl_tabl
70497 }
70498
70499 #endif
70500+extern struct ctl_table grsecurity_table[];
70501
70502 static struct ctl_table root_table[];
70503 static struct ctl_table_root sysctl_table_root;
70504@@ -225,6 +233,20 @@ extern struct ctl_table epoll_table[];
70505 int sysctl_legacy_va_layout;
70506 #endif
70507
70508+#ifdef CONFIG_PAX_SOFTMODE
70509+static ctl_table pax_table[] = {
70510+ {
70511+ .procname = "softmode",
70512+ .data = &pax_softmode,
70513+ .maxlen = sizeof(unsigned int),
70514+ .mode = 0600,
70515+ .proc_handler = &proc_dointvec,
70516+ },
70517+
70518+ { }
70519+};
70520+#endif
70521+
70522 /* The default sysctl tables: */
70523
70524 static struct ctl_table root_table[] = {
70525@@ -271,6 +293,22 @@ static int max_extfrag_threshold = 1000;
70526 #endif
70527
70528 static struct ctl_table kern_table[] = {
70529+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
70530+ {
70531+ .procname = "grsecurity",
70532+ .mode = 0500,
70533+ .child = grsecurity_table,
70534+ },
70535+#endif
70536+
70537+#ifdef CONFIG_PAX_SOFTMODE
70538+ {
70539+ .procname = "pax",
70540+ .mode = 0500,
70541+ .child = pax_table,
70542+ },
70543+#endif
70544+
70545 {
70546 .procname = "sched_child_runs_first",
70547 .data = &sysctl_sched_child_runs_first,
70548@@ -545,7 +583,7 @@ static struct ctl_table kern_table[] = {
70549 .data = &modprobe_path,
70550 .maxlen = KMOD_PATH_LEN,
70551 .mode = 0644,
70552- .proc_handler = proc_dostring,
70553+ .proc_handler = proc_dostring_modpriv,
70554 },
70555 {
70556 .procname = "modules_disabled",
70557@@ -707,16 +745,20 @@ static struct ctl_table kern_table[] = {
70558 .extra1 = &zero,
70559 .extra2 = &one,
70560 },
70561+#endif
70562 {
70563 .procname = "kptr_restrict",
70564 .data = &kptr_restrict,
70565 .maxlen = sizeof(int),
70566 .mode = 0644,
70567 .proc_handler = proc_dmesg_restrict,
70568+#ifdef CONFIG_GRKERNSEC_HIDESYM
70569+ .extra1 = &two,
70570+#else
70571 .extra1 = &zero,
70572+#endif
70573 .extra2 = &two,
70574 },
70575-#endif
70576 {
70577 .procname = "ngroups_max",
70578 .data = &ngroups_max,
70579@@ -1189,6 +1231,13 @@ static struct ctl_table vm_table[] = {
70580 .proc_handler = proc_dointvec_minmax,
70581 .extra1 = &zero,
70582 },
70583+ {
70584+ .procname = "heap_stack_gap",
70585+ .data = &sysctl_heap_stack_gap,
70586+ .maxlen = sizeof(sysctl_heap_stack_gap),
70587+ .mode = 0644,
70588+ .proc_handler = proc_doulongvec_minmax,
70589+ },
70590 #else
70591 {
70592 .procname = "nr_trim_pages",
70593@@ -1698,6 +1747,17 @@ static int test_perm(int mode, int op)
70594 int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
70595 {
70596 int mode;
70597+ int error;
70598+
70599+ if (table->parent != NULL && table->parent->procname != NULL &&
70600+ table->procname != NULL &&
70601+ gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
70602+ return -EACCES;
70603+ if (gr_handle_chroot_sysctl(op))
70604+ return -EACCES;
70605+ error = gr_handle_sysctl(table, op);
70606+ if (error)
70607+ return error;
70608
70609 if (root->permissions)
70610 mode = root->permissions(root, current->nsproxy, table);
70611@@ -2102,6 +2162,16 @@ int proc_dostring(struct ctl_table *tabl
70612 buffer, lenp, ppos);
70613 }
70614
70615+int proc_dostring_modpriv(struct ctl_table *table, int write,
70616+ void __user *buffer, size_t *lenp, loff_t *ppos)
70617+{
70618+ if (write && !capable(CAP_SYS_MODULE))
70619+ return -EPERM;
70620+
70621+ return _proc_do_string(table->data, table->maxlen, write,
70622+ buffer, lenp, ppos);
70623+}
70624+
70625 static size_t proc_skip_spaces(char **buf)
70626 {
70627 size_t ret;
70628@@ -2207,6 +2277,8 @@ static int proc_put_long(void __user **b
70629 len = strlen(tmp);
70630 if (len > *size)
70631 len = *size;
70632+ if (len > sizeof(tmp))
70633+ len = sizeof(tmp);
70634 if (copy_to_user(*buf, tmp, len))
70635 return -EFAULT;
70636 *size -= len;
70637@@ -2523,8 +2595,11 @@ static int __do_proc_doulongvec_minmax(v
70638 *i = val;
70639 } else {
70640 val = convdiv * (*i) / convmul;
70641- if (!first)
70642+ if (!first) {
70643 err = proc_put_char(&buffer, &left, '\t');
70644+ if (err)
70645+ break;
70646+ }
70647 err = proc_put_long(&buffer, &left, val, false);
70648 if (err)
70649 break;
70650@@ -2919,6 +2994,12 @@ int proc_dostring(struct ctl_table *tabl
70651 return -ENOSYS;
70652 }
70653
70654+int proc_dostring_modpriv(struct ctl_table *table, int write,
70655+ void __user *buffer, size_t *lenp, loff_t *ppos)
70656+{
70657+ return -ENOSYS;
70658+}
70659+
70660 int proc_dointvec(struct ctl_table *table, int write,
70661 void __user *buffer, size_t *lenp, loff_t *ppos)
70662 {
70663@@ -2975,6 +3056,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
70664 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
70665 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
70666 EXPORT_SYMBOL(proc_dostring);
70667+EXPORT_SYMBOL(proc_dostring_modpriv);
70668 EXPORT_SYMBOL(proc_doulongvec_minmax);
70669 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
70670 EXPORT_SYMBOL(register_sysctl_table);
70671diff -urNp linux-2.6.39.1/kernel/sysctl_check.c linux-2.6.39.1/kernel/sysctl_check.c
70672--- linux-2.6.39.1/kernel/sysctl_check.c 2011-05-19 00:06:34.000000000 -0400
70673+++ linux-2.6.39.1/kernel/sysctl_check.c 2011-05-22 19:41:42.000000000 -0400
70674@@ -129,6 +129,7 @@ int sysctl_check_table(struct nsproxy *n
70675 set_fail(&fail, table, "Directory with extra2");
70676 } else {
70677 if ((table->proc_handler == proc_dostring) ||
70678+ (table->proc_handler == proc_dostring_modpriv) ||
70679 (table->proc_handler == proc_dointvec) ||
70680 (table->proc_handler == proc_dointvec_minmax) ||
70681 (table->proc_handler == proc_dointvec_jiffies) ||
70682diff -urNp linux-2.6.39.1/kernel/taskstats.c linux-2.6.39.1/kernel/taskstats.c
70683--- linux-2.6.39.1/kernel/taskstats.c 2011-05-19 00:06:34.000000000 -0400
70684+++ linux-2.6.39.1/kernel/taskstats.c 2011-05-22 19:41:42.000000000 -0400
70685@@ -27,9 +27,12 @@
70686 #include <linux/cgroup.h>
70687 #include <linux/fs.h>
70688 #include <linux/file.h>
70689+#include <linux/grsecurity.h>
70690 #include <net/genetlink.h>
70691 #include <asm/atomic.h>
70692
70693+extern int gr_is_taskstats_denied(int pid);
70694+
70695 /*
70696 * Maximum length of a cpumask that can be specified in
70697 * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
70698@@ -549,6 +552,9 @@ err:
70699
70700 static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
70701 {
70702+ if (gr_is_taskstats_denied(current->pid))
70703+ return -EACCES;
70704+
70705 if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK])
70706 return cmd_attr_register_cpumask(info);
70707 else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
70708diff -urNp linux-2.6.39.1/kernel/time/posix-clock.c linux-2.6.39.1/kernel/time/posix-clock.c
70709--- linux-2.6.39.1/kernel/time/posix-clock.c 2011-05-19 00:06:34.000000000 -0400
70710+++ linux-2.6.39.1/kernel/time/posix-clock.c 2011-05-22 19:36:33.000000000 -0400
70711@@ -433,7 +433,7 @@ static int pc_timer_settime(struct k_iti
70712 return err;
70713 }
70714
70715-struct k_clock clock_posix_dynamic = {
70716+const struct k_clock clock_posix_dynamic = {
70717 .clock_getres = pc_clock_getres,
70718 .clock_set = pc_clock_settime,
70719 .clock_get = pc_clock_gettime,
70720diff -urNp linux-2.6.39.1/kernel/time/tick-broadcast.c linux-2.6.39.1/kernel/time/tick-broadcast.c
70721--- linux-2.6.39.1/kernel/time/tick-broadcast.c 2011-05-19 00:06:34.000000000 -0400
70722+++ linux-2.6.39.1/kernel/time/tick-broadcast.c 2011-05-22 19:36:33.000000000 -0400
70723@@ -115,7 +115,7 @@ int tick_device_uses_broadcast(struct cl
70724 * then clear the broadcast bit.
70725 */
70726 if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
70727- int cpu = smp_processor_id();
70728+ cpu = smp_processor_id();
70729
70730 cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
70731 tick_broadcast_clear_oneshot(cpu);
70732diff -urNp linux-2.6.39.1/kernel/time/timekeeping.c linux-2.6.39.1/kernel/time/timekeeping.c
70733--- linux-2.6.39.1/kernel/time/timekeeping.c 2011-05-19 00:06:34.000000000 -0400
70734+++ linux-2.6.39.1/kernel/time/timekeeping.c 2011-05-22 20:40:50.000000000 -0400
70735@@ -14,6 +14,7 @@
70736 #include <linux/init.h>
70737 #include <linux/mm.h>
70738 #include <linux/sched.h>
70739+#include <linux/grsecurity.h>
70740 #include <linux/syscore_ops.h>
70741 #include <linux/clocksource.h>
70742 #include <linux/jiffies.h>
70743@@ -361,6 +362,8 @@ int do_settimeofday(const struct timespe
70744 if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
70745 return -EINVAL;
70746
70747+ gr_log_timechange();
70748+
70749 write_seqlock_irqsave(&xtime_lock, flags);
70750
70751 timekeeping_forward_now();
70752diff -urNp linux-2.6.39.1/kernel/time/timer_list.c linux-2.6.39.1/kernel/time/timer_list.c
70753--- linux-2.6.39.1/kernel/time/timer_list.c 2011-05-19 00:06:34.000000000 -0400
70754+++ linux-2.6.39.1/kernel/time/timer_list.c 2011-05-22 19:41:42.000000000 -0400
70755@@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base,
70756
70757 static void print_name_offset(struct seq_file *m, void *sym)
70758 {
70759+#ifdef CONFIG_GRKERNSEC_HIDESYM
70760+ SEQ_printf(m, "<%p>", NULL);
70761+#else
70762 char symname[KSYM_NAME_LEN];
70763
70764 if (lookup_symbol_name((unsigned long)sym, symname) < 0)
70765 SEQ_printf(m, "<%pK>", sym);
70766 else
70767 SEQ_printf(m, "%s", symname);
70768+#endif
70769 }
70770
70771 static void
70772@@ -112,7 +116,11 @@ next_one:
70773 static void
70774 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
70775 {
70776+#ifdef CONFIG_GRKERNSEC_HIDESYM
70777+ SEQ_printf(m, " .base: %p\n", NULL);
70778+#else
70779 SEQ_printf(m, " .base: %pK\n", base);
70780+#endif
70781 SEQ_printf(m, " .index: %d\n",
70782 base->index);
70783 SEQ_printf(m, " .resolution: %Lu nsecs\n",
70784@@ -293,7 +301,11 @@ static int __init init_timer_list_procfs
70785 {
70786 struct proc_dir_entry *pe;
70787
70788+#ifdef CONFIG_GRKERNSEC_PROC_ADD
70789+ pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
70790+#else
70791 pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
70792+#endif
70793 if (!pe)
70794 return -ENOMEM;
70795 return 0;
70796diff -urNp linux-2.6.39.1/kernel/time/timer_stats.c linux-2.6.39.1/kernel/time/timer_stats.c
70797--- linux-2.6.39.1/kernel/time/timer_stats.c 2011-05-19 00:06:34.000000000 -0400
70798+++ linux-2.6.39.1/kernel/time/timer_stats.c 2011-05-22 19:41:42.000000000 -0400
70799@@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
70800 static unsigned long nr_entries;
70801 static struct entry entries[MAX_ENTRIES];
70802
70803-static atomic_t overflow_count;
70804+static atomic_unchecked_t overflow_count;
70805
70806 /*
70807 * The entries are in a hash-table, for fast lookup:
70808@@ -140,7 +140,7 @@ static void reset_entries(void)
70809 nr_entries = 0;
70810 memset(entries, 0, sizeof(entries));
70811 memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
70812- atomic_set(&overflow_count, 0);
70813+ atomic_set_unchecked(&overflow_count, 0);
70814 }
70815
70816 static struct entry *alloc_entry(void)
70817@@ -261,7 +261,7 @@ void timer_stats_update_stats(void *time
70818 if (likely(entry))
70819 entry->count++;
70820 else
70821- atomic_inc(&overflow_count);
70822+ atomic_inc_unchecked(&overflow_count);
70823
70824 out_unlock:
70825 raw_spin_unlock_irqrestore(lock, flags);
70826@@ -269,12 +269,16 @@ void timer_stats_update_stats(void *time
70827
70828 static void print_name_offset(struct seq_file *m, unsigned long addr)
70829 {
70830+#ifdef CONFIG_GRKERNSEC_HIDESYM
70831+ seq_printf(m, "<%p>", NULL);
70832+#else
70833 char symname[KSYM_NAME_LEN];
70834
70835 if (lookup_symbol_name(addr, symname) < 0)
70836 seq_printf(m, "<%p>", (void *)addr);
70837 else
70838 seq_printf(m, "%s", symname);
70839+#endif
70840 }
70841
70842 static int tstats_show(struct seq_file *m, void *v)
70843@@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *
70844
70845 seq_puts(m, "Timer Stats Version: v0.2\n");
70846 seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
70847- if (atomic_read(&overflow_count))
70848+ if (atomic_read_unchecked(&overflow_count))
70849 seq_printf(m, "Overflow: %d entries\n",
70850- atomic_read(&overflow_count));
70851+ atomic_read_unchecked(&overflow_count));
70852
70853 for (i = 0; i < nr_entries; i++) {
70854 entry = entries + i;
70855@@ -417,7 +421,11 @@ static int __init init_tstats_procfs(voi
70856 {
70857 struct proc_dir_entry *pe;
70858
70859+#ifdef CONFIG_GRKERNSEC_PROC_ADD
70860+ pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
70861+#else
70862 pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
70863+#endif
70864 if (!pe)
70865 return -ENOMEM;
70866 return 0;
70867diff -urNp linux-2.6.39.1/kernel/time.c linux-2.6.39.1/kernel/time.c
70868--- linux-2.6.39.1/kernel/time.c 2011-05-19 00:06:34.000000000 -0400
70869+++ linux-2.6.39.1/kernel/time.c 2011-05-22 19:41:42.000000000 -0400
70870@@ -163,6 +163,11 @@ int do_sys_settimeofday(const struct tim
70871 return error;
70872
70873 if (tz) {
70874+ /* we log in do_settimeofday called below, so don't log twice
70875+ */
70876+ if (!tv)
70877+ gr_log_timechange();
70878+
70879 /* SMP safe, global irq locking makes it work. */
70880 sys_tz = *tz;
70881 update_vsyscall_tz();
70882diff -urNp linux-2.6.39.1/kernel/timer.c linux-2.6.39.1/kernel/timer.c
70883--- linux-2.6.39.1/kernel/timer.c 2011-05-19 00:06:34.000000000 -0400
70884+++ linux-2.6.39.1/kernel/timer.c 2011-05-22 19:36:33.000000000 -0400
70885@@ -1305,7 +1305,7 @@ void update_process_times(int user_tick)
70886 /*
70887 * This function runs timers and the timer-tq in bottom half context.
70888 */
70889-static void run_timer_softirq(struct softirq_action *h)
70890+static void run_timer_softirq(void)
70891 {
70892 struct tvec_base *base = __this_cpu_read(tvec_bases);
70893
70894diff -urNp linux-2.6.39.1/kernel/trace/blktrace.c linux-2.6.39.1/kernel/trace/blktrace.c
70895--- linux-2.6.39.1/kernel/trace/blktrace.c 2011-05-19 00:06:34.000000000 -0400
70896+++ linux-2.6.39.1/kernel/trace/blktrace.c 2011-05-22 19:36:33.000000000 -0400
70897@@ -321,7 +321,7 @@ static ssize_t blk_dropped_read(struct f
70898 struct blk_trace *bt = filp->private_data;
70899 char buf[16];
70900
70901- snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
70902+ snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
70903
70904 return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
70905 }
70906@@ -386,7 +386,7 @@ static int blk_subbuf_start_callback(str
70907 return 1;
70908
70909 bt = buf->chan->private_data;
70910- atomic_inc(&bt->dropped);
70911+ atomic_inc_unchecked(&bt->dropped);
70912 return 0;
70913 }
70914
70915@@ -487,7 +487,7 @@ int do_blk_trace_setup(struct request_qu
70916
70917 bt->dir = dir;
70918 bt->dev = dev;
70919- atomic_set(&bt->dropped, 0);
70920+ atomic_set_unchecked(&bt->dropped, 0);
70921
70922 ret = -EIO;
70923 bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
70924diff -urNp linux-2.6.39.1/kernel/trace/ftrace.c linux-2.6.39.1/kernel/trace/ftrace.c
70925--- linux-2.6.39.1/kernel/trace/ftrace.c 2011-06-03 00:04:14.000000000 -0400
70926+++ linux-2.6.39.1/kernel/trace/ftrace.c 2011-06-03 00:32:08.000000000 -0400
70927@@ -1107,13 +1107,18 @@ ftrace_code_disable(struct module *mod,
70928
70929 ip = rec->ip;
70930
70931+ ret = ftrace_arch_code_modify_prepare();
70932+ FTRACE_WARN_ON(ret);
70933+ if (ret)
70934+ return 0;
70935+
70936 ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
70937+ FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
70938 if (ret) {
70939 ftrace_bug(ret, ip);
70940 rec->flags |= FTRACE_FL_FAILED;
70941- return 0;
70942 }
70943- return 1;
70944+ return ret ? 0 : 1;
70945 }
70946
70947 /*
70948@@ -2011,7 +2016,7 @@ static void ftrace_free_entry_rcu(struct
70949
70950 int
70951 register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
70952- void *data)
70953+ void *data)
70954 {
70955 struct ftrace_func_probe *entry;
70956 struct ftrace_page *pg;
70957@@ -2083,7 +2088,7 @@ enum {
70958 };
70959
70960 static void
70961-__unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
70962+__unregister_ftrace_function_probe(char *glob, const struct ftrace_probe_ops *ops,
70963 void *data, int flags)
70964 {
70965 struct ftrace_func_probe *entry;
70966@@ -2144,7 +2149,7 @@ unregister_ftrace_function_probe(char *g
70967 }
70968
70969 void
70970-unregister_ftrace_function_probe_func(char *glob, struct ftrace_probe_ops *ops)
70971+unregister_ftrace_function_probe_func(char *glob, const struct ftrace_probe_ops *ops)
70972 {
70973 __unregister_ftrace_function_probe(glob, ops, NULL, PROBE_TEST_FUNC);
70974 }
70975diff -urNp linux-2.6.39.1/kernel/trace/trace.c linux-2.6.39.1/kernel/trace/trace.c
70976--- linux-2.6.39.1/kernel/trace/trace.c 2011-05-19 00:06:34.000000000 -0400
70977+++ linux-2.6.39.1/kernel/trace/trace.c 2011-05-22 19:36:33.000000000 -0400
70978@@ -3330,6 +3330,8 @@ static ssize_t tracing_splice_read_pipe(
70979 size_t rem;
70980 unsigned int i;
70981
70982+ pax_track_stack();
70983+
70984 if (splice_grow_spd(pipe, &spd))
70985 return -ENOMEM;
70986
70987@@ -3813,6 +3815,8 @@ tracing_buffers_splice_read(struct file
70988 int entries, size, i;
70989 size_t ret;
70990
70991+ pax_track_stack();
70992+
70993 if (splice_grow_spd(pipe, &spd))
70994 return -ENOMEM;
70995
70996@@ -3981,10 +3985,9 @@ static const struct file_operations trac
70997 };
70998 #endif
70999
71000-static struct dentry *d_tracer;
71001-
71002 struct dentry *tracing_init_dentry(void)
71003 {
71004+ static struct dentry *d_tracer;
71005 static int once;
71006
71007 if (d_tracer)
71008@@ -4004,10 +4007,9 @@ struct dentry *tracing_init_dentry(void)
71009 return d_tracer;
71010 }
71011
71012-static struct dentry *d_percpu;
71013-
71014 struct dentry *tracing_dentry_percpu(void)
71015 {
71016+ static struct dentry *d_percpu;
71017 static int once;
71018 struct dentry *d_tracer;
71019
71020diff -urNp linux-2.6.39.1/kernel/trace/trace_events.c linux-2.6.39.1/kernel/trace/trace_events.c
71021--- linux-2.6.39.1/kernel/trace/trace_events.c 2011-05-19 00:06:34.000000000 -0400
71022+++ linux-2.6.39.1/kernel/trace/trace_events.c 2011-05-22 19:36:33.000000000 -0400
71023@@ -1241,10 +1241,10 @@ static LIST_HEAD(ftrace_module_file_list
71024 struct ftrace_module_file_ops {
71025 struct list_head list;
71026 struct module *mod;
71027- struct file_operations id;
71028- struct file_operations enable;
71029- struct file_operations format;
71030- struct file_operations filter;
71031+ struct file_operations id; /* cannot be const, see trace_create_file_ops() */
71032+ struct file_operations enable; /* cannot be const, see trace_create_file_ops() */
71033+ struct file_operations format; /* cannot be const, see trace_create_file_ops() */
71034+ struct file_operations filter; /* cannot be const, see trace_create_file_ops() */
71035 };
71036
71037 static struct ftrace_module_file_ops *
71038diff -urNp linux-2.6.39.1/kernel/trace/trace_functions.c linux-2.6.39.1/kernel/trace/trace_functions.c
71039--- linux-2.6.39.1/kernel/trace/trace_functions.c 2011-05-19 00:06:34.000000000 -0400
71040+++ linux-2.6.39.1/kernel/trace/trace_functions.c 2011-05-22 19:36:33.000000000 -0400
71041@@ -308,7 +308,7 @@ ftrace_trace_onoff_print(struct seq_file
71042 static int
71043 ftrace_trace_onoff_unreg(char *glob, char *cmd, char *param)
71044 {
71045- struct ftrace_probe_ops *ops;
71046+ const struct ftrace_probe_ops *ops;
71047
71048 /* we register both traceon and traceoff to this callback */
71049 if (strcmp(cmd, "traceon") == 0)
71050diff -urNp linux-2.6.39.1/kernel/trace/trace_mmiotrace.c linux-2.6.39.1/kernel/trace/trace_mmiotrace.c
71051--- linux-2.6.39.1/kernel/trace/trace_mmiotrace.c 2011-05-19 00:06:34.000000000 -0400
71052+++ linux-2.6.39.1/kernel/trace/trace_mmiotrace.c 2011-05-22 19:36:33.000000000 -0400
71053@@ -24,7 +24,7 @@ struct header_iter {
71054 static struct trace_array *mmio_trace_array;
71055 static bool overrun_detected;
71056 static unsigned long prev_overruns;
71057-static atomic_t dropped_count;
71058+static atomic_unchecked_t dropped_count;
71059
71060 static void mmio_reset_data(struct trace_array *tr)
71061 {
71062@@ -127,7 +127,7 @@ static void mmio_close(struct trace_iter
71063
71064 static unsigned long count_overruns(struct trace_iterator *iter)
71065 {
71066- unsigned long cnt = atomic_xchg(&dropped_count, 0);
71067+ unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
71068 unsigned long over = ring_buffer_overruns(iter->tr->buffer);
71069
71070 if (over > prev_overruns)
71071@@ -317,7 +317,7 @@ static void __trace_mmiotrace_rw(struct
71072 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
71073 sizeof(*entry), 0, pc);
71074 if (!event) {
71075- atomic_inc(&dropped_count);
71076+ atomic_inc_unchecked(&dropped_count);
71077 return;
71078 }
71079 entry = ring_buffer_event_data(event);
71080@@ -347,7 +347,7 @@ static void __trace_mmiotrace_map(struct
71081 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
71082 sizeof(*entry), 0, pc);
71083 if (!event) {
71084- atomic_inc(&dropped_count);
71085+ atomic_inc_unchecked(&dropped_count);
71086 return;
71087 }
71088 entry = ring_buffer_event_data(event);
71089diff -urNp linux-2.6.39.1/kernel/trace/trace_output.c linux-2.6.39.1/kernel/trace/trace_output.c
71090--- linux-2.6.39.1/kernel/trace/trace_output.c 2011-05-19 00:06:34.000000000 -0400
71091+++ linux-2.6.39.1/kernel/trace/trace_output.c 2011-05-22 19:36:33.000000000 -0400
71092@@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s,
71093
71094 p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
71095 if (!IS_ERR(p)) {
71096- p = mangle_path(s->buffer + s->len, p, "\n");
71097+ p = mangle_path(s->buffer + s->len, p, "\n\\");
71098 if (p) {
71099 s->len = p - s->buffer;
71100 return 1;
71101diff -urNp linux-2.6.39.1/kernel/trace/trace_stack.c linux-2.6.39.1/kernel/trace/trace_stack.c
71102--- linux-2.6.39.1/kernel/trace/trace_stack.c 2011-05-19 00:06:34.000000000 -0400
71103+++ linux-2.6.39.1/kernel/trace/trace_stack.c 2011-05-22 19:36:33.000000000 -0400
71104@@ -50,7 +50,7 @@ static inline void check_stack(void)
71105 return;
71106
71107 /* we do not handle interrupt stacks yet */
71108- if (!object_is_on_stack(&this_size))
71109+ if (!object_starts_on_stack(&this_size))
71110 return;
71111
71112 local_irq_save(flags);
71113diff -urNp linux-2.6.39.1/kernel/trace/trace_workqueue.c linux-2.6.39.1/kernel/trace/trace_workqueue.c
71114--- linux-2.6.39.1/kernel/trace/trace_workqueue.c 2011-05-19 00:06:34.000000000 -0400
71115+++ linux-2.6.39.1/kernel/trace/trace_workqueue.c 2011-05-22 19:36:33.000000000 -0400
71116@@ -22,7 +22,7 @@ struct cpu_workqueue_stats {
71117 int cpu;
71118 pid_t pid;
71119 /* Can be inserted from interrupt or user context, need to be atomic */
71120- atomic_t inserted;
71121+ atomic_unchecked_t inserted;
71122 /*
71123 * Don't need to be atomic, works are serialized in a single workqueue thread
71124 * on a single CPU.
71125@@ -60,7 +60,7 @@ probe_workqueue_insertion(void *ignore,
71126 spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
71127 list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
71128 if (node->pid == wq_thread->pid) {
71129- atomic_inc(&node->inserted);
71130+ atomic_inc_unchecked(&node->inserted);
71131 goto found;
71132 }
71133 }
71134@@ -210,7 +210,7 @@ static int workqueue_stat_show(struct se
71135 tsk = get_pid_task(pid, PIDTYPE_PID);
71136 if (tsk) {
71137 seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
71138- atomic_read(&cws->inserted), cws->executed,
71139+ atomic_read_unchecked(&cws->inserted), cws->executed,
71140 tsk->comm);
71141 put_task_struct(tsk);
71142 }
71143diff -urNp linux-2.6.39.1/lib/bug.c linux-2.6.39.1/lib/bug.c
71144--- linux-2.6.39.1/lib/bug.c 2011-05-19 00:06:34.000000000 -0400
71145+++ linux-2.6.39.1/lib/bug.c 2011-05-22 19:36:33.000000000 -0400
71146@@ -133,6 +133,8 @@ enum bug_trap_type report_bug(unsigned l
71147 return BUG_TRAP_TYPE_NONE;
71148
71149 bug = find_bug(bugaddr);
71150+ if (!bug)
71151+ return BUG_TRAP_TYPE_NONE;
71152
71153 file = NULL;
71154 line = 0;
71155diff -urNp linux-2.6.39.1/lib/debugobjects.c linux-2.6.39.1/lib/debugobjects.c
71156--- linux-2.6.39.1/lib/debugobjects.c 2011-05-19 00:06:34.000000000 -0400
71157+++ linux-2.6.39.1/lib/debugobjects.c 2011-05-22 19:36:33.000000000 -0400
71158@@ -284,7 +284,7 @@ static void debug_object_is_on_stack(voi
71159 if (limit > 4)
71160 return;
71161
71162- is_on_stack = object_is_on_stack(addr);
71163+ is_on_stack = object_starts_on_stack(addr);
71164 if (is_on_stack == onstack)
71165 return;
71166
71167diff -urNp linux-2.6.39.1/lib/dma-debug.c linux-2.6.39.1/lib/dma-debug.c
71168--- linux-2.6.39.1/lib/dma-debug.c 2011-05-19 00:06:34.000000000 -0400
71169+++ linux-2.6.39.1/lib/dma-debug.c 2011-05-22 19:36:33.000000000 -0400
71170@@ -862,7 +862,7 @@ out:
71171
71172 static void check_for_stack(struct device *dev, void *addr)
71173 {
71174- if (object_is_on_stack(addr))
71175+ if (object_starts_on_stack(addr))
71176 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
71177 "stack [addr=%p]\n", addr);
71178 }
71179diff -urNp linux-2.6.39.1/lib/inflate.c linux-2.6.39.1/lib/inflate.c
71180--- linux-2.6.39.1/lib/inflate.c 2011-05-19 00:06:34.000000000 -0400
71181+++ linux-2.6.39.1/lib/inflate.c 2011-05-22 19:36:33.000000000 -0400
71182@@ -269,7 +269,7 @@ static void free(void *where)
71183 malloc_ptr = free_mem_ptr;
71184 }
71185 #else
71186-#define malloc(a) kmalloc(a, GFP_KERNEL)
71187+#define malloc(a) kmalloc((a), GFP_KERNEL)
71188 #define free(a) kfree(a)
71189 #endif
71190
71191diff -urNp linux-2.6.39.1/lib/Kconfig.debug linux-2.6.39.1/lib/Kconfig.debug
71192--- linux-2.6.39.1/lib/Kconfig.debug 2011-05-19 00:06:34.000000000 -0400
71193+++ linux-2.6.39.1/lib/Kconfig.debug 2011-05-22 19:41:42.000000000 -0400
71194@@ -1078,6 +1078,7 @@ config LATENCYTOP
71195 depends on DEBUG_KERNEL
71196 depends on STACKTRACE_SUPPORT
71197 depends on PROC_FS
71198+ depends on !GRKERNSEC_HIDESYM
71199 select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE
71200 select KALLSYMS
71201 select KALLSYMS_ALL
71202diff -urNp linux-2.6.39.1/lib/kref.c linux-2.6.39.1/lib/kref.c
71203--- linux-2.6.39.1/lib/kref.c 2011-05-19 00:06:34.000000000 -0400
71204+++ linux-2.6.39.1/lib/kref.c 2011-05-22 19:36:33.000000000 -0400
71205@@ -52,7 +52,7 @@ void kref_get(struct kref *kref)
71206 */
71207 int kref_put(struct kref *kref, void (*release)(struct kref *kref))
71208 {
71209- WARN_ON(release == NULL);
71210+ BUG_ON(release == NULL);
71211 WARN_ON(release == (void (*)(struct kref *))kfree);
71212
71213 if (atomic_dec_and_test(&kref->refcount)) {
71214diff -urNp linux-2.6.39.1/lib/radix-tree.c linux-2.6.39.1/lib/radix-tree.c
71215--- linux-2.6.39.1/lib/radix-tree.c 2011-05-19 00:06:34.000000000 -0400
71216+++ linux-2.6.39.1/lib/radix-tree.c 2011-05-22 19:36:33.000000000 -0400
71217@@ -80,7 +80,7 @@ struct radix_tree_preload {
71218 int nr;
71219 struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
71220 };
71221-static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
71222+static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
71223
71224 static inline void *ptr_to_indirect(void *ptr)
71225 {
71226diff -urNp linux-2.6.39.1/lib/vsprintf.c linux-2.6.39.1/lib/vsprintf.c
71227--- linux-2.6.39.1/lib/vsprintf.c 2011-05-19 00:06:34.000000000 -0400
71228+++ linux-2.6.39.1/lib/vsprintf.c 2011-05-22 20:54:59.000000000 -0400
71229@@ -16,6 +16,9 @@
71230 * - scnprintf and vscnprintf
71231 */
71232
71233+#ifdef CONFIG_GRKERNSEC_HIDESYM
71234+#define __INCLUDED_BY_HIDESYM 1
71235+#endif
71236 #include <stdarg.h>
71237 #include <linux/module.h>
71238 #include <linux/types.h>
71239@@ -435,7 +438,7 @@ char *symbol_string(char *buf, char *end
71240 char sym[KSYM_SYMBOL_LEN];
71241 if (ext == 'B')
71242 sprint_backtrace(sym, value);
71243- else if (ext != 'f' && ext != 's')
71244+ else if (ext != 'f' && ext != 's' && ext != 'a')
71245 sprint_symbol(sym, value);
71246 else
71247 kallsyms_lookup(value, NULL, NULL, NULL, sym);
71248@@ -797,7 +800,11 @@ char *uuid_string(char *buf, char *end,
71249 return string(buf, end, uuid, spec);
71250 }
71251
71252+#ifdef CONFIG_GRKERNSEC_HIDESYM
71253+int kptr_restrict __read_mostly = 2;
71254+#else
71255 int kptr_restrict __read_mostly;
71256+#endif
71257
71258 /*
71259 * Show a '%p' thing. A kernel extension is that the '%p' is followed
71260@@ -811,6 +818,8 @@ int kptr_restrict __read_mostly;
71261 * - 'S' For symbolic direct pointers with offset
71262 * - 's' For symbolic direct pointers without offset
71263 * - 'B' For backtraced symbolic direct pointers with offset
71264+ * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
71265+ * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
71266 * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref]
71267 * - 'r' For raw struct resource, e.g., [mem 0x0-0x1f flags 0x201]
71268 * - 'M' For a 6-byte MAC address, it prints the address in the
71269@@ -855,12 +864,12 @@ char *pointer(const char *fmt, char *buf
71270 {
71271 if (!ptr && *fmt != 'K') {
71272 /*
71273- * Print (null) with the same width as a pointer so it makes
71274+ * Print (nil) with the same width as a pointer so it makes
71275 * tabular output look nice.
71276 */
71277 if (spec.field_width == -1)
71278 spec.field_width = 2 * sizeof(void *);
71279- return string(buf, end, "(null)", spec);
71280+ return string(buf, end, "(nil)", spec);
71281 }
71282
71283 switch (*fmt) {
71284@@ -870,6 +879,13 @@ char *pointer(const char *fmt, char *buf
71285 /* Fallthrough */
71286 case 'S':
71287 case 's':
71288+#ifdef CONFIG_GRKERNSEC_HIDESYM
71289+ break;
71290+#else
71291+ return symbol_string(buf, end, ptr, spec, *fmt);
71292+#endif
71293+ case 'A':
71294+ case 'a':
71295 case 'B':
71296 return symbol_string(buf, end, ptr, spec, *fmt);
71297 case 'R':
71298@@ -1632,11 +1648,11 @@ int bstr_printf(char *buf, size_t size,
71299 typeof(type) value; \
71300 if (sizeof(type) == 8) { \
71301 args = PTR_ALIGN(args, sizeof(u32)); \
71302- *(u32 *)&value = *(u32 *)args; \
71303- *((u32 *)&value + 1) = *(u32 *)(args + 4); \
71304+ *(u32 *)&value = *(const u32 *)args; \
71305+ *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
71306 } else { \
71307 args = PTR_ALIGN(args, sizeof(type)); \
71308- value = *(typeof(type) *)args; \
71309+ value = *(const typeof(type) *)args; \
71310 } \
71311 args += sizeof(type); \
71312 value; \
71313@@ -1699,7 +1715,7 @@ int bstr_printf(char *buf, size_t size,
71314 case FORMAT_TYPE_STR: {
71315 const char *str_arg = args;
71316 args += strlen(str_arg) + 1;
71317- str = string(str, end, (char *)str_arg, spec);
71318+ str = string(str, end, str_arg, spec);
71319 break;
71320 }
71321
71322diff -urNp linux-2.6.39.1/localversion-grsec linux-2.6.39.1/localversion-grsec
71323--- linux-2.6.39.1/localversion-grsec 1969-12-31 19:00:00.000000000 -0500
71324+++ linux-2.6.39.1/localversion-grsec 2011-05-22 19:41:42.000000000 -0400
71325@@ -0,0 +1 @@
71326+-grsec
71327diff -urNp linux-2.6.39.1/Makefile linux-2.6.39.1/Makefile
71328--- linux-2.6.39.1/Makefile 2011-06-03 00:04:13.000000000 -0400
71329+++ linux-2.6.39.1/Makefile 2011-06-04 17:40:47.000000000 -0400
71330@@ -237,8 +237,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
71331
71332 HOSTCC = gcc
71333 HOSTCXX = g++
71334-HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
71335-HOSTCXXFLAGS = -O2
71336+HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
71337+HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
71338+HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
71339
71340 # Decide whether to build built-in, modular, or both.
71341 # Normally, just do built-in.
71342@@ -356,10 +357,12 @@ LINUXINCLUDE := -I$(srctree)/arch/$(h
71343 KBUILD_CPPFLAGS := -D__KERNEL__
71344
71345 KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
71346+ -W -Wno-unused-parameter -Wno-missing-field-initializers \
71347 -fno-strict-aliasing -fno-common \
71348 -Werror-implicit-function-declaration \
71349 -Wno-format-security \
71350 -fno-delete-null-pointer-checks
71351+KBUILD_CFLAGS += $(call cc-option, -Wno-empty-body)
71352 KBUILD_AFLAGS_KERNEL :=
71353 KBUILD_CFLAGS_KERNEL :=
71354 KBUILD_AFLAGS := -D__ASSEMBLY__
71355@@ -685,7 +688,7 @@ export mod_strip_cmd
71356
71357
71358 ifeq ($(KBUILD_EXTMOD),)
71359-core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
71360+core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
71361
71362 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
71363 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
71364@@ -931,7 +934,19 @@ include/config/kernel.release: include/c
71365 # version.h and scripts_basic is processed / created.
71366
71367 # Listed in dependency order
71368-PHONY += prepare archprepare prepare0 prepare1 prepare2 prepare3
71369+PHONY += prepare archprepare prepare0 prepare1 prepare2 prepare3 pax-plugin
71370+
71371+ifeq ($(CONFIG_PAX_MEMORY_STACKLEAK),y)
71372+KBUILD_CFLAGS += $(call cc-ifversion, -ge, 0405, -fplugin=$(objtree)/tools/gcc/pax_plugin.so -fplugin-arg-pax_plugin-track-lowest-sp=100)
71373+endif
71374+pax-plugin:
71375+ifneq (,$(findstring pax_plugin, $(KBUILD_CFLAGS)))
71376+ $(Q)$(MAKE) $(build)=tools/gcc
71377+else
71378+ifeq ($(CONFIG_PAX_MEMORY_STACKLEAK),y)
71379+ $(Q)echo "warning, your gcc does not support plugins, PAX_MEMORY_STACKLEAK will be less secure"
71380+endif
71381+endif
71382
71383 # prepare3 is used to check if we are building in a separate output directory,
71384 # and if so do:
71385@@ -947,7 +962,7 @@ ifneq ($(KBUILD_SRC),)
71386 endif
71387
71388 # prepare2 creates a makefile if using a separate output directory
71389-prepare2: prepare3 outputmakefile
71390+prepare2: prepare3 outputmakefile pax-plugin
71391
71392 prepare1: prepare2 include/linux/version.h include/generated/utsrelease.h \
71393 include/config/auto.conf
71394diff -urNp linux-2.6.39.1/mm/filemap.c linux-2.6.39.1/mm/filemap.c
71395--- linux-2.6.39.1/mm/filemap.c 2011-05-19 00:06:34.000000000 -0400
71396+++ linux-2.6.39.1/mm/filemap.c 2011-05-22 19:41:42.000000000 -0400
71397@@ -1724,7 +1724,7 @@ int generic_file_mmap(struct file * file
71398 struct address_space *mapping = file->f_mapping;
71399
71400 if (!mapping->a_ops->readpage)
71401- return -ENOEXEC;
71402+ return -ENODEV;
71403 file_accessed(file);
71404 vma->vm_ops = &generic_file_vm_ops;
71405 vma->vm_flags |= VM_CAN_NONLINEAR;
71406@@ -2120,6 +2120,7 @@ inline int generic_write_checks(struct f
71407 *pos = i_size_read(inode);
71408
71409 if (limit != RLIM_INFINITY) {
71410+ gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
71411 if (*pos >= limit) {
71412 send_sig(SIGXFSZ, current, 0);
71413 return -EFBIG;
71414diff -urNp linux-2.6.39.1/mm/fremap.c linux-2.6.39.1/mm/fremap.c
71415--- linux-2.6.39.1/mm/fremap.c 2011-05-19 00:06:34.000000000 -0400
71416+++ linux-2.6.39.1/mm/fremap.c 2011-05-22 19:36:33.000000000 -0400
71417@@ -156,6 +156,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
71418 retry:
71419 vma = find_vma(mm, start);
71420
71421+#ifdef CONFIG_PAX_SEGMEXEC
71422+ if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
71423+ goto out;
71424+#endif
71425+
71426 /*
71427 * Make sure the vma is shared, that it supports prefaulting,
71428 * and that the remapped range is valid and fully within
71429@@ -224,7 +229,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
71430 /*
71431 * drop PG_Mlocked flag for over-mapped range
71432 */
71433- unsigned int saved_flags = vma->vm_flags;
71434+ unsigned long saved_flags = vma->vm_flags;
71435 munlock_vma_pages_range(vma, start, start + size);
71436 vma->vm_flags = saved_flags;
71437 }
71438diff -urNp linux-2.6.39.1/mm/highmem.c linux-2.6.39.1/mm/highmem.c
71439--- linux-2.6.39.1/mm/highmem.c 2011-05-19 00:06:34.000000000 -0400
71440+++ linux-2.6.39.1/mm/highmem.c 2011-05-22 19:36:33.000000000 -0400
71441@@ -125,9 +125,10 @@ static void flush_all_zero_pkmaps(void)
71442 * So no dangers, even with speculative execution.
71443 */
71444 page = pte_page(pkmap_page_table[i]);
71445+ pax_open_kernel();
71446 pte_clear(&init_mm, (unsigned long)page_address(page),
71447 &pkmap_page_table[i]);
71448-
71449+ pax_close_kernel();
71450 set_page_address(page, NULL);
71451 need_flush = 1;
71452 }
71453@@ -186,9 +187,11 @@ start:
71454 }
71455 }
71456 vaddr = PKMAP_ADDR(last_pkmap_nr);
71457+
71458+ pax_open_kernel();
71459 set_pte_at(&init_mm, vaddr,
71460 &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
71461-
71462+ pax_close_kernel();
71463 pkmap_count[last_pkmap_nr] = 1;
71464 set_page_address(page, (void *)vaddr);
71465
71466diff -urNp linux-2.6.39.1/mm/huge_memory.c linux-2.6.39.1/mm/huge_memory.c
71467--- linux-2.6.39.1/mm/huge_memory.c 2011-05-19 00:06:34.000000000 -0400
71468+++ linux-2.6.39.1/mm/huge_memory.c 2011-05-22 19:36:33.000000000 -0400
71469@@ -702,7 +702,7 @@ out:
71470 * run pte_offset_map on the pmd, if an huge pmd could
71471 * materialize from under us from a different thread.
71472 */
71473- if (unlikely(__pte_alloc(mm, vma, pmd, address)))
71474+ if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
71475 return VM_FAULT_OOM;
71476 /* if an huge pmd materialized from under us just retry later */
71477 if (unlikely(pmd_trans_huge(*pmd)))
71478diff -urNp linux-2.6.39.1/mm/hugetlb.c linux-2.6.39.1/mm/hugetlb.c
71479--- linux-2.6.39.1/mm/hugetlb.c 2011-05-19 00:06:34.000000000 -0400
71480+++ linux-2.6.39.1/mm/hugetlb.c 2011-05-22 19:36:33.000000000 -0400
71481@@ -2331,6 +2331,27 @@ static int unmap_ref_private(struct mm_s
71482 return 1;
71483 }
71484
71485+#ifdef CONFIG_PAX_SEGMEXEC
71486+static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
71487+{
71488+ struct mm_struct *mm = vma->vm_mm;
71489+ struct vm_area_struct *vma_m;
71490+ unsigned long address_m;
71491+ pte_t *ptep_m;
71492+
71493+ vma_m = pax_find_mirror_vma(vma);
71494+ if (!vma_m)
71495+ return;
71496+
71497+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71498+ address_m = address + SEGMEXEC_TASK_SIZE;
71499+ ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
71500+ get_page(page_m);
71501+ hugepage_add_anon_rmap(page_m, vma_m, address_m);
71502+ set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
71503+}
71504+#endif
71505+
71506 /*
71507 * Hugetlb_cow() should be called with page lock of the original hugepage held.
71508 */
71509@@ -2432,6 +2453,11 @@ retry_avoidcopy:
71510 make_huge_pte(vma, new_page, 1));
71511 page_remove_rmap(old_page);
71512 hugepage_add_new_anon_rmap(new_page, vma, address);
71513+
71514+#ifdef CONFIG_PAX_SEGMEXEC
71515+ pax_mirror_huge_pte(vma, address, new_page);
71516+#endif
71517+
71518 /* Make the old page be freed below */
71519 new_page = old_page;
71520 mmu_notifier_invalidate_range_end(mm,
71521@@ -2583,6 +2609,10 @@ retry:
71522 && (vma->vm_flags & VM_SHARED)));
71523 set_huge_pte_at(mm, address, ptep, new_pte);
71524
71525+#ifdef CONFIG_PAX_SEGMEXEC
71526+ pax_mirror_huge_pte(vma, address, page);
71527+#endif
71528+
71529 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
71530 /* Optimization, do the COW without a second fault */
71531 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
71532@@ -2612,6 +2642,10 @@ int hugetlb_fault(struct mm_struct *mm,
71533 static DEFINE_MUTEX(hugetlb_instantiation_mutex);
71534 struct hstate *h = hstate_vma(vma);
71535
71536+#ifdef CONFIG_PAX_SEGMEXEC
71537+ struct vm_area_struct *vma_m;
71538+#endif
71539+
71540 ptep = huge_pte_offset(mm, address);
71541 if (ptep) {
71542 entry = huge_ptep_get(ptep);
71543@@ -2623,6 +2657,26 @@ int hugetlb_fault(struct mm_struct *mm,
71544 VM_FAULT_SET_HINDEX(h - hstates);
71545 }
71546
71547+#ifdef CONFIG_PAX_SEGMEXEC
71548+ vma_m = pax_find_mirror_vma(vma);
71549+ if (vma_m) {
71550+ unsigned long address_m;
71551+
71552+ if (vma->vm_start > vma_m->vm_start) {
71553+ address_m = address;
71554+ address -= SEGMEXEC_TASK_SIZE;
71555+ vma = vma_m;
71556+ h = hstate_vma(vma);
71557+ } else
71558+ address_m = address + SEGMEXEC_TASK_SIZE;
71559+
71560+ if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
71561+ return VM_FAULT_OOM;
71562+ address_m &= HPAGE_MASK;
71563+ unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
71564+ }
71565+#endif
71566+
71567 ptep = huge_pte_alloc(mm, address, huge_page_size(h));
71568 if (!ptep)
71569 return VM_FAULT_OOM;
71570diff -urNp linux-2.6.39.1/mm/Kconfig linux-2.6.39.1/mm/Kconfig
71571--- linux-2.6.39.1/mm/Kconfig 2011-05-19 00:06:34.000000000 -0400
71572+++ linux-2.6.39.1/mm/Kconfig 2011-05-22 19:41:42.000000000 -0400
71573@@ -240,7 +240,7 @@ config KSM
71574 config DEFAULT_MMAP_MIN_ADDR
71575 int "Low address space to protect from user allocation"
71576 depends on MMU
71577- default 4096
71578+ default 65536
71579 help
71580 This is the portion of low virtual memory which should be protected
71581 from userspace allocation. Keeping a user from writing to low pages
71582diff -urNp linux-2.6.39.1/mm/kmemleak.c linux-2.6.39.1/mm/kmemleak.c
71583--- linux-2.6.39.1/mm/kmemleak.c 2011-06-03 00:04:14.000000000 -0400
71584+++ linux-2.6.39.1/mm/kmemleak.c 2011-06-03 00:32:08.000000000 -0400
71585@@ -357,7 +357,7 @@ static void print_unreferenced(struct se
71586
71587 for (i = 0; i < object->trace_len; i++) {
71588 void *ptr = (void *)object->trace[i];
71589- seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
71590+ seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
71591 }
71592 }
71593
71594diff -urNp linux-2.6.39.1/mm/maccess.c linux-2.6.39.1/mm/maccess.c
71595--- linux-2.6.39.1/mm/maccess.c 2011-05-19 00:06:34.000000000 -0400
71596+++ linux-2.6.39.1/mm/maccess.c 2011-05-22 19:36:33.000000000 -0400
71597@@ -15,10 +15,10 @@
71598 * happens, handle that and return -EFAULT.
71599 */
71600
71601-long __weak probe_kernel_read(void *dst, void *src, size_t size)
71602+long __weak probe_kernel_read(void *dst, const void *src, size_t size)
71603 __attribute__((alias("__probe_kernel_read")));
71604
71605-long __probe_kernel_read(void *dst, void *src, size_t size)
71606+long __probe_kernel_read(void *dst, const void *src, size_t size)
71607 {
71608 long ret;
71609 mm_segment_t old_fs = get_fs();
71610@@ -43,10 +43,10 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
71611 * Safely write to address @dst from the buffer at @src. If a kernel fault
71612 * happens, handle that and return -EFAULT.
71613 */
71614-long __weak probe_kernel_write(void *dst, void *src, size_t size)
71615+long __weak probe_kernel_write(void *dst, const void *src, size_t size)
71616 __attribute__((alias("__probe_kernel_write")));
71617
71618-long __probe_kernel_write(void *dst, void *src, size_t size)
71619+long __probe_kernel_write(void *dst, const void *src, size_t size)
71620 {
71621 long ret;
71622 mm_segment_t old_fs = get_fs();
71623diff -urNp linux-2.6.39.1/mm/madvise.c linux-2.6.39.1/mm/madvise.c
71624--- linux-2.6.39.1/mm/madvise.c 2011-05-19 00:06:34.000000000 -0400
71625+++ linux-2.6.39.1/mm/madvise.c 2011-05-22 19:36:33.000000000 -0400
71626@@ -45,6 +45,10 @@ static long madvise_behavior(struct vm_a
71627 pgoff_t pgoff;
71628 unsigned long new_flags = vma->vm_flags;
71629
71630+#ifdef CONFIG_PAX_SEGMEXEC
71631+ struct vm_area_struct *vma_m;
71632+#endif
71633+
71634 switch (behavior) {
71635 case MADV_NORMAL:
71636 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
71637@@ -110,6 +114,13 @@ success:
71638 /*
71639 * vm_flags is protected by the mmap_sem held in write mode.
71640 */
71641+
71642+#ifdef CONFIG_PAX_SEGMEXEC
71643+ vma_m = pax_find_mirror_vma(vma);
71644+ if (vma_m)
71645+ vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
71646+#endif
71647+
71648 vma->vm_flags = new_flags;
71649
71650 out:
71651@@ -168,6 +179,11 @@ static long madvise_dontneed(struct vm_a
71652 struct vm_area_struct ** prev,
71653 unsigned long start, unsigned long end)
71654 {
71655+
71656+#ifdef CONFIG_PAX_SEGMEXEC
71657+ struct vm_area_struct *vma_m;
71658+#endif
71659+
71660 *prev = vma;
71661 if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
71662 return -EINVAL;
71663@@ -180,6 +196,21 @@ static long madvise_dontneed(struct vm_a
71664 zap_page_range(vma, start, end - start, &details);
71665 } else
71666 zap_page_range(vma, start, end - start, NULL);
71667+
71668+#ifdef CONFIG_PAX_SEGMEXEC
71669+ vma_m = pax_find_mirror_vma(vma);
71670+ if (vma_m) {
71671+ if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
71672+ struct zap_details details = {
71673+ .nonlinear_vma = vma_m,
71674+ .last_index = ULONG_MAX,
71675+ };
71676+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
71677+ } else
71678+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
71679+ }
71680+#endif
71681+
71682 return 0;
71683 }
71684
71685@@ -376,6 +407,16 @@ SYSCALL_DEFINE3(madvise, unsigned long,
71686 if (end < start)
71687 goto out;
71688
71689+#ifdef CONFIG_PAX_SEGMEXEC
71690+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
71691+ if (end > SEGMEXEC_TASK_SIZE)
71692+ goto out;
71693+ } else
71694+#endif
71695+
71696+ if (end > TASK_SIZE)
71697+ goto out;
71698+
71699 error = 0;
71700 if (end == start)
71701 goto out;
71702diff -urNp linux-2.6.39.1/mm/memory.c linux-2.6.39.1/mm/memory.c
71703--- linux-2.6.39.1/mm/memory.c 2011-05-19 00:06:34.000000000 -0400
71704+++ linux-2.6.39.1/mm/memory.c 2011-05-22 19:36:33.000000000 -0400
71705@@ -259,8 +259,12 @@ static inline void free_pmd_range(struct
71706 return;
71707
71708 pmd = pmd_offset(pud, start);
71709+
71710+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
71711 pud_clear(pud);
71712 pmd_free_tlb(tlb, pmd, start);
71713+#endif
71714+
71715 }
71716
71717 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
71718@@ -291,9 +295,12 @@ static inline void free_pud_range(struct
71719 if (end - 1 > ceiling - 1)
71720 return;
71721
71722+#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
71723 pud = pud_offset(pgd, start);
71724 pgd_clear(pgd);
71725 pud_free_tlb(tlb, pud, start);
71726+#endif
71727+
71728 }
71729
71730 /*
71731@@ -1410,12 +1417,6 @@ no_page_table:
71732 return page;
71733 }
71734
71735-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
71736-{
71737- return stack_guard_page_start(vma, addr) ||
71738- stack_guard_page_end(vma, addr+PAGE_SIZE);
71739-}
71740-
71741 /**
71742 * __get_user_pages() - pin user pages in memory
71743 * @tsk: task_struct of target task
71744@@ -1488,10 +1489,10 @@ int __get_user_pages(struct task_struct
71745 (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
71746 i = 0;
71747
71748- do {
71749+ while (nr_pages) {
71750 struct vm_area_struct *vma;
71751
71752- vma = find_extend_vma(mm, start);
71753+ vma = find_vma(mm, start);
71754 if (!vma && in_gate_area(mm, start)) {
71755 unsigned long pg = start & PAGE_MASK;
71756 pgd_t *pgd;
71757@@ -1539,7 +1540,7 @@ int __get_user_pages(struct task_struct
71758 goto next_page;
71759 }
71760
71761- if (!vma ||
71762+ if (!vma || start < vma->vm_start ||
71763 (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
71764 !(vm_flags & vma->vm_flags))
71765 return i ? : -EFAULT;
71766@@ -1566,11 +1567,6 @@ int __get_user_pages(struct task_struct
71767 int ret;
71768 unsigned int fault_flags = 0;
71769
71770- /* For mlock, just skip the stack guard page. */
71771- if (foll_flags & FOLL_MLOCK) {
71772- if (stack_guard_page(vma, start))
71773- goto next_page;
71774- }
71775 if (foll_flags & FOLL_WRITE)
71776 fault_flags |= FAULT_FLAG_WRITE;
71777 if (nonblocking)
71778@@ -1644,7 +1640,7 @@ next_page:
71779 start += PAGE_SIZE;
71780 nr_pages--;
71781 } while (nr_pages && start < vma->vm_end);
71782- } while (nr_pages);
71783+ }
71784 return i;
71785 }
71786 EXPORT_SYMBOL(__get_user_pages);
71787@@ -1795,6 +1791,10 @@ static int insert_page(struct vm_area_st
71788 page_add_file_rmap(page);
71789 set_pte_at(mm, addr, pte, mk_pte(page, prot));
71790
71791+#ifdef CONFIG_PAX_SEGMEXEC
71792+ pax_mirror_file_pte(vma, addr, page, ptl);
71793+#endif
71794+
71795 retval = 0;
71796 pte_unmap_unlock(pte, ptl);
71797 return retval;
71798@@ -1829,10 +1829,22 @@ out:
71799 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
71800 struct page *page)
71801 {
71802+
71803+#ifdef CONFIG_PAX_SEGMEXEC
71804+ struct vm_area_struct *vma_m;
71805+#endif
71806+
71807 if (addr < vma->vm_start || addr >= vma->vm_end)
71808 return -EFAULT;
71809 if (!page_count(page))
71810 return -EINVAL;
71811+
71812+#ifdef CONFIG_PAX_SEGMEXEC
71813+ vma_m = pax_find_mirror_vma(vma);
71814+ if (vma_m)
71815+ vma_m->vm_flags |= VM_INSERTPAGE;
71816+#endif
71817+
71818 vma->vm_flags |= VM_INSERTPAGE;
71819 return insert_page(vma, addr, page, vma->vm_page_prot);
71820 }
71821@@ -1918,6 +1930,7 @@ int vm_insert_mixed(struct vm_area_struc
71822 unsigned long pfn)
71823 {
71824 BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
71825+ BUG_ON(vma->vm_mirror);
71826
71827 if (addr < vma->vm_start || addr >= vma->vm_end)
71828 return -EFAULT;
71829@@ -2233,6 +2246,186 @@ static inline void cow_user_page(struct
71830 copy_user_highpage(dst, src, va, vma);
71831 }
71832
71833+#ifdef CONFIG_PAX_SEGMEXEC
71834+static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
71835+{
71836+ struct mm_struct *mm = vma->vm_mm;
71837+ spinlock_t *ptl;
71838+ pte_t *pte, entry;
71839+
71840+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
71841+ entry = *pte;
71842+ if (!pte_present(entry)) {
71843+ if (!pte_none(entry)) {
71844+ BUG_ON(pte_file(entry));
71845+ free_swap_and_cache(pte_to_swp_entry(entry));
71846+ pte_clear_not_present_full(mm, address, pte, 0);
71847+ }
71848+ } else {
71849+ struct page *page;
71850+
71851+ flush_cache_page(vma, address, pte_pfn(entry));
71852+ entry = ptep_clear_flush(vma, address, pte);
71853+ BUG_ON(pte_dirty(entry));
71854+ page = vm_normal_page(vma, address, entry);
71855+ if (page) {
71856+ update_hiwater_rss(mm);
71857+ if (PageAnon(page))
71858+ dec_mm_counter_fast(mm, MM_ANONPAGES);
71859+ else
71860+ dec_mm_counter_fast(mm, MM_FILEPAGES);
71861+ page_remove_rmap(page);
71862+ page_cache_release(page);
71863+ }
71864+ }
71865+ pte_unmap_unlock(pte, ptl);
71866+}
71867+
71868+/* PaX: if vma is mirrored, synchronize the mirror's PTE
71869+ *
71870+ * the ptl of the lower mapped page is held on entry and is not released on exit
71871+ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
71872+ */
71873+static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
71874+{
71875+ struct mm_struct *mm = vma->vm_mm;
71876+ unsigned long address_m;
71877+ spinlock_t *ptl_m;
71878+ struct vm_area_struct *vma_m;
71879+ pmd_t *pmd_m;
71880+ pte_t *pte_m, entry_m;
71881+
71882+ BUG_ON(!page_m || !PageAnon(page_m));
71883+
71884+ vma_m = pax_find_mirror_vma(vma);
71885+ if (!vma_m)
71886+ return;
71887+
71888+ BUG_ON(!PageLocked(page_m));
71889+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71890+ address_m = address + SEGMEXEC_TASK_SIZE;
71891+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
71892+ pte_m = pte_offset_map(pmd_m, address_m);
71893+ ptl_m = pte_lockptr(mm, pmd_m);
71894+ if (ptl != ptl_m) {
71895+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71896+ if (!pte_none(*pte_m))
71897+ goto out;
71898+ }
71899+
71900+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
71901+ page_cache_get(page_m);
71902+ page_add_anon_rmap(page_m, vma_m, address_m);
71903+ inc_mm_counter_fast(mm, MM_ANONPAGES);
71904+ set_pte_at(mm, address_m, pte_m, entry_m);
71905+ update_mmu_cache(vma_m, address_m, entry_m);
71906+out:
71907+ if (ptl != ptl_m)
71908+ spin_unlock(ptl_m);
71909+ pte_unmap(pte_m);
71910+ unlock_page(page_m);
71911+}
71912+
71913+void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
71914+{
71915+ struct mm_struct *mm = vma->vm_mm;
71916+ unsigned long address_m;
71917+ spinlock_t *ptl_m;
71918+ struct vm_area_struct *vma_m;
71919+ pmd_t *pmd_m;
71920+ pte_t *pte_m, entry_m;
71921+
71922+ BUG_ON(!page_m || PageAnon(page_m));
71923+
71924+ vma_m = pax_find_mirror_vma(vma);
71925+ if (!vma_m)
71926+ return;
71927+
71928+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71929+ address_m = address + SEGMEXEC_TASK_SIZE;
71930+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
71931+ pte_m = pte_offset_map(pmd_m, address_m);
71932+ ptl_m = pte_lockptr(mm, pmd_m);
71933+ if (ptl != ptl_m) {
71934+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71935+ if (!pte_none(*pte_m))
71936+ goto out;
71937+ }
71938+
71939+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
71940+ page_cache_get(page_m);
71941+ page_add_file_rmap(page_m);
71942+ inc_mm_counter_fast(mm, MM_FILEPAGES);
71943+ set_pte_at(mm, address_m, pte_m, entry_m);
71944+ update_mmu_cache(vma_m, address_m, entry_m);
71945+out:
71946+ if (ptl != ptl_m)
71947+ spin_unlock(ptl_m);
71948+ pte_unmap(pte_m);
71949+}
71950+
71951+static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
71952+{
71953+ struct mm_struct *mm = vma->vm_mm;
71954+ unsigned long address_m;
71955+ spinlock_t *ptl_m;
71956+ struct vm_area_struct *vma_m;
71957+ pmd_t *pmd_m;
71958+ pte_t *pte_m, entry_m;
71959+
71960+ vma_m = pax_find_mirror_vma(vma);
71961+ if (!vma_m)
71962+ return;
71963+
71964+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71965+ address_m = address + SEGMEXEC_TASK_SIZE;
71966+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
71967+ pte_m = pte_offset_map(pmd_m, address_m);
71968+ ptl_m = pte_lockptr(mm, pmd_m);
71969+ if (ptl != ptl_m) {
71970+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71971+ if (!pte_none(*pte_m))
71972+ goto out;
71973+ }
71974+
71975+ entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
71976+ set_pte_at(mm, address_m, pte_m, entry_m);
71977+out:
71978+ if (ptl != ptl_m)
71979+ spin_unlock(ptl_m);
71980+ pte_unmap(pte_m);
71981+}
71982+
71983+static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
71984+{
71985+ struct page *page_m;
71986+ pte_t entry;
71987+
71988+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
71989+ goto out;
71990+
71991+ entry = *pte;
71992+ page_m = vm_normal_page(vma, address, entry);
71993+ if (!page_m)
71994+ pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
71995+ else if (PageAnon(page_m)) {
71996+ if (pax_find_mirror_vma(vma)) {
71997+ pte_unmap_unlock(pte, ptl);
71998+ lock_page(page_m);
71999+ pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
72000+ if (pte_same(entry, *pte))
72001+ pax_mirror_anon_pte(vma, address, page_m, ptl);
72002+ else
72003+ unlock_page(page_m);
72004+ }
72005+ } else
72006+ pax_mirror_file_pte(vma, address, page_m, ptl);
72007+
72008+out:
72009+ pte_unmap_unlock(pte, ptl);
72010+}
72011+#endif
72012+
72013 /*
72014 * This routine handles present pages, when users try to write
72015 * to a shared page. It is done by copying the page to a new address
72016@@ -2444,6 +2637,12 @@ gotten:
72017 */
72018 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
72019 if (likely(pte_same(*page_table, orig_pte))) {
72020+
72021+#ifdef CONFIG_PAX_SEGMEXEC
72022+ if (pax_find_mirror_vma(vma))
72023+ BUG_ON(!trylock_page(new_page));
72024+#endif
72025+
72026 if (old_page) {
72027 if (!PageAnon(old_page)) {
72028 dec_mm_counter_fast(mm, MM_FILEPAGES);
72029@@ -2495,6 +2694,10 @@ gotten:
72030 page_remove_rmap(old_page);
72031 }
72032
72033+#ifdef CONFIG_PAX_SEGMEXEC
72034+ pax_mirror_anon_pte(vma, address, new_page, ptl);
72035+#endif
72036+
72037 /* Free the old page.. */
72038 new_page = old_page;
72039 ret |= VM_FAULT_WRITE;
72040@@ -2905,6 +3108,11 @@ static int do_swap_page(struct mm_struct
72041 swap_free(entry);
72042 if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
72043 try_to_free_swap(page);
72044+
72045+#ifdef CONFIG_PAX_SEGMEXEC
72046+ if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
72047+#endif
72048+
72049 unlock_page(page);
72050 if (swapcache) {
72051 /*
72052@@ -2928,6 +3136,11 @@ static int do_swap_page(struct mm_struct
72053
72054 /* No need to invalidate - it was non-present before */
72055 update_mmu_cache(vma, address, page_table);
72056+
72057+#ifdef CONFIG_PAX_SEGMEXEC
72058+ pax_mirror_anon_pte(vma, address, page, ptl);
72059+#endif
72060+
72061 unlock:
72062 pte_unmap_unlock(page_table, ptl);
72063 out:
72064@@ -2947,40 +3160,6 @@ out_release:
72065 }
72066
72067 /*
72068- * This is like a special single-page "expand_{down|up}wards()",
72069- * except we must first make sure that 'address{-|+}PAGE_SIZE'
72070- * doesn't hit another vma.
72071- */
72072-static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
72073-{
72074- address &= PAGE_MASK;
72075- if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
72076- struct vm_area_struct *prev = vma->vm_prev;
72077-
72078- /*
72079- * Is there a mapping abutting this one below?
72080- *
72081- * That's only ok if it's the same stack mapping
72082- * that has gotten split..
72083- */
72084- if (prev && prev->vm_end == address)
72085- return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
72086-
72087- expand_stack(vma, address - PAGE_SIZE);
72088- }
72089- if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
72090- struct vm_area_struct *next = vma->vm_next;
72091-
72092- /* As VM_GROWSDOWN but s/below/above/ */
72093- if (next && next->vm_start == address + PAGE_SIZE)
72094- return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
72095-
72096- expand_upwards(vma, address + PAGE_SIZE);
72097- }
72098- return 0;
72099-}
72100-
72101-/*
72102 * We enter with non-exclusive mmap_sem (to exclude vma changes,
72103 * but allow concurrent faults), and pte mapped but not yet locked.
72104 * We return with mmap_sem still held, but pte unmapped and unlocked.
72105@@ -2989,27 +3168,23 @@ static int do_anonymous_page(struct mm_s
72106 unsigned long address, pte_t *page_table, pmd_t *pmd,
72107 unsigned int flags)
72108 {
72109- struct page *page;
72110+ struct page *page = NULL;
72111 spinlock_t *ptl;
72112 pte_t entry;
72113
72114- pte_unmap(page_table);
72115-
72116- /* Check if we need to add a guard page to the stack */
72117- if (check_stack_guard_page(vma, address) < 0)
72118- return VM_FAULT_SIGBUS;
72119-
72120- /* Use the zero-page for reads */
72121 if (!(flags & FAULT_FLAG_WRITE)) {
72122 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
72123 vma->vm_page_prot));
72124- page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
72125+ ptl = pte_lockptr(mm, pmd);
72126+ spin_lock(ptl);
72127 if (!pte_none(*page_table))
72128 goto unlock;
72129 goto setpte;
72130 }
72131
72132 /* Allocate our own private page. */
72133+ pte_unmap(page_table);
72134+
72135 if (unlikely(anon_vma_prepare(vma)))
72136 goto oom;
72137 page = alloc_zeroed_user_highpage_movable(vma, address);
72138@@ -3028,6 +3203,11 @@ static int do_anonymous_page(struct mm_s
72139 if (!pte_none(*page_table))
72140 goto release;
72141
72142+#ifdef CONFIG_PAX_SEGMEXEC
72143+ if (pax_find_mirror_vma(vma))
72144+ BUG_ON(!trylock_page(page));
72145+#endif
72146+
72147 inc_mm_counter_fast(mm, MM_ANONPAGES);
72148 page_add_new_anon_rmap(page, vma, address);
72149 setpte:
72150@@ -3035,6 +3215,12 @@ setpte:
72151
72152 /* No need to invalidate - it was non-present before */
72153 update_mmu_cache(vma, address, page_table);
72154+
72155+#ifdef CONFIG_PAX_SEGMEXEC
72156+ if (page)
72157+ pax_mirror_anon_pte(vma, address, page, ptl);
72158+#endif
72159+
72160 unlock:
72161 pte_unmap_unlock(page_table, ptl);
72162 return 0;
72163@@ -3172,6 +3358,12 @@ static int __do_fault(struct mm_struct *
72164 */
72165 /* Only go through if we didn't race with anybody else... */
72166 if (likely(pte_same(*page_table, orig_pte))) {
72167+
72168+#ifdef CONFIG_PAX_SEGMEXEC
72169+ if (anon && pax_find_mirror_vma(vma))
72170+ BUG_ON(!trylock_page(page));
72171+#endif
72172+
72173 flush_icache_page(vma, page);
72174 entry = mk_pte(page, vma->vm_page_prot);
72175 if (flags & FAULT_FLAG_WRITE)
72176@@ -3191,6 +3383,14 @@ static int __do_fault(struct mm_struct *
72177
72178 /* no need to invalidate: a not-present page won't be cached */
72179 update_mmu_cache(vma, address, page_table);
72180+
72181+#ifdef CONFIG_PAX_SEGMEXEC
72182+ if (anon)
72183+ pax_mirror_anon_pte(vma, address, page, ptl);
72184+ else
72185+ pax_mirror_file_pte(vma, address, page, ptl);
72186+#endif
72187+
72188 } else {
72189 if (charged)
72190 mem_cgroup_uncharge_page(page);
72191@@ -3338,6 +3538,12 @@ int handle_pte_fault(struct mm_struct *m
72192 if (flags & FAULT_FLAG_WRITE)
72193 flush_tlb_fix_spurious_fault(vma, address);
72194 }
72195+
72196+#ifdef CONFIG_PAX_SEGMEXEC
72197+ pax_mirror_pte(vma, address, pte, pmd, ptl);
72198+ return 0;
72199+#endif
72200+
72201 unlock:
72202 pte_unmap_unlock(pte, ptl);
72203 return 0;
72204@@ -3354,6 +3560,10 @@ int handle_mm_fault(struct mm_struct *mm
72205 pmd_t *pmd;
72206 pte_t *pte;
72207
72208+#ifdef CONFIG_PAX_SEGMEXEC
72209+ struct vm_area_struct *vma_m;
72210+#endif
72211+
72212 __set_current_state(TASK_RUNNING);
72213
72214 count_vm_event(PGFAULT);
72215@@ -3364,6 +3574,34 @@ int handle_mm_fault(struct mm_struct *mm
72216 if (unlikely(is_vm_hugetlb_page(vma)))
72217 return hugetlb_fault(mm, vma, address, flags);
72218
72219+#ifdef CONFIG_PAX_SEGMEXEC
72220+ vma_m = pax_find_mirror_vma(vma);
72221+ if (vma_m) {
72222+ unsigned long address_m;
72223+ pgd_t *pgd_m;
72224+ pud_t *pud_m;
72225+ pmd_t *pmd_m;
72226+
72227+ if (vma->vm_start > vma_m->vm_start) {
72228+ address_m = address;
72229+ address -= SEGMEXEC_TASK_SIZE;
72230+ vma = vma_m;
72231+ } else
72232+ address_m = address + SEGMEXEC_TASK_SIZE;
72233+
72234+ pgd_m = pgd_offset(mm, address_m);
72235+ pud_m = pud_alloc(mm, pgd_m, address_m);
72236+ if (!pud_m)
72237+ return VM_FAULT_OOM;
72238+ pmd_m = pmd_alloc(mm, pud_m, address_m);
72239+ if (!pmd_m)
72240+ return VM_FAULT_OOM;
72241+ if (!pmd_present(*pmd_m) && __pte_alloc(mm, vma_m, pmd_m, address_m))
72242+ return VM_FAULT_OOM;
72243+ pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
72244+ }
72245+#endif
72246+
72247 pgd = pgd_offset(mm, address);
72248 pud = pud_alloc(mm, pgd, address);
72249 if (!pud)
72250@@ -3393,7 +3631,7 @@ int handle_mm_fault(struct mm_struct *mm
72251 * run pte_offset_map on the pmd, if an huge pmd could
72252 * materialize from under us from a different thread.
72253 */
72254- if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
72255+ if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
72256 return VM_FAULT_OOM;
72257 /* if an huge pmd materialized from under us just retry later */
72258 if (unlikely(pmd_trans_huge(*pmd)))
72259@@ -3497,7 +3735,7 @@ static int __init gate_vma_init(void)
72260 gate_vma.vm_start = FIXADDR_USER_START;
72261 gate_vma.vm_end = FIXADDR_USER_END;
72262 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
72263- gate_vma.vm_page_prot = __P101;
72264+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
72265 /*
72266 * Make sure the vDSO gets into every core dump.
72267 * Dumping its contents makes post-mortem fully interpretable later
72268diff -urNp linux-2.6.39.1/mm/memory-failure.c linux-2.6.39.1/mm/memory-failure.c
72269--- linux-2.6.39.1/mm/memory-failure.c 2011-05-19 00:06:34.000000000 -0400
72270+++ linux-2.6.39.1/mm/memory-failure.c 2011-05-22 19:36:33.000000000 -0400
72271@@ -58,7 +58,7 @@ int sysctl_memory_failure_early_kill __r
72272
72273 int sysctl_memory_failure_recovery __read_mostly = 1;
72274
72275-atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
72276+atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
72277
72278 #if defined(CONFIG_HWPOISON_INJECT) || defined(CONFIG_HWPOISON_INJECT_MODULE)
72279
72280@@ -1012,7 +1012,7 @@ int __memory_failure(unsigned long pfn,
72281 }
72282
72283 nr_pages = 1 << compound_trans_order(hpage);
72284- atomic_long_add(nr_pages, &mce_bad_pages);
72285+ atomic_long_add_unchecked(nr_pages, &mce_bad_pages);
72286
72287 /*
72288 * We need/can do nothing about count=0 pages.
72289@@ -1042,7 +1042,7 @@ int __memory_failure(unsigned long pfn,
72290 if (!PageHWPoison(hpage)
72291 || (hwpoison_filter(p) && TestClearPageHWPoison(p))
72292 || (p != hpage && TestSetPageHWPoison(hpage))) {
72293- atomic_long_sub(nr_pages, &mce_bad_pages);
72294+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72295 return 0;
72296 }
72297 set_page_hwpoison_huge_page(hpage);
72298@@ -1100,7 +1100,7 @@ int __memory_failure(unsigned long pfn,
72299 }
72300 if (hwpoison_filter(p)) {
72301 if (TestClearPageHWPoison(p))
72302- atomic_long_sub(nr_pages, &mce_bad_pages);
72303+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72304 unlock_page(hpage);
72305 put_page(hpage);
72306 return 0;
72307@@ -1226,7 +1226,7 @@ int unpoison_memory(unsigned long pfn)
72308 return 0;
72309 }
72310 if (TestClearPageHWPoison(p))
72311- atomic_long_sub(nr_pages, &mce_bad_pages);
72312+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72313 pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn);
72314 return 0;
72315 }
72316@@ -1240,7 +1240,7 @@ int unpoison_memory(unsigned long pfn)
72317 */
72318 if (TestClearPageHWPoison(page)) {
72319 pr_info("MCE: Software-unpoisoned page %#lx\n", pfn);
72320- atomic_long_sub(nr_pages, &mce_bad_pages);
72321+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72322 freeit = 1;
72323 if (PageHuge(page))
72324 clear_page_hwpoison_huge_page(page);
72325@@ -1353,7 +1353,7 @@ static int soft_offline_huge_page(struct
72326 }
72327 done:
72328 if (!PageHWPoison(hpage))
72329- atomic_long_add(1 << compound_trans_order(hpage), &mce_bad_pages);
72330+ atomic_long_add_unchecked(1 << compound_trans_order(hpage), &mce_bad_pages);
72331 set_page_hwpoison_huge_page(hpage);
72332 dequeue_hwpoisoned_huge_page(hpage);
72333 /* keep elevated page count for bad page */
72334@@ -1482,7 +1482,7 @@ int soft_offline_page(struct page *page,
72335 return ret;
72336
72337 done:
72338- atomic_long_add(1, &mce_bad_pages);
72339+ atomic_long_add_unchecked(1, &mce_bad_pages);
72340 SetPageHWPoison(page);
72341 /* keep elevated page count for bad page */
72342 return ret;
72343diff -urNp linux-2.6.39.1/mm/mempolicy.c linux-2.6.39.1/mm/mempolicy.c
72344--- linux-2.6.39.1/mm/mempolicy.c 2011-05-19 00:06:34.000000000 -0400
72345+++ linux-2.6.39.1/mm/mempolicy.c 2011-05-22 19:41:42.000000000 -0400
72346@@ -643,6 +643,10 @@ static int mbind_range(struct mm_struct
72347 unsigned long vmstart;
72348 unsigned long vmend;
72349
72350+#ifdef CONFIG_PAX_SEGMEXEC
72351+ struct vm_area_struct *vma_m;
72352+#endif
72353+
72354 vma = find_vma_prev(mm, start, &prev);
72355 if (!vma || vma->vm_start > start)
72356 return -EFAULT;
72357@@ -673,6 +677,16 @@ static int mbind_range(struct mm_struct
72358 err = policy_vma(vma, new_pol);
72359 if (err)
72360 goto out;
72361+
72362+#ifdef CONFIG_PAX_SEGMEXEC
72363+ vma_m = pax_find_mirror_vma(vma);
72364+ if (vma_m) {
72365+ err = policy_vma(vma_m, new_pol);
72366+ if (err)
72367+ goto out;
72368+ }
72369+#endif
72370+
72371 }
72372
72373 out:
72374@@ -1106,6 +1120,17 @@ static long do_mbind(unsigned long start
72375
72376 if (end < start)
72377 return -EINVAL;
72378+
72379+#ifdef CONFIG_PAX_SEGMEXEC
72380+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
72381+ if (end > SEGMEXEC_TASK_SIZE)
72382+ return -EINVAL;
72383+ } else
72384+#endif
72385+
72386+ if (end > TASK_SIZE)
72387+ return -EINVAL;
72388+
72389 if (end == start)
72390 return 0;
72391
72392@@ -1324,6 +1349,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
72393 if (!mm)
72394 goto out;
72395
72396+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
72397+ if (mm != current->mm &&
72398+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
72399+ err = -EPERM;
72400+ goto out;
72401+ }
72402+#endif
72403+
72404 /*
72405 * Check if this process has the right to modify the specified
72406 * process. The right exists if the process has administrative
72407@@ -1333,8 +1366,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
72408 rcu_read_lock();
72409 tcred = __task_cred(task);
72410 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
72411- cred->uid != tcred->suid && cred->uid != tcred->uid &&
72412- !capable(CAP_SYS_NICE)) {
72413+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
72414 rcu_read_unlock();
72415 err = -EPERM;
72416 goto out;
72417@@ -2634,7 +2666,7 @@ int show_numa_map(struct seq_file *m, vo
72418
72419 if (file) {
72420 seq_printf(m, " file=");
72421- seq_path(m, &file->f_path, "\n\t= ");
72422+ seq_path(m, &file->f_path, "\n\t\\= ");
72423 } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
72424 seq_printf(m, " heap");
72425 } else if (vma->vm_start <= mm->start_stack &&
72426diff -urNp linux-2.6.39.1/mm/migrate.c linux-2.6.39.1/mm/migrate.c
72427--- linux-2.6.39.1/mm/migrate.c 2011-05-19 00:06:34.000000000 -0400
72428+++ linux-2.6.39.1/mm/migrate.c 2011-05-22 19:41:42.000000000 -0400
72429@@ -1133,6 +1133,8 @@ static int do_pages_move(struct mm_struc
72430 unsigned long chunk_start;
72431 int err;
72432
72433+ pax_track_stack();
72434+
72435 task_nodes = cpuset_mems_allowed(task);
72436
72437 err = -ENOMEM;
72438@@ -1317,6 +1319,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
72439 if (!mm)
72440 return -EINVAL;
72441
72442+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
72443+ if (mm != current->mm &&
72444+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
72445+ err = -EPERM;
72446+ goto out;
72447+ }
72448+#endif
72449+
72450 /*
72451 * Check if this process has the right to modify the specified
72452 * process. The right exists if the process has administrative
72453@@ -1326,8 +1336,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
72454 rcu_read_lock();
72455 tcred = __task_cred(task);
72456 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
72457- cred->uid != tcred->suid && cred->uid != tcred->uid &&
72458- !capable(CAP_SYS_NICE)) {
72459+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
72460 rcu_read_unlock();
72461 err = -EPERM;
72462 goto out;
72463diff -urNp linux-2.6.39.1/mm/mlock.c linux-2.6.39.1/mm/mlock.c
72464--- linux-2.6.39.1/mm/mlock.c 2011-05-19 00:06:34.000000000 -0400
72465+++ linux-2.6.39.1/mm/mlock.c 2011-05-22 19:41:42.000000000 -0400
72466@@ -13,6 +13,7 @@
72467 #include <linux/pagemap.h>
72468 #include <linux/mempolicy.h>
72469 #include <linux/syscalls.h>
72470+#include <linux/security.h>
72471 #include <linux/sched.h>
72472 #include <linux/module.h>
72473 #include <linux/rmap.h>
72474@@ -377,6 +378,9 @@ static int do_mlock(unsigned long start,
72475 return -EINVAL;
72476 if (end == start)
72477 return 0;
72478+ if (end > TASK_SIZE)
72479+ return -EINVAL;
72480+
72481 vma = find_vma_prev(current->mm, start, &prev);
72482 if (!vma || vma->vm_start > start)
72483 return -ENOMEM;
72484@@ -387,6 +391,11 @@ static int do_mlock(unsigned long start,
72485 for (nstart = start ; ; ) {
72486 unsigned int newflags;
72487
72488+#ifdef CONFIG_PAX_SEGMEXEC
72489+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
72490+ break;
72491+#endif
72492+
72493 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
72494
72495 newflags = vma->vm_flags | VM_LOCKED;
72496@@ -492,6 +501,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
72497 lock_limit >>= PAGE_SHIFT;
72498
72499 /* check against resource limits */
72500+ gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
72501 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
72502 error = do_mlock(start, len, 1);
72503 up_write(&current->mm->mmap_sem);
72504@@ -515,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long,
72505 static int do_mlockall(int flags)
72506 {
72507 struct vm_area_struct * vma, * prev = NULL;
72508- unsigned int def_flags = 0;
72509
72510 if (flags & MCL_FUTURE)
72511- def_flags = VM_LOCKED;
72512- current->mm->def_flags = def_flags;
72513+ current->mm->def_flags |= VM_LOCKED;
72514+ else
72515+ current->mm->def_flags &= ~VM_LOCKED;
72516 if (flags == MCL_FUTURE)
72517 goto out;
72518
72519 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
72520- unsigned int newflags;
72521+ unsigned long newflags;
72522+
72523+#ifdef CONFIG_PAX_SEGMEXEC
72524+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
72525+ break;
72526+#endif
72527
72528+ BUG_ON(vma->vm_end > TASK_SIZE);
72529 newflags = vma->vm_flags | VM_LOCKED;
72530 if (!(flags & MCL_CURRENT))
72531 newflags &= ~VM_LOCKED;
72532@@ -557,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
72533 lock_limit >>= PAGE_SHIFT;
72534
72535 ret = -ENOMEM;
72536+ gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
72537 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
72538 capable(CAP_IPC_LOCK))
72539 ret = do_mlockall(flags);
72540diff -urNp linux-2.6.39.1/mm/mmap.c linux-2.6.39.1/mm/mmap.c
72541--- linux-2.6.39.1/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
72542+++ linux-2.6.39.1/mm/mmap.c 2011-05-22 19:41:42.000000000 -0400
72543@@ -46,6 +46,16 @@
72544 #define arch_rebalance_pgtables(addr, len) (addr)
72545 #endif
72546
72547+static inline void verify_mm_writelocked(struct mm_struct *mm)
72548+{
72549+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
72550+ if (unlikely(down_read_trylock(&mm->mmap_sem))) {
72551+ up_read(&mm->mmap_sem);
72552+ BUG();
72553+ }
72554+#endif
72555+}
72556+
72557 static void unmap_region(struct mm_struct *mm,
72558 struct vm_area_struct *vma, struct vm_area_struct *prev,
72559 unsigned long start, unsigned long end);
72560@@ -71,22 +81,32 @@ static void unmap_region(struct mm_struc
72561 * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
72562 *
72563 */
72564-pgprot_t protection_map[16] = {
72565+pgprot_t protection_map[16] __read_only = {
72566 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
72567 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
72568 };
72569
72570 pgprot_t vm_get_page_prot(unsigned long vm_flags)
72571 {
72572- return __pgprot(pgprot_val(protection_map[vm_flags &
72573+ pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
72574 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
72575 pgprot_val(arch_vm_get_page_prot(vm_flags)));
72576+
72577+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72578+ if (!(__supported_pte_mask & _PAGE_NX) &&
72579+ (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
72580+ (vm_flags & (VM_READ | VM_WRITE)))
72581+ prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
72582+#endif
72583+
72584+ return prot;
72585 }
72586 EXPORT_SYMBOL(vm_get_page_prot);
72587
72588 int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
72589 int sysctl_overcommit_ratio = 50; /* default is 50% */
72590 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
72591+unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
72592 struct percpu_counter vm_committed_as;
72593
72594 /*
72595@@ -232,6 +252,7 @@ static struct vm_area_struct *remove_vma
72596 struct vm_area_struct *next = vma->vm_next;
72597
72598 might_sleep();
72599+ BUG_ON(vma->vm_mirror);
72600 if (vma->vm_ops && vma->vm_ops->close)
72601 vma->vm_ops->close(vma);
72602 if (vma->vm_file) {
72603@@ -276,6 +297,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
72604 * not page aligned -Ram Gupta
72605 */
72606 rlim = rlimit(RLIMIT_DATA);
72607+ gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
72608 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
72609 (mm->end_data - mm->start_data) > rlim)
72610 goto out;
72611@@ -719,6 +741,12 @@ static int
72612 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
72613 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
72614 {
72615+
72616+#ifdef CONFIG_PAX_SEGMEXEC
72617+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
72618+ return 0;
72619+#endif
72620+
72621 if (is_mergeable_vma(vma, file, vm_flags) &&
72622 is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
72623 if (vma->vm_pgoff == vm_pgoff)
72624@@ -738,6 +766,12 @@ static int
72625 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
72626 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
72627 {
72628+
72629+#ifdef CONFIG_PAX_SEGMEXEC
72630+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
72631+ return 0;
72632+#endif
72633+
72634 if (is_mergeable_vma(vma, file, vm_flags) &&
72635 is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
72636 pgoff_t vm_pglen;
72637@@ -780,13 +814,20 @@ can_vma_merge_after(struct vm_area_struc
72638 struct vm_area_struct *vma_merge(struct mm_struct *mm,
72639 struct vm_area_struct *prev, unsigned long addr,
72640 unsigned long end, unsigned long vm_flags,
72641- struct anon_vma *anon_vma, struct file *file,
72642+ struct anon_vma *anon_vma, struct file *file,
72643 pgoff_t pgoff, struct mempolicy *policy)
72644 {
72645 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
72646 struct vm_area_struct *area, *next;
72647 int err;
72648
72649+#ifdef CONFIG_PAX_SEGMEXEC
72650+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
72651+ struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
72652+
72653+ BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
72654+#endif
72655+
72656 /*
72657 * We later require that vma->vm_flags == vm_flags,
72658 * so this tests vma->vm_flags & VM_SPECIAL, too.
72659@@ -802,6 +843,15 @@ struct vm_area_struct *vma_merge(struct
72660 if (next && next->vm_end == end) /* cases 6, 7, 8 */
72661 next = next->vm_next;
72662
72663+#ifdef CONFIG_PAX_SEGMEXEC
72664+ if (prev)
72665+ prev_m = pax_find_mirror_vma(prev);
72666+ if (area)
72667+ area_m = pax_find_mirror_vma(area);
72668+ if (next)
72669+ next_m = pax_find_mirror_vma(next);
72670+#endif
72671+
72672 /*
72673 * Can it merge with the predecessor?
72674 */
72675@@ -821,9 +871,24 @@ struct vm_area_struct *vma_merge(struct
72676 /* cases 1, 6 */
72677 err = vma_adjust(prev, prev->vm_start,
72678 next->vm_end, prev->vm_pgoff, NULL);
72679- } else /* cases 2, 5, 7 */
72680+
72681+#ifdef CONFIG_PAX_SEGMEXEC
72682+ if (!err && prev_m)
72683+ err = vma_adjust(prev_m, prev_m->vm_start,
72684+ next_m->vm_end, prev_m->vm_pgoff, NULL);
72685+#endif
72686+
72687+ } else { /* cases 2, 5, 7 */
72688 err = vma_adjust(prev, prev->vm_start,
72689 end, prev->vm_pgoff, NULL);
72690+
72691+#ifdef CONFIG_PAX_SEGMEXEC
72692+ if (!err && prev_m)
72693+ err = vma_adjust(prev_m, prev_m->vm_start,
72694+ end_m, prev_m->vm_pgoff, NULL);
72695+#endif
72696+
72697+ }
72698 if (err)
72699 return NULL;
72700 khugepaged_enter_vma_merge(prev);
72701@@ -837,12 +902,27 @@ struct vm_area_struct *vma_merge(struct
72702 mpol_equal(policy, vma_policy(next)) &&
72703 can_vma_merge_before(next, vm_flags,
72704 anon_vma, file, pgoff+pglen)) {
72705- if (prev && addr < prev->vm_end) /* case 4 */
72706+ if (prev && addr < prev->vm_end) { /* case 4 */
72707 err = vma_adjust(prev, prev->vm_start,
72708 addr, prev->vm_pgoff, NULL);
72709- else /* cases 3, 8 */
72710+
72711+#ifdef CONFIG_PAX_SEGMEXEC
72712+ if (!err && prev_m)
72713+ err = vma_adjust(prev_m, prev_m->vm_start,
72714+ addr_m, prev_m->vm_pgoff, NULL);
72715+#endif
72716+
72717+ } else { /* cases 3, 8 */
72718 err = vma_adjust(area, addr, next->vm_end,
72719 next->vm_pgoff - pglen, NULL);
72720+
72721+#ifdef CONFIG_PAX_SEGMEXEC
72722+ if (!err && area_m)
72723+ err = vma_adjust(area_m, addr_m, next_m->vm_end,
72724+ next_m->vm_pgoff - pglen, NULL);
72725+#endif
72726+
72727+ }
72728 if (err)
72729 return NULL;
72730 khugepaged_enter_vma_merge(area);
72731@@ -958,14 +1038,11 @@ none:
72732 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
72733 struct file *file, long pages)
72734 {
72735- const unsigned long stack_flags
72736- = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
72737-
72738 if (file) {
72739 mm->shared_vm += pages;
72740 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
72741 mm->exec_vm += pages;
72742- } else if (flags & stack_flags)
72743+ } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
72744 mm->stack_vm += pages;
72745 if (flags & (VM_RESERVED|VM_IO))
72746 mm->reserved_vm += pages;
72747@@ -992,7 +1069,7 @@ unsigned long do_mmap_pgoff(struct file
72748 * (the exception is when the underlying filesystem is noexec
72749 * mounted, in which case we dont add PROT_EXEC.)
72750 */
72751- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
72752+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
72753 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
72754 prot |= PROT_EXEC;
72755
72756@@ -1018,7 +1095,7 @@ unsigned long do_mmap_pgoff(struct file
72757 /* Obtain the address to map to. we verify (or select) it and ensure
72758 * that it represents a valid section of the address space.
72759 */
72760- addr = get_unmapped_area(file, addr, len, pgoff, flags);
72761+ addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
72762 if (addr & ~PAGE_MASK)
72763 return addr;
72764
72765@@ -1029,6 +1106,36 @@ unsigned long do_mmap_pgoff(struct file
72766 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
72767 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
72768
72769+#ifdef CONFIG_PAX_MPROTECT
72770+ if (mm->pax_flags & MF_PAX_MPROTECT) {
72771+#ifndef CONFIG_PAX_MPROTECT_COMPAT
72772+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
72773+ gr_log_rwxmmap(file);
72774+
72775+#ifdef CONFIG_PAX_EMUPLT
72776+ vm_flags &= ~VM_EXEC;
72777+#else
72778+ return -EPERM;
72779+#endif
72780+
72781+ }
72782+
72783+ if (!(vm_flags & VM_EXEC))
72784+ vm_flags &= ~VM_MAYEXEC;
72785+#else
72786+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
72787+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
72788+#endif
72789+ else
72790+ vm_flags &= ~VM_MAYWRITE;
72791+ }
72792+#endif
72793+
72794+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72795+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
72796+ vm_flags &= ~VM_PAGEEXEC;
72797+#endif
72798+
72799 if (flags & MAP_LOCKED)
72800 if (!can_do_mlock())
72801 return -EPERM;
72802@@ -1040,6 +1147,7 @@ unsigned long do_mmap_pgoff(struct file
72803 locked += mm->locked_vm;
72804 lock_limit = rlimit(RLIMIT_MEMLOCK);
72805 lock_limit >>= PAGE_SHIFT;
72806+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
72807 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
72808 return -EAGAIN;
72809 }
72810@@ -1110,6 +1218,9 @@ unsigned long do_mmap_pgoff(struct file
72811 if (error)
72812 return error;
72813
72814+ if (!gr_acl_handle_mmap(file, prot))
72815+ return -EACCES;
72816+
72817 return mmap_region(file, addr, len, flags, vm_flags, pgoff);
72818 }
72819 EXPORT_SYMBOL(do_mmap_pgoff);
72820@@ -1187,10 +1298,10 @@ SYSCALL_DEFINE1(old_mmap, struct mmap_ar
72821 */
72822 int vma_wants_writenotify(struct vm_area_struct *vma)
72823 {
72824- unsigned int vm_flags = vma->vm_flags;
72825+ unsigned long vm_flags = vma->vm_flags;
72826
72827 /* If it was private or non-writable, the write bit is already clear */
72828- if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
72829+ if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
72830 return 0;
72831
72832 /* The backer wishes to know when pages are first written to? */
72833@@ -1239,14 +1350,24 @@ unsigned long mmap_region(struct file *f
72834 unsigned long charged = 0;
72835 struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
72836
72837+#ifdef CONFIG_PAX_SEGMEXEC
72838+ struct vm_area_struct *vma_m = NULL;
72839+#endif
72840+
72841+ /*
72842+ * mm->mmap_sem is required to protect against another thread
72843+ * changing the mappings in case we sleep.
72844+ */
72845+ verify_mm_writelocked(mm);
72846+
72847 /* Clear old maps */
72848 error = -ENOMEM;
72849-munmap_back:
72850 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72851 if (vma && vma->vm_start < addr + len) {
72852 if (do_munmap(mm, addr, len))
72853 return -ENOMEM;
72854- goto munmap_back;
72855+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72856+ BUG_ON(vma && vma->vm_start < addr + len);
72857 }
72858
72859 /* Check against address space limit. */
72860@@ -1295,6 +1416,16 @@ munmap_back:
72861 goto unacct_error;
72862 }
72863
72864+#ifdef CONFIG_PAX_SEGMEXEC
72865+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
72866+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72867+ if (!vma_m) {
72868+ error = -ENOMEM;
72869+ goto free_vma;
72870+ }
72871+ }
72872+#endif
72873+
72874 vma->vm_mm = mm;
72875 vma->vm_start = addr;
72876 vma->vm_end = addr + len;
72877@@ -1318,6 +1449,19 @@ munmap_back:
72878 error = file->f_op->mmap(file, vma);
72879 if (error)
72880 goto unmap_and_free_vma;
72881+
72882+#ifdef CONFIG_PAX_SEGMEXEC
72883+ if (vma_m && (vm_flags & VM_EXECUTABLE))
72884+ added_exe_file_vma(mm);
72885+#endif
72886+
72887+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72888+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
72889+ vma->vm_flags |= VM_PAGEEXEC;
72890+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
72891+ }
72892+#endif
72893+
72894 if (vm_flags & VM_EXECUTABLE)
72895 added_exe_file_vma(mm);
72896
72897@@ -1353,6 +1497,11 @@ munmap_back:
72898 vma_link(mm, vma, prev, rb_link, rb_parent);
72899 file = vma->vm_file;
72900
72901+#ifdef CONFIG_PAX_SEGMEXEC
72902+ if (vma_m)
72903+ BUG_ON(pax_mirror_vma(vma_m, vma));
72904+#endif
72905+
72906 /* Once vma denies write, undo our temporary denial count */
72907 if (correct_wcount)
72908 atomic_inc(&inode->i_writecount);
72909@@ -1361,6 +1510,7 @@ out:
72910
72911 mm->total_vm += len >> PAGE_SHIFT;
72912 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
72913+ track_exec_limit(mm, addr, addr + len, vm_flags);
72914 if (vm_flags & VM_LOCKED) {
72915 if (!mlock_vma_pages_range(vma, addr, addr + len))
72916 mm->locked_vm += (len >> PAGE_SHIFT);
72917@@ -1378,6 +1528,12 @@ unmap_and_free_vma:
72918 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
72919 charged = 0;
72920 free_vma:
72921+
72922+#ifdef CONFIG_PAX_SEGMEXEC
72923+ if (vma_m)
72924+ kmem_cache_free(vm_area_cachep, vma_m);
72925+#endif
72926+
72927 kmem_cache_free(vm_area_cachep, vma);
72928 unacct_error:
72929 if (charged)
72930@@ -1385,6 +1541,44 @@ unacct_error:
72931 return error;
72932 }
72933
72934+bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
72935+{
72936+ if (!vma) {
72937+#ifdef CONFIG_STACK_GROWSUP
72938+ if (addr > sysctl_heap_stack_gap)
72939+ vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
72940+ else
72941+ vma = find_vma(current->mm, 0);
72942+ if (vma && (vma->vm_flags & VM_GROWSUP))
72943+ return false;
72944+#endif
72945+ return true;
72946+ }
72947+
72948+ if (addr + len > vma->vm_start)
72949+ return false;
72950+
72951+ if (vma->vm_flags & VM_GROWSDOWN)
72952+ return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
72953+#ifdef CONFIG_STACK_GROWSUP
72954+ else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
72955+ return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
72956+#endif
72957+
72958+ return true;
72959+}
72960+
72961+unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
72962+{
72963+ if (vma->vm_start < len)
72964+ return -ENOMEM;
72965+ if (!(vma->vm_flags & VM_GROWSDOWN))
72966+ return vma->vm_start - len;
72967+ if (sysctl_heap_stack_gap <= vma->vm_start - len)
72968+ return vma->vm_start - len - sysctl_heap_stack_gap;
72969+ return -ENOMEM;
72970+}
72971+
72972 /* Get an address range which is currently unmapped.
72973 * For shmat() with addr=0.
72974 *
72975@@ -1411,18 +1605,23 @@ arch_get_unmapped_area(struct file *filp
72976 if (flags & MAP_FIXED)
72977 return addr;
72978
72979+#ifdef CONFIG_PAX_RANDMMAP
72980+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
72981+#endif
72982+
72983 if (addr) {
72984 addr = PAGE_ALIGN(addr);
72985- vma = find_vma(mm, addr);
72986- if (TASK_SIZE - len >= addr &&
72987- (!vma || addr + len <= vma->vm_start))
72988- return addr;
72989+ if (TASK_SIZE - len >= addr) {
72990+ vma = find_vma(mm, addr);
72991+ if (check_heap_stack_gap(vma, addr, len))
72992+ return addr;
72993+ }
72994 }
72995 if (len > mm->cached_hole_size) {
72996- start_addr = addr = mm->free_area_cache;
72997+ start_addr = addr = mm->free_area_cache;
72998 } else {
72999- start_addr = addr = TASK_UNMAPPED_BASE;
73000- mm->cached_hole_size = 0;
73001+ start_addr = addr = mm->mmap_base;
73002+ mm->cached_hole_size = 0;
73003 }
73004
73005 full_search:
73006@@ -1433,34 +1632,40 @@ full_search:
73007 * Start a new search - just in case we missed
73008 * some holes.
73009 */
73010- if (start_addr != TASK_UNMAPPED_BASE) {
73011- addr = TASK_UNMAPPED_BASE;
73012- start_addr = addr;
73013+ if (start_addr != mm->mmap_base) {
73014+ start_addr = addr = mm->mmap_base;
73015 mm->cached_hole_size = 0;
73016 goto full_search;
73017 }
73018 return -ENOMEM;
73019 }
73020- if (!vma || addr + len <= vma->vm_start) {
73021- /*
73022- * Remember the place where we stopped the search:
73023- */
73024- mm->free_area_cache = addr + len;
73025- return addr;
73026- }
73027+ if (check_heap_stack_gap(vma, addr, len))
73028+ break;
73029 if (addr + mm->cached_hole_size < vma->vm_start)
73030 mm->cached_hole_size = vma->vm_start - addr;
73031 addr = vma->vm_end;
73032 }
73033+
73034+ /*
73035+ * Remember the place where we stopped the search:
73036+ */
73037+ mm->free_area_cache = addr + len;
73038+ return addr;
73039 }
73040 #endif
73041
73042 void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
73043 {
73044+
73045+#ifdef CONFIG_PAX_SEGMEXEC
73046+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
73047+ return;
73048+#endif
73049+
73050 /*
73051 * Is this a new hole at the lowest possible address?
73052 */
73053- if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
73054+ if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
73055 mm->free_area_cache = addr;
73056 mm->cached_hole_size = ~0UL;
73057 }
73058@@ -1478,7 +1683,7 @@ arch_get_unmapped_area_topdown(struct fi
73059 {
73060 struct vm_area_struct *vma;
73061 struct mm_struct *mm = current->mm;
73062- unsigned long addr = addr0;
73063+ unsigned long base = mm->mmap_base, addr = addr0;
73064
73065 /* requested length too big for entire address space */
73066 if (len > TASK_SIZE)
73067@@ -1487,13 +1692,18 @@ arch_get_unmapped_area_topdown(struct fi
73068 if (flags & MAP_FIXED)
73069 return addr;
73070
73071+#ifdef CONFIG_PAX_RANDMMAP
73072+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
73073+#endif
73074+
73075 /* requesting a specific address */
73076 if (addr) {
73077 addr = PAGE_ALIGN(addr);
73078- vma = find_vma(mm, addr);
73079- if (TASK_SIZE - len >= addr &&
73080- (!vma || addr + len <= vma->vm_start))
73081- return addr;
73082+ if (TASK_SIZE - len >= addr) {
73083+ vma = find_vma(mm, addr);
73084+ if (check_heap_stack_gap(vma, addr, len))
73085+ return addr;
73086+ }
73087 }
73088
73089 /* check if free_area_cache is useful for us */
73090@@ -1508,7 +1718,7 @@ arch_get_unmapped_area_topdown(struct fi
73091 /* make sure it can fit in the remaining address space */
73092 if (addr > len) {
73093 vma = find_vma(mm, addr-len);
73094- if (!vma || addr <= vma->vm_start)
73095+ if (check_heap_stack_gap(vma, addr - len, len))
73096 /* remember the address as a hint for next time */
73097 return (mm->free_area_cache = addr-len);
73098 }
73099@@ -1525,7 +1735,7 @@ arch_get_unmapped_area_topdown(struct fi
73100 * return with success:
73101 */
73102 vma = find_vma(mm, addr);
73103- if (!vma || addr+len <= vma->vm_start)
73104+ if (check_heap_stack_gap(vma, addr, len))
73105 /* remember the address as a hint for next time */
73106 return (mm->free_area_cache = addr);
73107
73108@@ -1534,8 +1744,8 @@ arch_get_unmapped_area_topdown(struct fi
73109 mm->cached_hole_size = vma->vm_start - addr;
73110
73111 /* try just below the current vma->vm_start */
73112- addr = vma->vm_start-len;
73113- } while (len < vma->vm_start);
73114+ addr = skip_heap_stack_gap(vma, len);
73115+ } while (!IS_ERR_VALUE(addr));
73116
73117 bottomup:
73118 /*
73119@@ -1544,13 +1754,21 @@ bottomup:
73120 * can happen with large stack limits and large mmap()
73121 * allocations.
73122 */
73123+ mm->mmap_base = TASK_UNMAPPED_BASE;
73124+
73125+#ifdef CONFIG_PAX_RANDMMAP
73126+ if (mm->pax_flags & MF_PAX_RANDMMAP)
73127+ mm->mmap_base += mm->delta_mmap;
73128+#endif
73129+
73130+ mm->free_area_cache = mm->mmap_base;
73131 mm->cached_hole_size = ~0UL;
73132- mm->free_area_cache = TASK_UNMAPPED_BASE;
73133 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
73134 /*
73135 * Restore the topdown base:
73136 */
73137- mm->free_area_cache = mm->mmap_base;
73138+ mm->mmap_base = base;
73139+ mm->free_area_cache = base;
73140 mm->cached_hole_size = ~0UL;
73141
73142 return addr;
73143@@ -1559,6 +1777,12 @@ bottomup:
73144
73145 void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
73146 {
73147+
73148+#ifdef CONFIG_PAX_SEGMEXEC
73149+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
73150+ return;
73151+#endif
73152+
73153 /*
73154 * Is this a new hole at the highest possible address?
73155 */
73156@@ -1566,8 +1790,10 @@ void arch_unmap_area_topdown(struct mm_s
73157 mm->free_area_cache = addr;
73158
73159 /* dont allow allocations above current base */
73160- if (mm->free_area_cache > mm->mmap_base)
73161+ if (mm->free_area_cache > mm->mmap_base) {
73162 mm->free_area_cache = mm->mmap_base;
73163+ mm->cached_hole_size = ~0UL;
73164+ }
73165 }
73166
73167 unsigned long
73168@@ -1675,6 +1901,28 @@ out:
73169 return prev ? prev->vm_next : vma;
73170 }
73171
73172+#ifdef CONFIG_PAX_SEGMEXEC
73173+struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
73174+{
73175+ struct vm_area_struct *vma_m;
73176+
73177+ BUG_ON(!vma || vma->vm_start >= vma->vm_end);
73178+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
73179+ BUG_ON(vma->vm_mirror);
73180+ return NULL;
73181+ }
73182+ BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
73183+ vma_m = vma->vm_mirror;
73184+ BUG_ON(!vma_m || vma_m->vm_mirror != vma);
73185+ BUG_ON(vma->vm_file != vma_m->vm_file);
73186+ BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
73187+ BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff);
73188+ BUG_ON(vma->anon_vma != vma_m->anon_vma && vma->anon_vma->root != vma_m->anon_vma->root);
73189+ BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
73190+ return vma_m;
73191+}
73192+#endif
73193+
73194 /*
73195 * Verify that the stack growth is acceptable and
73196 * update accounting. This is shared with both the
73197@@ -1691,6 +1939,7 @@ static int acct_stack_growth(struct vm_a
73198 return -ENOMEM;
73199
73200 /* Stack limit test */
73201+ gr_learn_resource(current, RLIMIT_STACK, size, 1);
73202 if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
73203 return -ENOMEM;
73204
73205@@ -1701,6 +1950,7 @@ static int acct_stack_growth(struct vm_a
73206 locked = mm->locked_vm + grow;
73207 limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
73208 limit >>= PAGE_SHIFT;
73209+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
73210 if (locked > limit && !capable(CAP_IPC_LOCK))
73211 return -ENOMEM;
73212 }
73213@@ -1731,37 +1981,48 @@ static int acct_stack_growth(struct vm_a
73214 * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
73215 * vma is the last one with address > vma->vm_end. Have to extend vma.
73216 */
73217+#ifndef CONFIG_IA64
73218+static
73219+#endif
73220 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
73221 {
73222 int error;
73223+ bool locknext;
73224
73225 if (!(vma->vm_flags & VM_GROWSUP))
73226 return -EFAULT;
73227
73228+ /* Also guard against wrapping around to address 0. */
73229+ if (address < PAGE_ALIGN(address+1))
73230+ address = PAGE_ALIGN(address+1);
73231+ else
73232+ return -ENOMEM;
73233+
73234 /*
73235 * We must make sure the anon_vma is allocated
73236 * so that the anon_vma locking is not a noop.
73237 */
73238 if (unlikely(anon_vma_prepare(vma)))
73239 return -ENOMEM;
73240+ locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
73241+ if (locknext && anon_vma_prepare(vma->vm_next))
73242+ return -ENOMEM;
73243 vma_lock_anon_vma(vma);
73244+ if (locknext)
73245+ vma_lock_anon_vma(vma->vm_next);
73246
73247 /*
73248 * vma->vm_start/vm_end cannot change under us because the caller
73249 * is required to hold the mmap_sem in read mode. We need the
73250- * anon_vma lock to serialize against concurrent expand_stacks.
73251- * Also guard against wrapping around to address 0.
73252+ * anon_vma locks to serialize against concurrent expand_stacks
73253+ * and expand_upwards.
73254 */
73255- if (address < PAGE_ALIGN(address+4))
73256- address = PAGE_ALIGN(address+4);
73257- else {
73258- vma_unlock_anon_vma(vma);
73259- return -ENOMEM;
73260- }
73261 error = 0;
73262
73263 /* Somebody else might have raced and expanded it already */
73264- if (address > vma->vm_end) {
73265+ if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
73266+ error = -ENOMEM;
73267+ else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
73268 unsigned long size, grow;
73269
73270 size = address - vma->vm_start;
73271@@ -1776,6 +2037,8 @@ int expand_upwards(struct vm_area_struct
73272 }
73273 }
73274 }
73275+ if (locknext)
73276+ vma_unlock_anon_vma(vma->vm_next);
73277 vma_unlock_anon_vma(vma);
73278 khugepaged_enter_vma_merge(vma);
73279 return error;
73280@@ -1789,6 +2052,8 @@ static int expand_downwards(struct vm_ar
73281 unsigned long address)
73282 {
73283 int error;
73284+ bool lockprev = false;
73285+ struct vm_area_struct *prev;
73286
73287 /*
73288 * We must make sure the anon_vma is allocated
73289@@ -1802,6 +2067,15 @@ static int expand_downwards(struct vm_ar
73290 if (error)
73291 return error;
73292
73293+ prev = vma->vm_prev;
73294+#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
73295+ lockprev = prev && (prev->vm_flags & VM_GROWSUP);
73296+#endif
73297+ if (lockprev && anon_vma_prepare(prev))
73298+ return -ENOMEM;
73299+ if (lockprev)
73300+ vma_lock_anon_vma(prev);
73301+
73302 vma_lock_anon_vma(vma);
73303
73304 /*
73305@@ -1811,9 +2085,17 @@ static int expand_downwards(struct vm_ar
73306 */
73307
73308 /* Somebody else might have raced and expanded it already */
73309- if (address < vma->vm_start) {
73310+ if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
73311+ error = -ENOMEM;
73312+ else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
73313 unsigned long size, grow;
73314
73315+#ifdef CONFIG_PAX_SEGMEXEC
73316+ struct vm_area_struct *vma_m;
73317+
73318+ vma_m = pax_find_mirror_vma(vma);
73319+#endif
73320+
73321 size = vma->vm_end - address;
73322 grow = (vma->vm_start - address) >> PAGE_SHIFT;
73323
73324@@ -1823,11 +2105,22 @@ static int expand_downwards(struct vm_ar
73325 if (!error) {
73326 vma->vm_start = address;
73327 vma->vm_pgoff -= grow;
73328+ track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
73329+
73330+#ifdef CONFIG_PAX_SEGMEXEC
73331+ if (vma_m) {
73332+ vma_m->vm_start -= grow << PAGE_SHIFT;
73333+ vma_m->vm_pgoff -= grow;
73334+ }
73335+#endif
73336+
73337 perf_event_mmap(vma);
73338 }
73339 }
73340 }
73341 vma_unlock_anon_vma(vma);
73342+ if (lockprev)
73343+ vma_unlock_anon_vma(prev);
73344 khugepaged_enter_vma_merge(vma);
73345 return error;
73346 }
73347@@ -1902,6 +2195,13 @@ static void remove_vma_list(struct mm_st
73348 do {
73349 long nrpages = vma_pages(vma);
73350
73351+#ifdef CONFIG_PAX_SEGMEXEC
73352+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
73353+ vma = remove_vma(vma);
73354+ continue;
73355+ }
73356+#endif
73357+
73358 mm->total_vm -= nrpages;
73359 vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
73360 vma = remove_vma(vma);
73361@@ -1947,6 +2247,16 @@ detach_vmas_to_be_unmapped(struct mm_str
73362 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
73363 vma->vm_prev = NULL;
73364 do {
73365+
73366+#ifdef CONFIG_PAX_SEGMEXEC
73367+ if (vma->vm_mirror) {
73368+ BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
73369+ vma->vm_mirror->vm_mirror = NULL;
73370+ vma->vm_mirror->vm_flags &= ~VM_EXEC;
73371+ vma->vm_mirror = NULL;
73372+ }
73373+#endif
73374+
73375 rb_erase(&vma->vm_rb, &mm->mm_rb);
73376 mm->map_count--;
73377 tail_vma = vma;
73378@@ -1975,14 +2285,33 @@ static int __split_vma(struct mm_struct
73379 struct vm_area_struct *new;
73380 int err = -ENOMEM;
73381
73382+#ifdef CONFIG_PAX_SEGMEXEC
73383+ struct vm_area_struct *vma_m, *new_m = NULL;
73384+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
73385+#endif
73386+
73387 if (is_vm_hugetlb_page(vma) && (addr &
73388 ~(huge_page_mask(hstate_vma(vma)))))
73389 return -EINVAL;
73390
73391+#ifdef CONFIG_PAX_SEGMEXEC
73392+ vma_m = pax_find_mirror_vma(vma);
73393+#endif
73394+
73395 new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
73396 if (!new)
73397 goto out_err;
73398
73399+#ifdef CONFIG_PAX_SEGMEXEC
73400+ if (vma_m) {
73401+ new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
73402+ if (!new_m) {
73403+ kmem_cache_free(vm_area_cachep, new);
73404+ goto out_err;
73405+ }
73406+ }
73407+#endif
73408+
73409 /* most fields are the same, copy all, and then fixup */
73410 *new = *vma;
73411
73412@@ -1995,6 +2324,22 @@ static int __split_vma(struct mm_struct
73413 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
73414 }
73415
73416+#ifdef CONFIG_PAX_SEGMEXEC
73417+ if (vma_m) {
73418+ *new_m = *vma_m;
73419+ INIT_LIST_HEAD(&new_m->anon_vma_chain);
73420+ new_m->vm_mirror = new;
73421+ new->vm_mirror = new_m;
73422+
73423+ if (new_below)
73424+ new_m->vm_end = addr_m;
73425+ else {
73426+ new_m->vm_start = addr_m;
73427+ new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
73428+ }
73429+ }
73430+#endif
73431+
73432 pol = mpol_dup(vma_policy(vma));
73433 if (IS_ERR(pol)) {
73434 err = PTR_ERR(pol);
73435@@ -2020,6 +2365,42 @@ static int __split_vma(struct mm_struct
73436 else
73437 err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
73438
73439+#ifdef CONFIG_PAX_SEGMEXEC
73440+ if (!err && vma_m) {
73441+ if (anon_vma_clone(new_m, vma_m))
73442+ goto out_free_mpol;
73443+
73444+ mpol_get(pol);
73445+ vma_set_policy(new_m, pol);
73446+
73447+ if (new_m->vm_file) {
73448+ get_file(new_m->vm_file);
73449+ if (vma_m->vm_flags & VM_EXECUTABLE)
73450+ added_exe_file_vma(mm);
73451+ }
73452+
73453+ if (new_m->vm_ops && new_m->vm_ops->open)
73454+ new_m->vm_ops->open(new_m);
73455+
73456+ if (new_below)
73457+ err = vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
73458+ ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
73459+ else
73460+ err = vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
73461+
73462+ if (err) {
73463+ if (new_m->vm_ops && new_m->vm_ops->close)
73464+ new_m->vm_ops->close(new_m);
73465+ if (new_m->vm_file) {
73466+ if (vma_m->vm_flags & VM_EXECUTABLE)
73467+ removed_exe_file_vma(mm);
73468+ fput(new_m->vm_file);
73469+ }
73470+ mpol_put(pol);
73471+ }
73472+ }
73473+#endif
73474+
73475 /* Success. */
73476 if (!err)
73477 return 0;
73478@@ -2032,10 +2413,18 @@ static int __split_vma(struct mm_struct
73479 removed_exe_file_vma(mm);
73480 fput(new->vm_file);
73481 }
73482- unlink_anon_vmas(new);
73483 out_free_mpol:
73484 mpol_put(pol);
73485 out_free_vma:
73486+
73487+#ifdef CONFIG_PAX_SEGMEXEC
73488+ if (new_m) {
73489+ unlink_anon_vmas(new_m);
73490+ kmem_cache_free(vm_area_cachep, new_m);
73491+ }
73492+#endif
73493+
73494+ unlink_anon_vmas(new);
73495 kmem_cache_free(vm_area_cachep, new);
73496 out_err:
73497 return err;
73498@@ -2048,6 +2437,15 @@ static int __split_vma(struct mm_struct
73499 int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
73500 unsigned long addr, int new_below)
73501 {
73502+
73503+#ifdef CONFIG_PAX_SEGMEXEC
73504+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
73505+ BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
73506+ if (mm->map_count >= sysctl_max_map_count-1)
73507+ return -ENOMEM;
73508+ } else
73509+#endif
73510+
73511 if (mm->map_count >= sysctl_max_map_count)
73512 return -ENOMEM;
73513
73514@@ -2059,11 +2457,30 @@ int split_vma(struct mm_struct *mm, stru
73515 * work. This now handles partial unmappings.
73516 * Jeremy Fitzhardinge <jeremy@goop.org>
73517 */
73518+#ifdef CONFIG_PAX_SEGMEXEC
73519+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73520+{
73521+ int ret = __do_munmap(mm, start, len);
73522+ if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
73523+ return ret;
73524+
73525+ return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
73526+}
73527+
73528+int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73529+#else
73530 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73531+#endif
73532 {
73533 unsigned long end;
73534 struct vm_area_struct *vma, *prev, *last;
73535
73536+ /*
73537+ * mm->mmap_sem is required to protect against another thread
73538+ * changing the mappings in case we sleep.
73539+ */
73540+ verify_mm_writelocked(mm);
73541+
73542 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
73543 return -EINVAL;
73544
73545@@ -2137,6 +2554,8 @@ int do_munmap(struct mm_struct *mm, unsi
73546 /* Fix up all other VM information */
73547 remove_vma_list(mm, vma);
73548
73549+ track_exec_limit(mm, start, end, 0UL);
73550+
73551 return 0;
73552 }
73553
73554@@ -2149,22 +2568,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
73555
73556 profile_munmap(addr);
73557
73558+#ifdef CONFIG_PAX_SEGMEXEC
73559+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
73560+ (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
73561+ return -EINVAL;
73562+#endif
73563+
73564 down_write(&mm->mmap_sem);
73565 ret = do_munmap(mm, addr, len);
73566 up_write(&mm->mmap_sem);
73567 return ret;
73568 }
73569
73570-static inline void verify_mm_writelocked(struct mm_struct *mm)
73571-{
73572-#ifdef CONFIG_DEBUG_VM
73573- if (unlikely(down_read_trylock(&mm->mmap_sem))) {
73574- WARN_ON(1);
73575- up_read(&mm->mmap_sem);
73576- }
73577-#endif
73578-}
73579-
73580 /*
73581 * this is really a simplified "do_mmap". it only handles
73582 * anonymous maps. eventually we may be able to do some
73583@@ -2178,6 +2593,7 @@ unsigned long do_brk(unsigned long addr,
73584 struct rb_node ** rb_link, * rb_parent;
73585 pgoff_t pgoff = addr >> PAGE_SHIFT;
73586 int error;
73587+ unsigned long charged;
73588
73589 len = PAGE_ALIGN(len);
73590 if (!len)
73591@@ -2189,16 +2605,30 @@ unsigned long do_brk(unsigned long addr,
73592
73593 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
73594
73595+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
73596+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
73597+ flags &= ~VM_EXEC;
73598+
73599+#ifdef CONFIG_PAX_MPROTECT
73600+ if (mm->pax_flags & MF_PAX_MPROTECT)
73601+ flags &= ~VM_MAYEXEC;
73602+#endif
73603+
73604+ }
73605+#endif
73606+
73607 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
73608 if (error & ~PAGE_MASK)
73609 return error;
73610
73611+ charged = len >> PAGE_SHIFT;
73612+
73613 /*
73614 * mlock MCL_FUTURE?
73615 */
73616 if (mm->def_flags & VM_LOCKED) {
73617 unsigned long locked, lock_limit;
73618- locked = len >> PAGE_SHIFT;
73619+ locked = charged;
73620 locked += mm->locked_vm;
73621 lock_limit = rlimit(RLIMIT_MEMLOCK);
73622 lock_limit >>= PAGE_SHIFT;
73623@@ -2215,22 +2645,22 @@ unsigned long do_brk(unsigned long addr,
73624 /*
73625 * Clear old maps. this also does some error checking for us
73626 */
73627- munmap_back:
73628 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73629 if (vma && vma->vm_start < addr + len) {
73630 if (do_munmap(mm, addr, len))
73631 return -ENOMEM;
73632- goto munmap_back;
73633+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73634+ BUG_ON(vma && vma->vm_start < addr + len);
73635 }
73636
73637 /* Check against address space limits *after* clearing old maps... */
73638- if (!may_expand_vm(mm, len >> PAGE_SHIFT))
73639+ if (!may_expand_vm(mm, charged))
73640 return -ENOMEM;
73641
73642 if (mm->map_count > sysctl_max_map_count)
73643 return -ENOMEM;
73644
73645- if (security_vm_enough_memory(len >> PAGE_SHIFT))
73646+ if (security_vm_enough_memory(charged))
73647 return -ENOMEM;
73648
73649 /* Can we just expand an old private anonymous mapping? */
73650@@ -2244,7 +2674,7 @@ unsigned long do_brk(unsigned long addr,
73651 */
73652 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73653 if (!vma) {
73654- vm_unacct_memory(len >> PAGE_SHIFT);
73655+ vm_unacct_memory(charged);
73656 return -ENOMEM;
73657 }
73658
73659@@ -2258,11 +2688,12 @@ unsigned long do_brk(unsigned long addr,
73660 vma_link(mm, vma, prev, rb_link, rb_parent);
73661 out:
73662 perf_event_mmap(vma);
73663- mm->total_vm += len >> PAGE_SHIFT;
73664+ mm->total_vm += charged;
73665 if (flags & VM_LOCKED) {
73666 if (!mlock_vma_pages_range(vma, addr, addr + len))
73667- mm->locked_vm += (len >> PAGE_SHIFT);
73668+ mm->locked_vm += charged;
73669 }
73670+ track_exec_limit(mm, addr, addr + len, flags);
73671 return addr;
73672 }
73673
73674@@ -2309,8 +2740,10 @@ void exit_mmap(struct mm_struct *mm)
73675 * Walk the list again, actually closing and freeing it,
73676 * with preemption enabled, without holding any MM locks.
73677 */
73678- while (vma)
73679+ while (vma) {
73680+ vma->vm_mirror = NULL;
73681 vma = remove_vma(vma);
73682+ }
73683
73684 BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
73685 }
73686@@ -2324,6 +2757,13 @@ int insert_vm_struct(struct mm_struct *
73687 struct vm_area_struct * __vma, * prev;
73688 struct rb_node ** rb_link, * rb_parent;
73689
73690+#ifdef CONFIG_PAX_SEGMEXEC
73691+ struct vm_area_struct *vma_m = NULL;
73692+#endif
73693+
73694+ if (security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1))
73695+ return -EPERM;
73696+
73697 /*
73698 * The vm_pgoff of a purely anonymous vma should be irrelevant
73699 * until its first write fault, when page's anon_vma and index
73700@@ -2346,7 +2786,22 @@ int insert_vm_struct(struct mm_struct *
73701 if ((vma->vm_flags & VM_ACCOUNT) &&
73702 security_vm_enough_memory_mm(mm, vma_pages(vma)))
73703 return -ENOMEM;
73704+
73705+#ifdef CONFIG_PAX_SEGMEXEC
73706+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
73707+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73708+ if (!vma_m)
73709+ return -ENOMEM;
73710+ }
73711+#endif
73712+
73713 vma_link(mm, vma, prev, rb_link, rb_parent);
73714+
73715+#ifdef CONFIG_PAX_SEGMEXEC
73716+ if (vma_m)
73717+ BUG_ON(pax_mirror_vma(vma_m, vma));
73718+#endif
73719+
73720 return 0;
73721 }
73722
73723@@ -2364,6 +2819,8 @@ struct vm_area_struct *copy_vma(struct v
73724 struct rb_node **rb_link, *rb_parent;
73725 struct mempolicy *pol;
73726
73727+ BUG_ON(vma->vm_mirror);
73728+
73729 /*
73730 * If anonymous vma has not yet been faulted, update new pgoff
73731 * to match new location, to increase its chance of merging.
73732@@ -2413,6 +2870,39 @@ struct vm_area_struct *copy_vma(struct v
73733 kmem_cache_free(vm_area_cachep, new_vma);
73734 return NULL;
73735 }
73736+
73737+#ifdef CONFIG_PAX_SEGMEXEC
73738+long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
73739+{
73740+ struct vm_area_struct *prev_m;
73741+ struct rb_node **rb_link_m, *rb_parent_m;
73742+ struct mempolicy *pol_m;
73743+
73744+ BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
73745+ BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
73746+ BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
73747+ *vma_m = *vma;
73748+ INIT_LIST_HEAD(&vma_m->anon_vma_chain);
73749+ if (anon_vma_clone(vma_m, vma))
73750+ return -ENOMEM;
73751+ pol_m = vma_policy(vma_m);
73752+ mpol_get(pol_m);
73753+ vma_set_policy(vma_m, pol_m);
73754+ vma_m->vm_start += SEGMEXEC_TASK_SIZE;
73755+ vma_m->vm_end += SEGMEXEC_TASK_SIZE;
73756+ vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
73757+ vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
73758+ if (vma_m->vm_file)
73759+ get_file(vma_m->vm_file);
73760+ if (vma_m->vm_ops && vma_m->vm_ops->open)
73761+ vma_m->vm_ops->open(vma_m);
73762+ find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
73763+ vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
73764+ vma_m->vm_mirror = vma;
73765+ vma->vm_mirror = vma_m;
73766+ return 0;
73767+}
73768+#endif
73769
73770 /*
73771 * Return true if the calling process may expand its vm space by the passed
73772@@ -2424,7 +2914,7 @@ int may_expand_vm(struct mm_struct *mm,
73773 unsigned long lim;
73774
73775 lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
73776-
73777+ gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
73778 if (cur + npages > lim)
73779 return 0;
73780 return 1;
73781@@ -2495,6 +2985,22 @@ int install_special_mapping(struct mm_st
73782 vma->vm_start = addr;
73783 vma->vm_end = addr + len;
73784
73785+#ifdef CONFIG_PAX_MPROTECT
73786+ if (mm->pax_flags & MF_PAX_MPROTECT) {
73787+#ifndef CONFIG_PAX_MPROTECT_COMPAT
73788+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
73789+ return -EPERM;
73790+ if (!(vm_flags & VM_EXEC))
73791+ vm_flags &= ~VM_MAYEXEC;
73792+#else
73793+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
73794+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
73795+#endif
73796+ else
73797+ vm_flags &= ~VM_MAYWRITE;
73798+ }
73799+#endif
73800+
73801 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
73802 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
73803
73804diff -urNp linux-2.6.39.1/mm/mprotect.c linux-2.6.39.1/mm/mprotect.c
73805--- linux-2.6.39.1/mm/mprotect.c 2011-05-19 00:06:34.000000000 -0400
73806+++ linux-2.6.39.1/mm/mprotect.c 2011-05-22 19:41:42.000000000 -0400
73807@@ -23,10 +23,16 @@
73808 #include <linux/mmu_notifier.h>
73809 #include <linux/migrate.h>
73810 #include <linux/perf_event.h>
73811+
73812+#ifdef CONFIG_PAX_MPROTECT
73813+#include <linux/elf.h>
73814+#endif
73815+
73816 #include <asm/uaccess.h>
73817 #include <asm/pgtable.h>
73818 #include <asm/cacheflush.h>
73819 #include <asm/tlbflush.h>
73820+#include <asm/mmu_context.h>
73821
73822 #ifndef pgprot_modify
73823 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
73824@@ -141,6 +147,48 @@ static void change_protection(struct vm_
73825 flush_tlb_range(vma, start, end);
73826 }
73827
73828+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
73829+/* called while holding the mmap semaphor for writing except stack expansion */
73830+void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
73831+{
73832+ unsigned long oldlimit, newlimit = 0UL;
73833+
73834+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || (__supported_pte_mask & _PAGE_NX))
73835+ return;
73836+
73837+ spin_lock(&mm->page_table_lock);
73838+ oldlimit = mm->context.user_cs_limit;
73839+ if ((prot & VM_EXEC) && oldlimit < end)
73840+ /* USER_CS limit moved up */
73841+ newlimit = end;
73842+ else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
73843+ /* USER_CS limit moved down */
73844+ newlimit = start;
73845+
73846+ if (newlimit) {
73847+ mm->context.user_cs_limit = newlimit;
73848+
73849+#ifdef CONFIG_SMP
73850+ wmb();
73851+ cpus_clear(mm->context.cpu_user_cs_mask);
73852+ cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
73853+#endif
73854+
73855+ set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
73856+ }
73857+ spin_unlock(&mm->page_table_lock);
73858+ if (newlimit == end) {
73859+ struct vm_area_struct *vma = find_vma(mm, oldlimit);
73860+
73861+ for (; vma && vma->vm_start < end; vma = vma->vm_next)
73862+ if (is_vm_hugetlb_page(vma))
73863+ hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
73864+ else
73865+ change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
73866+ }
73867+}
73868+#endif
73869+
73870 int
73871 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
73872 unsigned long start, unsigned long end, unsigned long newflags)
73873@@ -153,11 +201,29 @@ mprotect_fixup(struct vm_area_struct *vm
73874 int error;
73875 int dirty_accountable = 0;
73876
73877+#ifdef CONFIG_PAX_SEGMEXEC
73878+ struct vm_area_struct *vma_m = NULL;
73879+ unsigned long start_m, end_m;
73880+
73881+ start_m = start + SEGMEXEC_TASK_SIZE;
73882+ end_m = end + SEGMEXEC_TASK_SIZE;
73883+#endif
73884+
73885 if (newflags == oldflags) {
73886 *pprev = vma;
73887 return 0;
73888 }
73889
73890+ if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
73891+ struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
73892+
73893+ if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
73894+ return -ENOMEM;
73895+
73896+ if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
73897+ return -ENOMEM;
73898+ }
73899+
73900 /*
73901 * If we make a private mapping writable we increase our commit;
73902 * but (without finer accounting) cannot reduce our commit if we
73903@@ -174,6 +240,42 @@ mprotect_fixup(struct vm_area_struct *vm
73904 }
73905 }
73906
73907+#ifdef CONFIG_PAX_SEGMEXEC
73908+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
73909+ if (start != vma->vm_start) {
73910+ error = split_vma(mm, vma, start, 1);
73911+ if (error)
73912+ goto fail;
73913+ BUG_ON(!*pprev || (*pprev)->vm_next == vma);
73914+ *pprev = (*pprev)->vm_next;
73915+ }
73916+
73917+ if (end != vma->vm_end) {
73918+ error = split_vma(mm, vma, end, 0);
73919+ if (error)
73920+ goto fail;
73921+ }
73922+
73923+ if (pax_find_mirror_vma(vma)) {
73924+ error = __do_munmap(mm, start_m, end_m - start_m);
73925+ if (error)
73926+ goto fail;
73927+ } else {
73928+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73929+ if (!vma_m) {
73930+ error = -ENOMEM;
73931+ goto fail;
73932+ }
73933+ vma->vm_flags = newflags;
73934+ error = pax_mirror_vma(vma_m, vma);
73935+ if (error) {
73936+ vma->vm_flags = oldflags;
73937+ goto fail;
73938+ }
73939+ }
73940+ }
73941+#endif
73942+
73943 /*
73944 * First try to merge with previous and/or next vma.
73945 */
73946@@ -204,9 +306,21 @@ success:
73947 * vm_flags and vm_page_prot are protected by the mmap_sem
73948 * held in write mode.
73949 */
73950+
73951+#ifdef CONFIG_PAX_SEGMEXEC
73952+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
73953+ pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
73954+#endif
73955+
73956 vma->vm_flags = newflags;
73957+
73958+#ifdef CONFIG_PAX_MPROTECT
73959+ if (mm->binfmt && mm->binfmt->handle_mprotect)
73960+ mm->binfmt->handle_mprotect(vma, newflags);
73961+#endif
73962+
73963 vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
73964- vm_get_page_prot(newflags));
73965+ vm_get_page_prot(vma->vm_flags));
73966
73967 if (vma_wants_writenotify(vma)) {
73968 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
73969@@ -248,6 +362,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
73970 end = start + len;
73971 if (end <= start)
73972 return -ENOMEM;
73973+
73974+#ifdef CONFIG_PAX_SEGMEXEC
73975+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
73976+ if (end > SEGMEXEC_TASK_SIZE)
73977+ return -EINVAL;
73978+ } else
73979+#endif
73980+
73981+ if (end > TASK_SIZE)
73982+ return -EINVAL;
73983+
73984 if (!arch_validate_prot(prot))
73985 return -EINVAL;
73986
73987@@ -255,7 +380,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
73988 /*
73989 * Does the application expect PROT_READ to imply PROT_EXEC:
73990 */
73991- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
73992+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
73993 prot |= PROT_EXEC;
73994
73995 vm_flags = calc_vm_prot_bits(prot);
73996@@ -287,6 +412,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
73997 if (start > vma->vm_start)
73998 prev = vma;
73999
74000+#ifdef CONFIG_PAX_MPROTECT
74001+ if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
74002+ current->mm->binfmt->handle_mprotect(vma, vm_flags);
74003+#endif
74004+
74005 for (nstart = start ; ; ) {
74006 unsigned long newflags;
74007
74008@@ -296,6 +426,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
74009
74010 /* newflags >> 4 shift VM_MAY% in place of VM_% */
74011 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
74012+ if (prot & (PROT_WRITE | PROT_EXEC))
74013+ gr_log_rwxmprotect(vma->vm_file);
74014+
74015+ error = -EACCES;
74016+ goto out;
74017+ }
74018+
74019+ if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
74020 error = -EACCES;
74021 goto out;
74022 }
74023@@ -310,6 +448,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
74024 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
74025 if (error)
74026 goto out;
74027+
74028+ track_exec_limit(current->mm, nstart, tmp, vm_flags);
74029+
74030 nstart = tmp;
74031
74032 if (nstart < prev->vm_end)
74033diff -urNp linux-2.6.39.1/mm/mremap.c linux-2.6.39.1/mm/mremap.c
74034--- linux-2.6.39.1/mm/mremap.c 2011-05-19 00:06:34.000000000 -0400
74035+++ linux-2.6.39.1/mm/mremap.c 2011-05-22 19:36:33.000000000 -0400
74036@@ -114,6 +114,12 @@ static void move_ptes(struct vm_area_str
74037 continue;
74038 pte = ptep_clear_flush(vma, old_addr, old_pte);
74039 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
74040+
74041+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
74042+ if (!(__supported_pte_mask & _PAGE_NX) && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
74043+ pte = pte_exprotect(pte);
74044+#endif
74045+
74046 set_pte_at(mm, new_addr, new_pte, pte);
74047 }
74048
74049@@ -273,6 +279,11 @@ static struct vm_area_struct *vma_to_res
74050 if (is_vm_hugetlb_page(vma))
74051 goto Einval;
74052
74053+#ifdef CONFIG_PAX_SEGMEXEC
74054+ if (pax_find_mirror_vma(vma))
74055+ goto Einval;
74056+#endif
74057+
74058 /* We can't remap across vm area boundaries */
74059 if (old_len > vma->vm_end - addr)
74060 goto Efault;
74061@@ -329,20 +340,25 @@ static unsigned long mremap_to(unsigned
74062 unsigned long ret = -EINVAL;
74063 unsigned long charged = 0;
74064 unsigned long map_flags;
74065+ unsigned long pax_task_size = TASK_SIZE;
74066
74067 if (new_addr & ~PAGE_MASK)
74068 goto out;
74069
74070- if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
74071+#ifdef CONFIG_PAX_SEGMEXEC
74072+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
74073+ pax_task_size = SEGMEXEC_TASK_SIZE;
74074+#endif
74075+
74076+ pax_task_size -= PAGE_SIZE;
74077+
74078+ if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
74079 goto out;
74080
74081 /* Check if the location we're moving into overlaps the
74082 * old location at all, and fail if it does.
74083 */
74084- if ((new_addr <= addr) && (new_addr+new_len) > addr)
74085- goto out;
74086-
74087- if ((addr <= new_addr) && (addr+old_len) > new_addr)
74088+ if (addr + old_len > new_addr && new_addr + new_len > addr)
74089 goto out;
74090
74091 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
74092@@ -414,6 +430,7 @@ unsigned long do_mremap(unsigned long ad
74093 struct vm_area_struct *vma;
74094 unsigned long ret = -EINVAL;
74095 unsigned long charged = 0;
74096+ unsigned long pax_task_size = TASK_SIZE;
74097
74098 if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
74099 goto out;
74100@@ -432,6 +449,17 @@ unsigned long do_mremap(unsigned long ad
74101 if (!new_len)
74102 goto out;
74103
74104+#ifdef CONFIG_PAX_SEGMEXEC
74105+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
74106+ pax_task_size = SEGMEXEC_TASK_SIZE;
74107+#endif
74108+
74109+ pax_task_size -= PAGE_SIZE;
74110+
74111+ if (new_len > pax_task_size || addr > pax_task_size-new_len ||
74112+ old_len > pax_task_size || addr > pax_task_size-old_len)
74113+ goto out;
74114+
74115 if (flags & MREMAP_FIXED) {
74116 if (flags & MREMAP_MAYMOVE)
74117 ret = mremap_to(addr, old_len, new_addr, new_len);
74118@@ -481,6 +509,7 @@ unsigned long do_mremap(unsigned long ad
74119 addr + new_len);
74120 }
74121 ret = addr;
74122+ track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
74123 goto out;
74124 }
74125 }
74126@@ -507,7 +536,13 @@ unsigned long do_mremap(unsigned long ad
74127 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
74128 if (ret)
74129 goto out;
74130+
74131+ map_flags = vma->vm_flags;
74132 ret = move_vma(vma, addr, old_len, new_len, new_addr);
74133+ if (!(ret & ~PAGE_MASK)) {
74134+ track_exec_limit(current->mm, addr, addr + old_len, 0UL);
74135+ track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
74136+ }
74137 }
74138 out:
74139 if (ret & ~PAGE_MASK)
74140diff -urNp linux-2.6.39.1/mm/nobootmem.c linux-2.6.39.1/mm/nobootmem.c
74141--- linux-2.6.39.1/mm/nobootmem.c 2011-05-19 00:06:34.000000000 -0400
74142+++ linux-2.6.39.1/mm/nobootmem.c 2011-05-22 19:36:33.000000000 -0400
74143@@ -110,19 +110,30 @@ static void __init __free_pages_memory(u
74144 unsigned long __init free_all_memory_core_early(int nodeid)
74145 {
74146 int i;
74147- u64 start, end;
74148+ u64 start, end, startrange, endrange;
74149 unsigned long count = 0;
74150- struct range *range = NULL;
74151+ struct range *range = NULL, rangerange = { 0, 0 };
74152 int nr_range;
74153
74154 nr_range = get_free_all_memory_range(&range, nodeid);
74155+ startrange = __pa(range) >> PAGE_SHIFT;
74156+ endrange = (__pa(range + nr_range) - 1) >> PAGE_SHIFT;
74157
74158 for (i = 0; i < nr_range; i++) {
74159 start = range[i].start;
74160 end = range[i].end;
74161+ if (start <= endrange && startrange < end) {
74162+ BUG_ON(rangerange.start | rangerange.end);
74163+ rangerange = range[i];
74164+ continue;
74165+ }
74166 count += end - start;
74167 __free_pages_memory(start, end);
74168 }
74169+ start = rangerange.start;
74170+ end = rangerange.end;
74171+ count += end - start;
74172+ __free_pages_memory(start, end);
74173
74174 return count;
74175 }
74176diff -urNp linux-2.6.39.1/mm/nommu.c linux-2.6.39.1/mm/nommu.c
74177--- linux-2.6.39.1/mm/nommu.c 2011-05-19 00:06:34.000000000 -0400
74178+++ linux-2.6.39.1/mm/nommu.c 2011-05-22 19:36:33.000000000 -0400
74179@@ -63,7 +63,6 @@ int sysctl_overcommit_memory = OVERCOMMI
74180 int sysctl_overcommit_ratio = 50; /* default is 50% */
74181 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
74182 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
74183-int heap_stack_gap = 0;
74184
74185 atomic_long_t mmap_pages_allocated;
74186
74187@@ -833,15 +832,6 @@ struct vm_area_struct *find_vma(struct m
74188 EXPORT_SYMBOL(find_vma);
74189
74190 /*
74191- * find a VMA
74192- * - we don't extend stack VMAs under NOMMU conditions
74193- */
74194-struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
74195-{
74196- return find_vma(mm, addr);
74197-}
74198-
74199-/*
74200 * expand a stack to a given address
74201 * - not supported under NOMMU conditions
74202 */
74203@@ -1563,6 +1553,7 @@ int split_vma(struct mm_struct *mm, stru
74204
74205 /* most fields are the same, copy all, and then fixup */
74206 *new = *vma;
74207+ INIT_LIST_HEAD(&new->anon_vma_chain);
74208 *region = *vma->vm_region;
74209 new->vm_region = region;
74210
74211diff -urNp linux-2.6.39.1/mm/page_alloc.c linux-2.6.39.1/mm/page_alloc.c
74212--- linux-2.6.39.1/mm/page_alloc.c 2011-06-03 00:04:14.000000000 -0400
74213+++ linux-2.6.39.1/mm/page_alloc.c 2011-06-03 00:32:08.000000000 -0400
74214@@ -650,6 +650,10 @@ static bool free_pages_prepare(struct pa
74215 int i;
74216 int bad = 0;
74217
74218+#ifdef CONFIG_PAX_MEMORY_SANITIZE
74219+ unsigned long index = 1UL << order;
74220+#endif
74221+
74222 trace_mm_page_free_direct(page, order);
74223 kmemcheck_free_shadow(page, order);
74224
74225@@ -665,6 +669,12 @@ static bool free_pages_prepare(struct pa
74226 debug_check_no_obj_freed(page_address(page),
74227 PAGE_SIZE << order);
74228 }
74229+
74230+#ifdef CONFIG_PAX_MEMORY_SANITIZE
74231+ for (; index; --index)
74232+ sanitize_highpage(page + index - 1);
74233+#endif
74234+
74235 arch_free_page(page, order);
74236 kernel_map_pages(page, 1 << order, 0);
74237
74238@@ -780,8 +790,10 @@ static int prep_new_page(struct page *pa
74239 arch_alloc_page(page, order);
74240 kernel_map_pages(page, 1 << order, 1);
74241
74242+#ifndef CONFIG_PAX_MEMORY_SANITIZE
74243 if (gfp_flags & __GFP_ZERO)
74244 prep_zero_page(page, order, gfp_flags);
74245+#endif
74246
74247 if (order && (gfp_flags & __GFP_COMP))
74248 prep_compound_page(page, order);
74249@@ -2504,6 +2516,8 @@ void __show_free_areas(unsigned int filt
74250 int cpu;
74251 struct zone *zone;
74252
74253+ pax_track_stack();
74254+
74255 for_each_populated_zone(zone) {
74256 if (skip_free_areas_zone(filter, zone))
74257 continue;
74258diff -urNp linux-2.6.39.1/mm/percpu.c linux-2.6.39.1/mm/percpu.c
74259--- linux-2.6.39.1/mm/percpu.c 2011-05-19 00:06:34.000000000 -0400
74260+++ linux-2.6.39.1/mm/percpu.c 2011-05-22 19:36:33.000000000 -0400
74261@@ -121,7 +121,7 @@ static unsigned int pcpu_first_unit_cpu
74262 static unsigned int pcpu_last_unit_cpu __read_mostly;
74263
74264 /* the address of the first chunk which starts with the kernel static area */
74265-void *pcpu_base_addr __read_mostly;
74266+void *pcpu_base_addr __read_only;
74267 EXPORT_SYMBOL_GPL(pcpu_base_addr);
74268
74269 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
74270diff -urNp linux-2.6.39.1/mm/rmap.c linux-2.6.39.1/mm/rmap.c
74271--- linux-2.6.39.1/mm/rmap.c 2011-05-19 00:06:34.000000000 -0400
74272+++ linux-2.6.39.1/mm/rmap.c 2011-05-22 19:36:33.000000000 -0400
74273@@ -131,6 +131,10 @@ int anon_vma_prepare(struct vm_area_stru
74274 struct anon_vma *anon_vma = vma->anon_vma;
74275 struct anon_vma_chain *avc;
74276
74277+#ifdef CONFIG_PAX_SEGMEXEC
74278+ struct anon_vma_chain *avc_m = NULL;
74279+#endif
74280+
74281 might_sleep();
74282 if (unlikely(!anon_vma)) {
74283 struct mm_struct *mm = vma->vm_mm;
74284@@ -140,6 +144,12 @@ int anon_vma_prepare(struct vm_area_stru
74285 if (!avc)
74286 goto out_enomem;
74287
74288+#ifdef CONFIG_PAX_SEGMEXEC
74289+ avc_m = anon_vma_chain_alloc();
74290+ if (!avc_m)
74291+ goto out_enomem_free_avc;
74292+#endif
74293+
74294 anon_vma = find_mergeable_anon_vma(vma);
74295 allocated = NULL;
74296 if (!anon_vma) {
74297@@ -153,6 +163,21 @@ int anon_vma_prepare(struct vm_area_stru
74298 /* page_table_lock to protect against threads */
74299 spin_lock(&mm->page_table_lock);
74300 if (likely(!vma->anon_vma)) {
74301+
74302+#ifdef CONFIG_PAX_SEGMEXEC
74303+ struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
74304+
74305+ if (vma_m) {
74306+ BUG_ON(vma_m->anon_vma);
74307+ vma_m->anon_vma = anon_vma;
74308+ avc_m->anon_vma = anon_vma;
74309+ avc_m->vma = vma;
74310+ list_add(&avc_m->same_vma, &vma_m->anon_vma_chain);
74311+ list_add(&avc_m->same_anon_vma, &anon_vma->head);
74312+ avc_m = NULL;
74313+ }
74314+#endif
74315+
74316 vma->anon_vma = anon_vma;
74317 avc->anon_vma = anon_vma;
74318 avc->vma = vma;
74319@@ -166,12 +191,24 @@ int anon_vma_prepare(struct vm_area_stru
74320
74321 if (unlikely(allocated))
74322 put_anon_vma(allocated);
74323+
74324+#ifdef CONFIG_PAX_SEGMEXEC
74325+ if (unlikely(avc_m))
74326+ anon_vma_chain_free(avc_m);
74327+#endif
74328+
74329 if (unlikely(avc))
74330 anon_vma_chain_free(avc);
74331 }
74332 return 0;
74333
74334 out_enomem_free_avc:
74335+
74336+#ifdef CONFIG_PAX_SEGMEXEC
74337+ if (avc_m)
74338+ anon_vma_chain_free(avc_m);
74339+#endif
74340+
74341 anon_vma_chain_free(avc);
74342 out_enomem:
74343 return -ENOMEM;
74344@@ -198,7 +235,7 @@ static void anon_vma_chain_link(struct v
74345 * Attach the anon_vmas from src to dst.
74346 * Returns 0 on success, -ENOMEM on failure.
74347 */
74348-int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
74349+int anon_vma_clone(struct vm_area_struct *dst, const struct vm_area_struct *src)
74350 {
74351 struct anon_vma_chain *avc, *pavc;
74352
74353@@ -220,7 +257,7 @@ int anon_vma_clone(struct vm_area_struct
74354 * the corresponding VMA in the parent process is attached to.
74355 * Returns 0 on success, non-zero on failure.
74356 */
74357-int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
74358+int anon_vma_fork(struct vm_area_struct *vma, const struct vm_area_struct *pvma)
74359 {
74360 struct anon_vma_chain *avc;
74361 struct anon_vma *anon_vma;
74362diff -urNp linux-2.6.39.1/mm/shmem.c linux-2.6.39.1/mm/shmem.c
74363--- linux-2.6.39.1/mm/shmem.c 2011-06-03 00:04:14.000000000 -0400
74364+++ linux-2.6.39.1/mm/shmem.c 2011-06-03 00:32:08.000000000 -0400
74365@@ -31,7 +31,7 @@
74366 #include <linux/percpu_counter.h>
74367 #include <linux/swap.h>
74368
74369-static struct vfsmount *shm_mnt;
74370+struct vfsmount *shm_mnt;
74371
74372 #ifdef CONFIG_SHMEM
74373 /*
74374@@ -1087,6 +1087,8 @@ static int shmem_writepage(struct page *
74375 goto unlock;
74376 }
74377 entry = shmem_swp_entry(info, index, NULL);
74378+ if (!entry)
74379+ goto unlock;
74380 if (entry->val) {
74381 /*
74382 * The more uptodate page coming down from a stacked
74383@@ -1158,6 +1160,8 @@ static struct page *shmem_swapin(swp_ent
74384 struct vm_area_struct pvma;
74385 struct page *page;
74386
74387+ pax_track_stack();
74388+
74389 spol = mpol_cond_copy(&mpol,
74390 mpol_shared_policy_lookup(&info->policy, idx));
74391
74392@@ -2014,7 +2018,7 @@ static int shmem_symlink(struct inode *d
74393
74394 info = SHMEM_I(inode);
74395 inode->i_size = len-1;
74396- if (len <= (char *)inode - (char *)info) {
74397+ if (len <= (char *)inode - (char *)info && len <= 64) {
74398 /* do it inline */
74399 memcpy(info, symname, len);
74400 inode->i_op = &shmem_symlink_inline_operations;
74401@@ -2362,8 +2366,7 @@ int shmem_fill_super(struct super_block
74402 int err = -ENOMEM;
74403
74404 /* Round up to L1_CACHE_BYTES to resist false sharing */
74405- sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
74406- L1_CACHE_BYTES), GFP_KERNEL);
74407+ sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
74408 if (!sbinfo)
74409 return -ENOMEM;
74410
74411diff -urNp linux-2.6.39.1/mm/slab.c linux-2.6.39.1/mm/slab.c
74412--- linux-2.6.39.1/mm/slab.c 2011-05-19 00:06:34.000000000 -0400
74413+++ linux-2.6.39.1/mm/slab.c 2011-05-22 19:41:42.000000000 -0400
74414@@ -150,7 +150,7 @@
74415
74416 /* Legal flag mask for kmem_cache_create(). */
74417 #if DEBUG
74418-# define CREATE_MASK (SLAB_RED_ZONE | \
74419+# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
74420 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
74421 SLAB_CACHE_DMA | \
74422 SLAB_STORE_USER | \
74423@@ -158,7 +158,7 @@
74424 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
74425 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
74426 #else
74427-# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
74428+# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
74429 SLAB_CACHE_DMA | \
74430 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
74431 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
74432@@ -287,7 +287,7 @@ struct kmem_list3 {
74433 * Need this for bootstrapping a per node allocator.
74434 */
74435 #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
74436-static struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
74437+static struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
74438 #define CACHE_CACHE 0
74439 #define SIZE_AC MAX_NUMNODES
74440 #define SIZE_L3 (2 * MAX_NUMNODES)
74441@@ -388,10 +388,10 @@ static void kmem_list3_init(struct kmem_
74442 if ((x)->max_freeable < i) \
74443 (x)->max_freeable = i; \
74444 } while (0)
74445-#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
74446-#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
74447-#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
74448-#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
74449+#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
74450+#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
74451+#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
74452+#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
74453 #else
74454 #define STATS_INC_ACTIVE(x) do { } while (0)
74455 #define STATS_DEC_ACTIVE(x) do { } while (0)
74456@@ -537,7 +537,7 @@ static inline void *index_to_obj(struct
74457 * reciprocal_divide(offset, cache->reciprocal_buffer_size)
74458 */
74459 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
74460- const struct slab *slab, void *obj)
74461+ const struct slab *slab, const void *obj)
74462 {
74463 u32 offset = (obj - slab->s_mem);
74464 return reciprocal_divide(offset, cache->reciprocal_buffer_size);
74465@@ -563,7 +563,7 @@ struct cache_names {
74466 static struct cache_names __initdata cache_names[] = {
74467 #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
74468 #include <linux/kmalloc_sizes.h>
74469- {NULL,}
74470+ {NULL}
74471 #undef CACHE
74472 };
74473
74474@@ -1529,7 +1529,7 @@ void __init kmem_cache_init(void)
74475 sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
74476 sizes[INDEX_AC].cs_size,
74477 ARCH_KMALLOC_MINALIGN,
74478- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74479+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74480 NULL);
74481
74482 if (INDEX_AC != INDEX_L3) {
74483@@ -1537,7 +1537,7 @@ void __init kmem_cache_init(void)
74484 kmem_cache_create(names[INDEX_L3].name,
74485 sizes[INDEX_L3].cs_size,
74486 ARCH_KMALLOC_MINALIGN,
74487- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74488+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74489 NULL);
74490 }
74491
74492@@ -1555,7 +1555,7 @@ void __init kmem_cache_init(void)
74493 sizes->cs_cachep = kmem_cache_create(names->name,
74494 sizes->cs_size,
74495 ARCH_KMALLOC_MINALIGN,
74496- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74497+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74498 NULL);
74499 }
74500 #ifdef CONFIG_ZONE_DMA
74501@@ -4270,10 +4270,10 @@ static int s_show(struct seq_file *m, vo
74502 }
74503 /* cpu stats */
74504 {
74505- unsigned long allochit = atomic_read(&cachep->allochit);
74506- unsigned long allocmiss = atomic_read(&cachep->allocmiss);
74507- unsigned long freehit = atomic_read(&cachep->freehit);
74508- unsigned long freemiss = atomic_read(&cachep->freemiss);
74509+ unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
74510+ unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
74511+ unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
74512+ unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
74513
74514 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
74515 allochit, allocmiss, freehit, freemiss);
74516@@ -4530,15 +4530,66 @@ static const struct file_operations proc
74517
74518 static int __init slab_proc_init(void)
74519 {
74520- proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
74521+ mode_t gr_mode = S_IRUGO;
74522+
74523+#ifdef CONFIG_GRKERNSEC_PROC_ADD
74524+ gr_mode = S_IRUSR;
74525+#endif
74526+
74527+ proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
74528 #ifdef CONFIG_DEBUG_SLAB_LEAK
74529- proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
74530+ proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
74531 #endif
74532 return 0;
74533 }
74534 module_init(slab_proc_init);
74535 #endif
74536
74537+void check_object_size(const void *ptr, unsigned long n, bool to)
74538+{
74539+
74540+#ifdef CONFIG_PAX_USERCOPY
74541+ struct page *page;
74542+ struct kmem_cache *cachep = NULL;
74543+ struct slab *slabp;
74544+ unsigned int objnr;
74545+ unsigned long offset;
74546+
74547+ if (!n)
74548+ return;
74549+
74550+ if (ZERO_OR_NULL_PTR(ptr))
74551+ goto report;
74552+
74553+ if (!virt_addr_valid(ptr))
74554+ return;
74555+
74556+ page = virt_to_head_page(ptr);
74557+
74558+ if (!PageSlab(page)) {
74559+ if (object_is_on_stack(ptr, n) == -1)
74560+ goto report;
74561+ return;
74562+ }
74563+
74564+ cachep = page_get_cache(page);
74565+ if (!(cachep->flags & SLAB_USERCOPY))
74566+ goto report;
74567+
74568+ slabp = page_get_slab(page);
74569+ objnr = obj_to_index(cachep, slabp, ptr);
74570+ BUG_ON(objnr >= cachep->num);
74571+ offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
74572+ if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
74573+ return;
74574+
74575+report:
74576+ pax_report_usercopy(ptr, n, to, cachep ? cachep->name : NULL);
74577+#endif
74578+
74579+}
74580+EXPORT_SYMBOL(check_object_size);
74581+
74582 /**
74583 * ksize - get the actual amount of memory allocated for a given object
74584 * @objp: Pointer to the object
74585diff -urNp linux-2.6.39.1/mm/slob.c linux-2.6.39.1/mm/slob.c
74586--- linux-2.6.39.1/mm/slob.c 2011-05-19 00:06:34.000000000 -0400
74587+++ linux-2.6.39.1/mm/slob.c 2011-05-22 19:36:33.000000000 -0400
74588@@ -29,7 +29,7 @@
74589 * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
74590 * alloc_pages() directly, allocating compound pages so the page order
74591 * does not have to be separately tracked, and also stores the exact
74592- * allocation size in page->private so that it can be used to accurately
74593+ * allocation size in slob_page->size so that it can be used to accurately
74594 * provide ksize(). These objects are detected in kfree() because slob_page()
74595 * is false for them.
74596 *
74597@@ -58,6 +58,7 @@
74598 */
74599
74600 #include <linux/kernel.h>
74601+#include <linux/sched.h>
74602 #include <linux/slab.h>
74603 #include <linux/mm.h>
74604 #include <linux/swap.h> /* struct reclaim_state */
74605@@ -102,7 +103,8 @@ struct slob_page {
74606 unsigned long flags; /* mandatory */
74607 atomic_t _count; /* mandatory */
74608 slobidx_t units; /* free units left in page */
74609- unsigned long pad[2];
74610+ unsigned long pad[1];
74611+ unsigned long size; /* size when >=PAGE_SIZE */
74612 slob_t *free; /* first free slob_t in page */
74613 struct list_head list; /* linked list of free pages */
74614 };
74615@@ -135,7 +137,7 @@ static LIST_HEAD(free_slob_large);
74616 */
74617 static inline int is_slob_page(struct slob_page *sp)
74618 {
74619- return PageSlab((struct page *)sp);
74620+ return PageSlab((struct page *)sp) && !sp->size;
74621 }
74622
74623 static inline void set_slob_page(struct slob_page *sp)
74624@@ -150,7 +152,7 @@ static inline void clear_slob_page(struc
74625
74626 static inline struct slob_page *slob_page(const void *addr)
74627 {
74628- return (struct slob_page *)virt_to_page(addr);
74629+ return (struct slob_page *)virt_to_head_page(addr);
74630 }
74631
74632 /*
74633@@ -210,7 +212,7 @@ static void set_slob(slob_t *s, slobidx_
74634 /*
74635 * Return the size of a slob block.
74636 */
74637-static slobidx_t slob_units(slob_t *s)
74638+static slobidx_t slob_units(const slob_t *s)
74639 {
74640 if (s->units > 0)
74641 return s->units;
74642@@ -220,7 +222,7 @@ static slobidx_t slob_units(slob_t *s)
74643 /*
74644 * Return the next free slob block pointer after this one.
74645 */
74646-static slob_t *slob_next(slob_t *s)
74647+static slob_t *slob_next(const slob_t *s)
74648 {
74649 slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
74650 slobidx_t next;
74651@@ -235,7 +237,7 @@ static slob_t *slob_next(slob_t *s)
74652 /*
74653 * Returns true if s is the last free block in its page.
74654 */
74655-static int slob_last(slob_t *s)
74656+static int slob_last(const slob_t *s)
74657 {
74658 return !((unsigned long)slob_next(s) & ~PAGE_MASK);
74659 }
74660@@ -254,6 +256,7 @@ static void *slob_new_pages(gfp_t gfp, i
74661 if (!page)
74662 return NULL;
74663
74664+ set_slob_page(page);
74665 return page_address(page);
74666 }
74667
74668@@ -370,11 +373,11 @@ static void *slob_alloc(size_t size, gfp
74669 if (!b)
74670 return NULL;
74671 sp = slob_page(b);
74672- set_slob_page(sp);
74673
74674 spin_lock_irqsave(&slob_lock, flags);
74675 sp->units = SLOB_UNITS(PAGE_SIZE);
74676 sp->free = b;
74677+ sp->size = 0;
74678 INIT_LIST_HEAD(&sp->list);
74679 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
74680 set_slob_page_free(sp, slob_list);
74681@@ -476,10 +479,9 @@ out:
74682 * End of slob allocator proper. Begin kmem_cache_alloc and kmalloc frontend.
74683 */
74684
74685-void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74686+static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
74687 {
74688- unsigned int *m;
74689- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74690+ slob_t *m;
74691 void *ret;
74692
74693 lockdep_trace_alloc(gfp);
74694@@ -492,7 +494,10 @@ void *__kmalloc_node(size_t size, gfp_t
74695
74696 if (!m)
74697 return NULL;
74698- *m = size;
74699+ BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
74700+ BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
74701+ m[0].units = size;
74702+ m[1].units = align;
74703 ret = (void *)m + align;
74704
74705 trace_kmalloc_node(_RET_IP_, ret,
74706@@ -504,9 +509,9 @@ void *__kmalloc_node(size_t size, gfp_t
74707 gfp |= __GFP_COMP;
74708 ret = slob_new_pages(gfp, order, node);
74709 if (ret) {
74710- struct page *page;
74711- page = virt_to_page(ret);
74712- page->private = size;
74713+ struct slob_page *sp;
74714+ sp = slob_page(ret);
74715+ sp->size = size;
74716 }
74717
74718 trace_kmalloc_node(_RET_IP_, ret,
74719@@ -516,6 +521,13 @@ void *__kmalloc_node(size_t size, gfp_t
74720 kmemleak_alloc(ret, size, 1, gfp);
74721 return ret;
74722 }
74723+
74724+void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74725+{
74726+ int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74727+
74728+ return __kmalloc_node_align(size, gfp, node, align);
74729+}
74730 EXPORT_SYMBOL(__kmalloc_node);
74731
74732 void kfree(const void *block)
74733@@ -531,13 +543,81 @@ void kfree(const void *block)
74734 sp = slob_page(block);
74735 if (is_slob_page(sp)) {
74736 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74737- unsigned int *m = (unsigned int *)(block - align);
74738- slob_free(m, *m + align);
74739- } else
74740+ slob_t *m = (slob_t *)(block - align);
74741+ slob_free(m, m[0].units + align);
74742+ } else {
74743+ clear_slob_page(sp);
74744+ free_slob_page(sp);
74745+ sp->size = 0;
74746 put_page(&sp->page);
74747+ }
74748 }
74749 EXPORT_SYMBOL(kfree);
74750
74751+void check_object_size(const void *ptr, unsigned long n, bool to)
74752+{
74753+
74754+#ifdef CONFIG_PAX_USERCOPY
74755+ struct slob_page *sp;
74756+ const slob_t *free;
74757+ const void *base;
74758+
74759+ if (!n)
74760+ return;
74761+
74762+ if (ZERO_OR_NULL_PTR(ptr))
74763+ goto report;
74764+
74765+ if (!virt_addr_valid(ptr))
74766+ return;
74767+
74768+ sp = slob_page(ptr);
74769+ if (!PageSlab((struct page*)sp)) {
74770+ if (object_is_on_stack(ptr, n) == -1)
74771+ goto report;
74772+ return;
74773+ }
74774+
74775+ if (sp->size) {
74776+ base = page_address(&sp->page);
74777+ if (base <= ptr && n <= sp->size - (ptr - base))
74778+ return;
74779+ goto report;
74780+ }
74781+
74782+ /* some tricky double walking to find the chunk */
74783+ base = (void *)((unsigned long)ptr & PAGE_MASK);
74784+ free = sp->free;
74785+
74786+ while (!slob_last(free) && (void *)free <= ptr) {
74787+ base = free + slob_units(free);
74788+ free = slob_next(free);
74789+ }
74790+
74791+ while (base < (void *)free) {
74792+ slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
74793+ int size = SLOB_UNIT * SLOB_UNITS(m + align);
74794+ int offset;
74795+
74796+ if (ptr < base + align)
74797+ goto report;
74798+
74799+ offset = ptr - base - align;
74800+ if (offset < m) {
74801+ if (n <= m - offset)
74802+ return;
74803+ goto report;
74804+ }
74805+ base += size;
74806+ }
74807+
74808+report:
74809+ pax_report_usercopy(ptr, n, to, NULL);
74810+#endif
74811+
74812+}
74813+EXPORT_SYMBOL(check_object_size);
74814+
74815 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
74816 size_t ksize(const void *block)
74817 {
74818@@ -550,10 +630,10 @@ size_t ksize(const void *block)
74819 sp = slob_page(block);
74820 if (is_slob_page(sp)) {
74821 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74822- unsigned int *m = (unsigned int *)(block - align);
74823- return SLOB_UNITS(*m) * SLOB_UNIT;
74824+ slob_t *m = (slob_t *)(block - align);
74825+ return SLOB_UNITS(m[0].units) * SLOB_UNIT;
74826 } else
74827- return sp->page.private;
74828+ return sp->size;
74829 }
74830 EXPORT_SYMBOL(ksize);
74831
74832@@ -608,17 +688,25 @@ void *kmem_cache_alloc_node(struct kmem_
74833 {
74834 void *b;
74835
74836+#ifdef CONFIG_PAX_USERCOPY
74837+ b = __kmalloc_node_align(c->size, flags, node, c->align);
74838+#else
74839 if (c->size < PAGE_SIZE) {
74840 b = slob_alloc(c->size, flags, c->align, node);
74841 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
74842 SLOB_UNITS(c->size) * SLOB_UNIT,
74843 flags, node);
74844 } else {
74845+ struct slob_page *sp;
74846+
74847 b = slob_new_pages(flags, get_order(c->size), node);
74848+ sp = slob_page(b);
74849+ sp->size = c->size;
74850 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
74851 PAGE_SIZE << get_order(c->size),
74852 flags, node);
74853 }
74854+#endif
74855
74856 if (c->ctor)
74857 c->ctor(b);
74858@@ -630,10 +718,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
74859
74860 static void __kmem_cache_free(void *b, int size)
74861 {
74862- if (size < PAGE_SIZE)
74863+ struct slob_page *sp = slob_page(b);
74864+
74865+ if (is_slob_page(sp))
74866 slob_free(b, size);
74867- else
74868+ else {
74869+ clear_slob_page(sp);
74870+ free_slob_page(sp);
74871+ sp->size = 0;
74872 slob_free_pages(b, get_order(size));
74873+ }
74874 }
74875
74876 static void kmem_rcu_free(struct rcu_head *head)
74877@@ -646,14 +740,23 @@ static void kmem_rcu_free(struct rcu_hea
74878
74879 void kmem_cache_free(struct kmem_cache *c, void *b)
74880 {
74881+ int size = c->size;
74882+
74883+#ifdef CONFIG_PAX_USERCOPY
74884+ if (size + c->align < PAGE_SIZE) {
74885+ size += c->align;
74886+ b -= c->align;
74887+ }
74888+#endif
74889+
74890 kmemleak_free_recursive(b, c->flags);
74891 if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
74892 struct slob_rcu *slob_rcu;
74893- slob_rcu = b + (c->size - sizeof(struct slob_rcu));
74894- slob_rcu->size = c->size;
74895+ slob_rcu = b + (size - sizeof(struct slob_rcu));
74896+ slob_rcu->size = size;
74897 call_rcu(&slob_rcu->head, kmem_rcu_free);
74898 } else {
74899- __kmem_cache_free(b, c->size);
74900+ __kmem_cache_free(b, size);
74901 }
74902
74903 trace_kmem_cache_free(_RET_IP_, b);
74904diff -urNp linux-2.6.39.1/mm/slub.c linux-2.6.39.1/mm/slub.c
74905--- linux-2.6.39.1/mm/slub.c 2011-06-03 00:04:14.000000000 -0400
74906+++ linux-2.6.39.1/mm/slub.c 2011-06-03 00:32:08.000000000 -0400
74907@@ -431,7 +431,7 @@ static void print_track(const char *s, s
74908 if (!t->addr)
74909 return;
74910
74911- printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
74912+ printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
74913 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
74914 }
74915
74916@@ -2183,6 +2183,8 @@ void kmem_cache_free(struct kmem_cache *
74917
74918 page = virt_to_head_page(x);
74919
74920+ BUG_ON(!PageSlab(page));
74921+
74922 slab_free(s, page, x, _RET_IP_);
74923
74924 trace_kmem_cache_free(_RET_IP_, x);
74925@@ -2216,7 +2218,7 @@ static int slub_min_objects;
74926 * Merge control. If this is set then no merging of slab caches will occur.
74927 * (Could be removed. This was introduced to pacify the merge skeptics.)
74928 */
74929-static int slub_nomerge;
74930+static int slub_nomerge = 1;
74931
74932 /*
74933 * Calculate the order of allocation given an slab object size.
74934@@ -2644,7 +2646,7 @@ static int kmem_cache_open(struct kmem_c
74935 * list to avoid pounding the page allocator excessively.
74936 */
74937 set_min_partial(s, ilog2(s->size));
74938- s->refcount = 1;
74939+ atomic_set(&s->refcount, 1);
74940 #ifdef CONFIG_NUMA
74941 s->remote_node_defrag_ratio = 1000;
74942 #endif
74943@@ -2750,8 +2752,7 @@ static inline int kmem_cache_close(struc
74944 void kmem_cache_destroy(struct kmem_cache *s)
74945 {
74946 down_write(&slub_lock);
74947- s->refcount--;
74948- if (!s->refcount) {
74949+ if (atomic_dec_and_test(&s->refcount)) {
74950 list_del(&s->list);
74951 if (kmem_cache_close(s)) {
74952 printk(KERN_ERR "SLUB %s: %s called for cache that "
74953@@ -2961,6 +2962,46 @@ void *__kmalloc_node(size_t size, gfp_t
74954 EXPORT_SYMBOL(__kmalloc_node);
74955 #endif
74956
74957+void check_object_size(const void *ptr, unsigned long n, bool to)
74958+{
74959+
74960+#ifdef CONFIG_PAX_USERCOPY
74961+ struct page *page;
74962+ struct kmem_cache *s = NULL;
74963+ unsigned long offset;
74964+
74965+ if (!n)
74966+ return;
74967+
74968+ if (ZERO_OR_NULL_PTR(ptr))
74969+ goto report;
74970+
74971+ if (!virt_addr_valid(ptr))
74972+ return;
74973+
74974+ page = virt_to_head_page(ptr);
74975+
74976+ if (!PageSlab(page)) {
74977+ if (object_is_on_stack(ptr, n) == -1)
74978+ goto report;
74979+ return;
74980+ }
74981+
74982+ s = page->slab;
74983+ if (!(s->flags & SLAB_USERCOPY))
74984+ goto report;
74985+
74986+ offset = (ptr - page_address(page)) % s->size;
74987+ if (offset <= s->objsize && n <= s->objsize - offset)
74988+ return;
74989+
74990+report:
74991+ pax_report_usercopy(ptr, n, to, s ? s->name : NULL);
74992+#endif
74993+
74994+}
74995+EXPORT_SYMBOL(check_object_size);
74996+
74997 size_t ksize(const void *object)
74998 {
74999 struct page *page;
75000@@ -3205,7 +3246,7 @@ static void __init kmem_cache_bootstrap_
75001 int node;
75002
75003 list_add(&s->list, &slab_caches);
75004- s->refcount = -1;
75005+ atomic_set(&s->refcount, -1);
75006
75007 for_each_node_state(node, N_NORMAL_MEMORY) {
75008 struct kmem_cache_node *n = get_node(s, node);
75009@@ -3322,17 +3363,17 @@ void __init kmem_cache_init(void)
75010
75011 /* Caches that are not of the two-to-the-power-of size */
75012 if (KMALLOC_MIN_SIZE <= 32) {
75013- kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, 0);
75014+ kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, SLAB_USERCOPY);
75015 caches++;
75016 }
75017
75018 if (KMALLOC_MIN_SIZE <= 64) {
75019- kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, 0);
75020+ kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, SLAB_USERCOPY);
75021 caches++;
75022 }
75023
75024 for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
75025- kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, 0);
75026+ kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, SLAB_USERCOPY);
75027 caches++;
75028 }
75029
75030@@ -3400,7 +3441,7 @@ static int slab_unmergeable(struct kmem_
75031 /*
75032 * We may have set a slab to be unmergeable during bootstrap.
75033 */
75034- if (s->refcount < 0)
75035+ if (atomic_read(&s->refcount) < 0)
75036 return 1;
75037
75038 return 0;
75039@@ -3459,7 +3500,7 @@ struct kmem_cache *kmem_cache_create(con
75040 down_write(&slub_lock);
75041 s = find_mergeable(size, align, flags, name, ctor);
75042 if (s) {
75043- s->refcount++;
75044+ atomic_inc(&s->refcount);
75045 /*
75046 * Adjust the object sizes so that we clear
75047 * the complete object on kzalloc.
75048@@ -3468,7 +3509,7 @@ struct kmem_cache *kmem_cache_create(con
75049 s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
75050
75051 if (sysfs_slab_alias(s, name)) {
75052- s->refcount--;
75053+ atomic_dec(&s->refcount);
75054 goto err;
75055 }
75056 up_write(&slub_lock);
75057@@ -4201,7 +4242,7 @@ SLAB_ATTR_RO(ctor);
75058
75059 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
75060 {
75061- return sprintf(buf, "%d\n", s->refcount - 1);
75062+ return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
75063 }
75064 SLAB_ATTR_RO(aliases);
75065
75066@@ -4945,7 +4986,13 @@ static const struct file_operations proc
75067
75068 static int __init slab_proc_init(void)
75069 {
75070- proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
75071+ mode_t gr_mode = S_IRUGO;
75072+
75073+#ifdef CONFIG_GRKERNSEC_PROC_ADD
75074+ gr_mode = S_IRUSR;
75075+#endif
75076+
75077+ proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
75078 return 0;
75079 }
75080 module_init(slab_proc_init);
75081diff -urNp linux-2.6.39.1/mm/swapfile.c linux-2.6.39.1/mm/swapfile.c
75082--- linux-2.6.39.1/mm/swapfile.c 2011-05-19 00:06:34.000000000 -0400
75083+++ linux-2.6.39.1/mm/swapfile.c 2011-05-22 19:36:33.000000000 -0400
75084@@ -61,7 +61,7 @@ static DEFINE_MUTEX(swapon_mutex);
75085
75086 static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait);
75087 /* Activity counter to indicate that a swapon or swapoff has occurred */
75088-static atomic_t proc_poll_event = ATOMIC_INIT(0);
75089+static atomic_unchecked_t proc_poll_event = ATOMIC_INIT(0);
75090
75091 static inline unsigned char swap_count(unsigned char ent)
75092 {
75093@@ -1669,7 +1669,7 @@ SYSCALL_DEFINE1(swapoff, const char __us
75094 }
75095 filp_close(swap_file, NULL);
75096 err = 0;
75097- atomic_inc(&proc_poll_event);
75098+ atomic_inc_unchecked(&proc_poll_event);
75099 wake_up_interruptible(&proc_poll_wait);
75100
75101 out_dput:
75102@@ -1690,8 +1690,8 @@ static unsigned swaps_poll(struct file *
75103
75104 poll_wait(file, &proc_poll_wait, wait);
75105
75106- if (s->event != atomic_read(&proc_poll_event)) {
75107- s->event = atomic_read(&proc_poll_event);
75108+ if (s->event != atomic_read_unchecked(&proc_poll_event)) {
75109+ s->event = atomic_read_unchecked(&proc_poll_event);
75110 return POLLIN | POLLRDNORM | POLLERR | POLLPRI;
75111 }
75112
75113@@ -1797,7 +1797,7 @@ static int swaps_open(struct inode *inod
75114 }
75115
75116 s->seq.private = s;
75117- s->event = atomic_read(&proc_poll_event);
75118+ s->event = atomic_read_unchecked(&proc_poll_event);
75119 return ret;
75120 }
75121
75122@@ -2131,7 +2131,7 @@ SYSCALL_DEFINE2(swapon, const char __use
75123 (p->flags & SWP_DISCARDABLE) ? "D" : "");
75124
75125 mutex_unlock(&swapon_mutex);
75126- atomic_inc(&proc_poll_event);
75127+ atomic_inc_unchecked(&proc_poll_event);
75128 wake_up_interruptible(&proc_poll_wait);
75129
75130 if (S_ISREG(inode->i_mode))
75131diff -urNp linux-2.6.39.1/mm/util.c linux-2.6.39.1/mm/util.c
75132--- linux-2.6.39.1/mm/util.c 2011-05-19 00:06:34.000000000 -0400
75133+++ linux-2.6.39.1/mm/util.c 2011-05-23 17:07:00.000000000 -0400
75134@@ -112,6 +112,7 @@ EXPORT_SYMBOL(memdup_user);
75135 * allocated buffer. Use this if you don't want to free the buffer immediately
75136 * like, for example, with RCU.
75137 */
75138+#undef __krealloc
75139 void *__krealloc(const void *p, size_t new_size, gfp_t flags)
75140 {
75141 void *ret;
75142@@ -145,6 +146,7 @@ EXPORT_SYMBOL(__krealloc);
75143 * behaves exactly like kmalloc(). If @size is 0 and @p is not a
75144 * %NULL pointer, the object pointed to is freed.
75145 */
75146+#undef krealloc
75147 void *krealloc(const void *p, size_t new_size, gfp_t flags)
75148 {
75149 void *ret;
75150@@ -219,6 +221,12 @@ EXPORT_SYMBOL(strndup_user);
75151 void arch_pick_mmap_layout(struct mm_struct *mm)
75152 {
75153 mm->mmap_base = TASK_UNMAPPED_BASE;
75154+
75155+#ifdef CONFIG_PAX_RANDMMAP
75156+ if (mm->pax_flags & MF_PAX_RANDMMAP)
75157+ mm->mmap_base += mm->delta_mmap;
75158+#endif
75159+
75160 mm->get_unmapped_area = arch_get_unmapped_area;
75161 mm->unmap_area = arch_unmap_area;
75162 }
75163diff -urNp linux-2.6.39.1/mm/vmalloc.c linux-2.6.39.1/mm/vmalloc.c
75164--- linux-2.6.39.1/mm/vmalloc.c 2011-05-19 00:06:34.000000000 -0400
75165+++ linux-2.6.39.1/mm/vmalloc.c 2011-05-22 19:36:33.000000000 -0400
75166@@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd,
75167
75168 pte = pte_offset_kernel(pmd, addr);
75169 do {
75170- pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
75171- WARN_ON(!pte_none(ptent) && !pte_present(ptent));
75172+
75173+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75174+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
75175+ BUG_ON(!pte_exec(*pte));
75176+ set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
75177+ continue;
75178+ }
75179+#endif
75180+
75181+ {
75182+ pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
75183+ WARN_ON(!pte_none(ptent) && !pte_present(ptent));
75184+ }
75185 } while (pte++, addr += PAGE_SIZE, addr != end);
75186 }
75187
75188@@ -91,6 +102,7 @@ static int vmap_pte_range(pmd_t *pmd, un
75189 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
75190 {
75191 pte_t *pte;
75192+ int ret = -ENOMEM;
75193
75194 /*
75195 * nr is a running index into the array which helps higher level
75196@@ -100,17 +112,30 @@ static int vmap_pte_range(pmd_t *pmd, un
75197 pte = pte_alloc_kernel(pmd, addr);
75198 if (!pte)
75199 return -ENOMEM;
75200+
75201+ pax_open_kernel();
75202 do {
75203 struct page *page = pages[*nr];
75204
75205- if (WARN_ON(!pte_none(*pte)))
75206- return -EBUSY;
75207- if (WARN_ON(!page))
75208- return -ENOMEM;
75209+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75210+ if (pgprot_val(prot) & _PAGE_NX)
75211+#endif
75212+
75213+ if (WARN_ON(!pte_none(*pte))) {
75214+ ret = -EBUSY;
75215+ goto out;
75216+ }
75217+ if (WARN_ON(!page)) {
75218+ ret = -ENOMEM;
75219+ goto out;
75220+ }
75221 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
75222 (*nr)++;
75223 } while (pte++, addr += PAGE_SIZE, addr != end);
75224- return 0;
75225+ ret = 0;
75226+out:
75227+ pax_close_kernel();
75228+ return ret;
75229 }
75230
75231 static int vmap_pmd_range(pud_t *pud, unsigned long addr,
75232@@ -191,11 +216,20 @@ int is_vmalloc_or_module_addr(const void
75233 * and fall back on vmalloc() if that fails. Others
75234 * just put it in the vmalloc space.
75235 */
75236-#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
75237+#ifdef CONFIG_MODULES
75238+#ifdef MODULES_VADDR
75239 unsigned long addr = (unsigned long)x;
75240 if (addr >= MODULES_VADDR && addr < MODULES_END)
75241 return 1;
75242 #endif
75243+
75244+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75245+ if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
75246+ return 1;
75247+#endif
75248+
75249+#endif
75250+
75251 return is_vmalloc_addr(x);
75252 }
75253
75254@@ -216,8 +250,14 @@ struct page *vmalloc_to_page(const void
75255
75256 if (!pgd_none(*pgd)) {
75257 pud_t *pud = pud_offset(pgd, addr);
75258+#ifdef CONFIG_X86
75259+ if (!pud_large(*pud))
75260+#endif
75261 if (!pud_none(*pud)) {
75262 pmd_t *pmd = pmd_offset(pud, addr);
75263+#ifdef CONFIG_X86
75264+ if (!pmd_large(*pmd))
75265+#endif
75266 if (!pmd_none(*pmd)) {
75267 pte_t *ptep, pte;
75268
75269@@ -1296,6 +1336,16 @@ static struct vm_struct *__get_vm_area_n
75270 struct vm_struct *area;
75271
75272 BUG_ON(in_interrupt());
75273+
75274+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75275+ if (flags & VM_KERNEXEC) {
75276+ if (start != VMALLOC_START || end != VMALLOC_END)
75277+ return NULL;
75278+ start = (unsigned long)MODULES_EXEC_VADDR;
75279+ end = (unsigned long)MODULES_EXEC_END;
75280+ }
75281+#endif
75282+
75283 if (flags & VM_IOREMAP) {
75284 int bit = fls(size);
75285
75286@@ -1514,6 +1564,11 @@ void *vmap(struct page **pages, unsigned
75287 if (count > totalram_pages)
75288 return NULL;
75289
75290+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75291+ if (!(pgprot_val(prot) & _PAGE_NX))
75292+ flags |= VM_KERNEXEC;
75293+#endif
75294+
75295 area = get_vm_area_caller((count << PAGE_SHIFT), flags,
75296 __builtin_return_address(0));
75297 if (!area)
75298@@ -1610,6 +1665,13 @@ void *__vmalloc_node_range(unsigned long
75299 if (!size || (size >> PAGE_SHIFT) > totalram_pages)
75300 return NULL;
75301
75302+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75303+ if (!(pgprot_val(prot) & _PAGE_NX))
75304+ area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
75305+ node, gfp_mask, caller);
75306+ else
75307+#endif
75308+
75309 area = __get_vm_area_node(size, align, VM_ALLOC, start, end, node,
75310 gfp_mask, caller);
75311
75312@@ -1649,6 +1711,7 @@ static void *__vmalloc_node(unsigned lon
75313 gfp_mask, prot, node, caller);
75314 }
75315
75316+#undef __vmalloc
75317 void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
75318 {
75319 return __vmalloc_node(size, 1, gfp_mask, prot, -1,
75320@@ -1672,6 +1735,7 @@ static inline void *__vmalloc_node_flags
75321 * For tight control over page level allocator and protection flags
75322 * use __vmalloc() instead.
75323 */
75324+#undef vmalloc
75325 void *vmalloc(unsigned long size)
75326 {
75327 return __vmalloc_node_flags(size, -1, GFP_KERNEL | __GFP_HIGHMEM);
75328@@ -1688,6 +1752,7 @@ EXPORT_SYMBOL(vmalloc);
75329 * For tight control over page level allocator and protection flags
75330 * use __vmalloc() instead.
75331 */
75332+#undef vzalloc
75333 void *vzalloc(unsigned long size)
75334 {
75335 return __vmalloc_node_flags(size, -1,
75336@@ -1702,6 +1767,7 @@ EXPORT_SYMBOL(vzalloc);
75337 * The resulting memory area is zeroed so it can be mapped to userspace
75338 * without leaking data.
75339 */
75340+#undef vmalloc_user
75341 void *vmalloc_user(unsigned long size)
75342 {
75343 struct vm_struct *area;
75344@@ -1729,6 +1795,7 @@ EXPORT_SYMBOL(vmalloc_user);
75345 * For tight control over page level allocator and protection flags
75346 * use __vmalloc() instead.
75347 */
75348+#undef vmalloc_node
75349 void *vmalloc_node(unsigned long size, int node)
75350 {
75351 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
75352@@ -1748,6 +1815,7 @@ EXPORT_SYMBOL(vmalloc_node);
75353 * For tight control over page level allocator and protection flags
75354 * use __vmalloc_node() instead.
75355 */
75356+#undef vzalloc_node
75357 void *vzalloc_node(unsigned long size, int node)
75358 {
75359 return __vmalloc_node_flags(size, node,
75360@@ -1770,10 +1838,10 @@ EXPORT_SYMBOL(vzalloc_node);
75361 * For tight control over page level allocator and protection flags
75362 * use __vmalloc() instead.
75363 */
75364-
75365+#undef vmalloc_exec
75366 void *vmalloc_exec(unsigned long size)
75367 {
75368- return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
75369+ return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
75370 -1, __builtin_return_address(0));
75371 }
75372
75373@@ -1792,6 +1860,7 @@ void *vmalloc_exec(unsigned long size)
75374 * Allocate enough 32bit PA addressable pages to cover @size from the
75375 * page level allocator and map them into contiguous kernel virtual space.
75376 */
75377+#undef vmalloc_32
75378 void *vmalloc_32(unsigned long size)
75379 {
75380 return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
75381@@ -1806,6 +1875,7 @@ EXPORT_SYMBOL(vmalloc_32);
75382 * The resulting memory area is 32bit addressable and zeroed so it can be
75383 * mapped to userspace without leaking data.
75384 */
75385+#undef vmalloc_32_user
75386 void *vmalloc_32_user(unsigned long size)
75387 {
75388 struct vm_struct *area;
75389@@ -2068,6 +2138,8 @@ int remap_vmalloc_range(struct vm_area_s
75390 unsigned long uaddr = vma->vm_start;
75391 unsigned long usize = vma->vm_end - vma->vm_start;
75392
75393+ BUG_ON(vma->vm_mirror);
75394+
75395 if ((PAGE_SIZE-1) & (unsigned long)addr)
75396 return -EINVAL;
75397
75398diff -urNp linux-2.6.39.1/mm/vmstat.c linux-2.6.39.1/mm/vmstat.c
75399--- linux-2.6.39.1/mm/vmstat.c 2011-05-19 00:06:34.000000000 -0400
75400+++ linux-2.6.39.1/mm/vmstat.c 2011-05-22 19:41:42.000000000 -0400
75401@@ -78,7 +78,7 @@ void vm_events_fold_cpu(int cpu)
75402 *
75403 * vm_stat contains the global counters
75404 */
75405-atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
75406+atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
75407 EXPORT_SYMBOL(vm_stat);
75408
75409 #ifdef CONFIG_SMP
75410@@ -454,7 +454,7 @@ void refresh_cpu_vm_stats(int cpu)
75411 v = p->vm_stat_diff[i];
75412 p->vm_stat_diff[i] = 0;
75413 local_irq_restore(flags);
75414- atomic_long_add(v, &zone->vm_stat[i]);
75415+ atomic_long_add_unchecked(v, &zone->vm_stat[i]);
75416 global_diff[i] += v;
75417 #ifdef CONFIG_NUMA
75418 /* 3 seconds idle till flush */
75419@@ -492,7 +492,7 @@ void refresh_cpu_vm_stats(int cpu)
75420
75421 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
75422 if (global_diff[i])
75423- atomic_long_add(global_diff[i], &vm_stat[i]);
75424+ atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
75425 }
75426
75427 #endif
75428@@ -1205,10 +1205,20 @@ static int __init setup_vmstat(void)
75429 start_cpu_timer(cpu);
75430 #endif
75431 #ifdef CONFIG_PROC_FS
75432- proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
75433- proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
75434- proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
75435- proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
75436+ {
75437+ mode_t gr_mode = S_IRUGO;
75438+#ifdef CONFIG_GRKERNSEC_PROC_ADD
75439+ gr_mode = S_IRUSR;
75440+#endif
75441+ proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
75442+ proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
75443+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
75444+ proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
75445+#else
75446+ proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
75447+#endif
75448+ proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
75449+ }
75450 #endif
75451 return 0;
75452 }
75453diff -urNp linux-2.6.39.1/net/8021q/vlan.c linux-2.6.39.1/net/8021q/vlan.c
75454--- linux-2.6.39.1/net/8021q/vlan.c 2011-05-19 00:06:34.000000000 -0400
75455+++ linux-2.6.39.1/net/8021q/vlan.c 2011-05-22 19:36:33.000000000 -0400
75456@@ -592,8 +592,7 @@ static int vlan_ioctl_handler(struct net
75457 err = -EPERM;
75458 if (!capable(CAP_NET_ADMIN))
75459 break;
75460- if ((args.u.name_type >= 0) &&
75461- (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
75462+ if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
75463 struct vlan_net *vn;
75464
75465 vn = net_generic(net, vlan_net_id);
75466diff -urNp linux-2.6.39.1/net/atm/atm_misc.c linux-2.6.39.1/net/atm/atm_misc.c
75467--- linux-2.6.39.1/net/atm/atm_misc.c 2011-05-19 00:06:34.000000000 -0400
75468+++ linux-2.6.39.1/net/atm/atm_misc.c 2011-05-22 19:36:33.000000000 -0400
75469@@ -17,7 +17,7 @@ int atm_charge(struct atm_vcc *vcc, int
75470 if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
75471 return 1;
75472 atm_return(vcc, truesize);
75473- atomic_inc(&vcc->stats->rx_drop);
75474+ atomic_inc_unchecked(&vcc->stats->rx_drop);
75475 return 0;
75476 }
75477 EXPORT_SYMBOL(atm_charge);
75478@@ -39,7 +39,7 @@ struct sk_buff *atm_alloc_charge(struct
75479 }
75480 }
75481 atm_return(vcc, guess);
75482- atomic_inc(&vcc->stats->rx_drop);
75483+ atomic_inc_unchecked(&vcc->stats->rx_drop);
75484 return NULL;
75485 }
75486 EXPORT_SYMBOL(atm_alloc_charge);
75487@@ -86,7 +86,7 @@ EXPORT_SYMBOL(atm_pcr_goal);
75488
75489 void sonet_copy_stats(struct k_sonet_stats *from, struct sonet_stats *to)
75490 {
75491-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
75492+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
75493 __SONET_ITEMS
75494 #undef __HANDLE_ITEM
75495 }
75496@@ -94,7 +94,7 @@ EXPORT_SYMBOL(sonet_copy_stats);
75497
75498 void sonet_subtract_stats(struct k_sonet_stats *from, struct sonet_stats *to)
75499 {
75500-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
75501+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
75502 __SONET_ITEMS
75503 #undef __HANDLE_ITEM
75504 }
75505diff -urNp linux-2.6.39.1/net/atm/mpoa_caches.c linux-2.6.39.1/net/atm/mpoa_caches.c
75506--- linux-2.6.39.1/net/atm/mpoa_caches.c 2011-05-19 00:06:34.000000000 -0400
75507+++ linux-2.6.39.1/net/atm/mpoa_caches.c 2011-05-22 19:36:33.000000000 -0400
75508@@ -255,6 +255,8 @@ static void check_resolving_entries(stru
75509 struct timeval now;
75510 struct k_message msg;
75511
75512+ pax_track_stack();
75513+
75514 do_gettimeofday(&now);
75515
75516 read_lock_bh(&client->ingress_lock);
75517diff -urNp linux-2.6.39.1/net/atm/proc.c linux-2.6.39.1/net/atm/proc.c
75518--- linux-2.6.39.1/net/atm/proc.c 2011-05-19 00:06:34.000000000 -0400
75519+++ linux-2.6.39.1/net/atm/proc.c 2011-05-22 19:41:42.000000000 -0400
75520@@ -45,9 +45,9 @@ static void add_stats(struct seq_file *s
75521 const struct k_atm_aal_stats *stats)
75522 {
75523 seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
75524- atomic_read(&stats->tx), atomic_read(&stats->tx_err),
75525- atomic_read(&stats->rx), atomic_read(&stats->rx_err),
75526- atomic_read(&stats->rx_drop));
75527+ atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
75528+ atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
75529+ atomic_read_unchecked(&stats->rx_drop));
75530 }
75531
75532 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
75533@@ -191,7 +191,12 @@ static void vcc_info(struct seq_file *se
75534 {
75535 struct sock *sk = sk_atm(vcc);
75536
75537+#ifdef CONFIG_GRKERNSEC_HIDESYM
75538+ seq_printf(seq, "%p ", NULL);
75539+#else
75540 seq_printf(seq, "%p ", vcc);
75541+#endif
75542+
75543 if (!vcc->dev)
75544 seq_printf(seq, "Unassigned ");
75545 else
75546@@ -218,7 +223,11 @@ static void svc_info(struct seq_file *se
75547 {
75548 if (!vcc->dev)
75549 seq_printf(seq, sizeof(void *) == 4 ?
75550+#ifdef CONFIG_GRKERNSEC_HIDESYM
75551+ "N/A@%p%10s" : "N/A@%p%2s", NULL, "");
75552+#else
75553 "N/A@%p%10s" : "N/A@%p%2s", vcc, "");
75554+#endif
75555 else
75556 seq_printf(seq, "%3d %3d %5d ",
75557 vcc->dev->number, vcc->vpi, vcc->vci);
75558diff -urNp linux-2.6.39.1/net/atm/resources.c linux-2.6.39.1/net/atm/resources.c
75559--- linux-2.6.39.1/net/atm/resources.c 2011-05-19 00:06:34.000000000 -0400
75560+++ linux-2.6.39.1/net/atm/resources.c 2011-05-22 19:36:33.000000000 -0400
75561@@ -160,7 +160,7 @@ EXPORT_SYMBOL(atm_dev_deregister);
75562 static void copy_aal_stats(struct k_atm_aal_stats *from,
75563 struct atm_aal_stats *to)
75564 {
75565-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
75566+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
75567 __AAL_STAT_ITEMS
75568 #undef __HANDLE_ITEM
75569 }
75570@@ -168,7 +168,7 @@ static void copy_aal_stats(struct k_atm_
75571 static void subtract_aal_stats(struct k_atm_aal_stats *from,
75572 struct atm_aal_stats *to)
75573 {
75574-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
75575+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
75576 __AAL_STAT_ITEMS
75577 #undef __HANDLE_ITEM
75578 }
75579diff -urNp linux-2.6.39.1/net/batman-adv/hard-interface.c linux-2.6.39.1/net/batman-adv/hard-interface.c
75580--- linux-2.6.39.1/net/batman-adv/hard-interface.c 2011-05-19 00:06:34.000000000 -0400
75581+++ linux-2.6.39.1/net/batman-adv/hard-interface.c 2011-05-22 19:36:33.000000000 -0400
75582@@ -339,8 +339,8 @@ int hardif_enable_interface(struct hard_
75583 hard_iface->batman_adv_ptype.dev = hard_iface->net_dev;
75584 dev_add_pack(&hard_iface->batman_adv_ptype);
75585
75586- atomic_set(&hard_iface->seqno, 1);
75587- atomic_set(&hard_iface->frag_seqno, 1);
75588+ atomic_set_unchecked(&hard_iface->seqno, 1);
75589+ atomic_set_unchecked(&hard_iface->frag_seqno, 1);
75590 bat_info(hard_iface->soft_iface, "Adding interface: %s\n",
75591 hard_iface->net_dev->name);
75592
75593diff -urNp linux-2.6.39.1/net/batman-adv/routing.c linux-2.6.39.1/net/batman-adv/routing.c
75594--- linux-2.6.39.1/net/batman-adv/routing.c 2011-05-19 00:06:34.000000000 -0400
75595+++ linux-2.6.39.1/net/batman-adv/routing.c 2011-05-22 19:36:33.000000000 -0400
75596@@ -625,7 +625,7 @@ void receive_bat_packet(struct ethhdr *e
75597 return;
75598
75599 /* could be changed by schedule_own_packet() */
75600- if_incoming_seqno = atomic_read(&if_incoming->seqno);
75601+ if_incoming_seqno = atomic_read_unchecked(&if_incoming->seqno);
75602
75603 has_directlink_flag = (batman_packet->flags & DIRECTLINK ? 1 : 0);
75604
75605diff -urNp linux-2.6.39.1/net/batman-adv/send.c linux-2.6.39.1/net/batman-adv/send.c
75606--- linux-2.6.39.1/net/batman-adv/send.c 2011-05-19 00:06:34.000000000 -0400
75607+++ linux-2.6.39.1/net/batman-adv/send.c 2011-05-22 19:36:33.000000000 -0400
75608@@ -277,7 +277,7 @@ void schedule_own_packet(struct hard_ifa
75609
75610 /* change sequence number to network order */
75611 batman_packet->seqno =
75612- htonl((uint32_t)atomic_read(&hard_iface->seqno));
75613+ htonl((uint32_t)atomic_read_unchecked(&hard_iface->seqno));
75614
75615 if (vis_server == VIS_TYPE_SERVER_SYNC)
75616 batman_packet->flags |= VIS_SERVER;
75617@@ -291,7 +291,7 @@ void schedule_own_packet(struct hard_ifa
75618 else
75619 batman_packet->gw_flags = 0;
75620
75621- atomic_inc(&hard_iface->seqno);
75622+ atomic_inc_unchecked(&hard_iface->seqno);
75623
75624 slide_own_bcast_window(hard_iface);
75625 send_time = own_send_time(bat_priv);
75626diff -urNp linux-2.6.39.1/net/batman-adv/soft-interface.c linux-2.6.39.1/net/batman-adv/soft-interface.c
75627--- linux-2.6.39.1/net/batman-adv/soft-interface.c 2011-05-19 00:06:34.000000000 -0400
75628+++ linux-2.6.39.1/net/batman-adv/soft-interface.c 2011-05-22 19:36:33.000000000 -0400
75629@@ -386,7 +386,7 @@ int interface_tx(struct sk_buff *skb, st
75630
75631 /* set broadcast sequence number */
75632 bcast_packet->seqno =
75633- htonl(atomic_inc_return(&bat_priv->bcast_seqno));
75634+ htonl(atomic_inc_return_unchecked(&bat_priv->bcast_seqno));
75635
75636 add_bcast_packet_to_list(bat_priv, skb);
75637
75638@@ -579,7 +579,7 @@ struct net_device *softif_create(char *n
75639 atomic_set(&bat_priv->batman_queue_left, BATMAN_QUEUE_LEN);
75640
75641 atomic_set(&bat_priv->mesh_state, MESH_INACTIVE);
75642- atomic_set(&bat_priv->bcast_seqno, 1);
75643+ atomic_set_unchecked(&bat_priv->bcast_seqno, 1);
75644 atomic_set(&bat_priv->hna_local_changed, 0);
75645
75646 bat_priv->primary_if = NULL;
75647diff -urNp linux-2.6.39.1/net/batman-adv/types.h linux-2.6.39.1/net/batman-adv/types.h
75648--- linux-2.6.39.1/net/batman-adv/types.h 2011-05-19 00:06:34.000000000 -0400
75649+++ linux-2.6.39.1/net/batman-adv/types.h 2011-05-22 19:36:33.000000000 -0400
75650@@ -38,8 +38,8 @@ struct hard_iface {
75651 int16_t if_num;
75652 char if_status;
75653 struct net_device *net_dev;
75654- atomic_t seqno;
75655- atomic_t frag_seqno;
75656+ atomic_unchecked_t seqno;
75657+ atomic_unchecked_t frag_seqno;
75658 unsigned char *packet_buff;
75659 int packet_len;
75660 struct kobject *hardif_obj;
75661@@ -141,7 +141,7 @@ struct bat_priv {
75662 atomic_t orig_interval; /* uint */
75663 atomic_t hop_penalty; /* uint */
75664 atomic_t log_level; /* uint */
75665- atomic_t bcast_seqno;
75666+ atomic_unchecked_t bcast_seqno;
75667 atomic_t bcast_queue_left;
75668 atomic_t batman_queue_left;
75669 char num_ifaces;
75670diff -urNp linux-2.6.39.1/net/batman-adv/unicast.c linux-2.6.39.1/net/batman-adv/unicast.c
75671--- linux-2.6.39.1/net/batman-adv/unicast.c 2011-05-19 00:06:34.000000000 -0400
75672+++ linux-2.6.39.1/net/batman-adv/unicast.c 2011-05-22 19:36:33.000000000 -0400
75673@@ -263,7 +263,7 @@ int frag_send_skb(struct sk_buff *skb, s
75674 frag1->flags = UNI_FRAG_HEAD | large_tail;
75675 frag2->flags = large_tail;
75676
75677- seqno = atomic_add_return(2, &hard_iface->frag_seqno);
75678+ seqno = atomic_add_return_unchecked(2, &hard_iface->frag_seqno);
75679 frag1->seqno = htons(seqno - 1);
75680 frag2->seqno = htons(seqno);
75681
75682diff -urNp linux-2.6.39.1/net/bridge/br_multicast.c linux-2.6.39.1/net/bridge/br_multicast.c
75683--- linux-2.6.39.1/net/bridge/br_multicast.c 2011-05-19 00:06:34.000000000 -0400
75684+++ linux-2.6.39.1/net/bridge/br_multicast.c 2011-05-22 19:36:33.000000000 -0400
75685@@ -1482,7 +1482,7 @@ static int br_multicast_ipv6_rcv(struct
75686 nexthdr = ip6h->nexthdr;
75687 offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
75688
75689- if (offset < 0 || nexthdr != IPPROTO_ICMPV6)
75690+ if (nexthdr != IPPROTO_ICMPV6)
75691 return 0;
75692
75693 /* Okay, we found ICMPv6 header */
75694diff -urNp linux-2.6.39.1/net/bridge/netfilter/ebtables.c linux-2.6.39.1/net/bridge/netfilter/ebtables.c
75695--- linux-2.6.39.1/net/bridge/netfilter/ebtables.c 2011-05-19 00:06:34.000000000 -0400
75696+++ linux-2.6.39.1/net/bridge/netfilter/ebtables.c 2011-05-22 19:36:33.000000000 -0400
75697@@ -1512,7 +1512,7 @@ static int do_ebt_get_ctl(struct sock *s
75698 tmp.valid_hooks = t->table->valid_hooks;
75699 }
75700 mutex_unlock(&ebt_mutex);
75701- if (copy_to_user(user, &tmp, *len) != 0){
75702+ if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0){
75703 BUGPRINT("c2u Didn't work\n");
75704 ret = -EFAULT;
75705 break;
75706@@ -1780,6 +1780,8 @@ static int compat_copy_everything_to_use
75707 int ret;
75708 void __user *pos;
75709
75710+ pax_track_stack();
75711+
75712 memset(&tinfo, 0, sizeof(tinfo));
75713
75714 if (cmd == EBT_SO_GET_ENTRIES) {
75715diff -urNp linux-2.6.39.1/net/caif/caif_socket.c linux-2.6.39.1/net/caif/caif_socket.c
75716--- linux-2.6.39.1/net/caif/caif_socket.c 2011-05-19 00:06:34.000000000 -0400
75717+++ linux-2.6.39.1/net/caif/caif_socket.c 2011-05-22 19:36:33.000000000 -0400
75718@@ -48,18 +48,19 @@ static struct dentry *debugfsdir;
75719 #ifdef CONFIG_DEBUG_FS
75720 struct debug_fs_counter {
75721 atomic_t caif_nr_socks;
75722- atomic_t num_connect_req;
75723- atomic_t num_connect_resp;
75724- atomic_t num_connect_fail_resp;
75725- atomic_t num_disconnect;
75726- atomic_t num_remote_shutdown_ind;
75727- atomic_t num_tx_flow_off_ind;
75728- atomic_t num_tx_flow_on_ind;
75729- atomic_t num_rx_flow_off;
75730- atomic_t num_rx_flow_on;
75731+ atomic_unchecked_t num_connect_req;
75732+ atomic_unchecked_t num_connect_resp;
75733+ atomic_unchecked_t num_connect_fail_resp;
75734+ atomic_unchecked_t num_disconnect;
75735+ atomic_unchecked_t num_remote_shutdown_ind;
75736+ atomic_unchecked_t num_tx_flow_off_ind;
75737+ atomic_unchecked_t num_tx_flow_on_ind;
75738+ atomic_unchecked_t num_rx_flow_off;
75739+ atomic_unchecked_t num_rx_flow_on;
75740 };
75741 static struct debug_fs_counter cnt;
75742 #define dbfs_atomic_inc(v) atomic_inc(v)
75743+#define dbfs_atomic_inc_unchecked(v) atomic_inc_unchecked(v)
75744 #define dbfs_atomic_dec(v) atomic_dec(v)
75745 #else
75746 #define dbfs_atomic_inc(v)
75747@@ -159,7 +160,7 @@ static int caif_queue_rcv_skb(struct soc
75748 atomic_read(&cf_sk->sk.sk_rmem_alloc),
75749 sk_rcvbuf_lowwater(cf_sk));
75750 set_rx_flow_off(cf_sk);
75751- dbfs_atomic_inc(&cnt.num_rx_flow_off);
75752+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
75753 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
75754 }
75755
75756@@ -169,7 +170,7 @@ static int caif_queue_rcv_skb(struct soc
75757 if (!sk_rmem_schedule(sk, skb->truesize) && rx_flow_is_on(cf_sk)) {
75758 set_rx_flow_off(cf_sk);
75759 pr_debug("sending flow OFF due to rmem_schedule\n");
75760- dbfs_atomic_inc(&cnt.num_rx_flow_off);
75761+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
75762 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
75763 }
75764 skb->dev = NULL;
75765@@ -218,21 +219,21 @@ static void caif_ctrl_cb(struct cflayer
75766 switch (flow) {
75767 case CAIF_CTRLCMD_FLOW_ON_IND:
75768 /* OK from modem to start sending again */
75769- dbfs_atomic_inc(&cnt.num_tx_flow_on_ind);
75770+ dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_on_ind);
75771 set_tx_flow_on(cf_sk);
75772 cf_sk->sk.sk_state_change(&cf_sk->sk);
75773 break;
75774
75775 case CAIF_CTRLCMD_FLOW_OFF_IND:
75776 /* Modem asks us to shut up */
75777- dbfs_atomic_inc(&cnt.num_tx_flow_off_ind);
75778+ dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_off_ind);
75779 set_tx_flow_off(cf_sk);
75780 cf_sk->sk.sk_state_change(&cf_sk->sk);
75781 break;
75782
75783 case CAIF_CTRLCMD_INIT_RSP:
75784 /* We're now connected */
75785- dbfs_atomic_inc(&cnt.num_connect_resp);
75786+ dbfs_atomic_inc_unchecked(&cnt.num_connect_resp);
75787 cf_sk->sk.sk_state = CAIF_CONNECTED;
75788 set_tx_flow_on(cf_sk);
75789 cf_sk->sk.sk_state_change(&cf_sk->sk);
75790@@ -247,7 +248,7 @@ static void caif_ctrl_cb(struct cflayer
75791
75792 case CAIF_CTRLCMD_INIT_FAIL_RSP:
75793 /* Connect request failed */
75794- dbfs_atomic_inc(&cnt.num_connect_fail_resp);
75795+ dbfs_atomic_inc_unchecked(&cnt.num_connect_fail_resp);
75796 cf_sk->sk.sk_err = ECONNREFUSED;
75797 cf_sk->sk.sk_state = CAIF_DISCONNECTED;
75798 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
75799@@ -261,7 +262,7 @@ static void caif_ctrl_cb(struct cflayer
75800
75801 case CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND:
75802 /* Modem has closed this connection, or device is down. */
75803- dbfs_atomic_inc(&cnt.num_remote_shutdown_ind);
75804+ dbfs_atomic_inc_unchecked(&cnt.num_remote_shutdown_ind);
75805 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
75806 cf_sk->sk.sk_err = ECONNRESET;
75807 set_rx_flow_on(cf_sk);
75808@@ -281,7 +282,7 @@ static void caif_check_flow_release(stru
75809 return;
75810
75811 if (atomic_read(&sk->sk_rmem_alloc) <= sk_rcvbuf_lowwater(cf_sk)) {
75812- dbfs_atomic_inc(&cnt.num_rx_flow_on);
75813+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_on);
75814 set_rx_flow_on(cf_sk);
75815 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
75816 }
75817@@ -864,7 +865,7 @@ static int caif_connect(struct socket *s
75818 /*ifindex = id of the interface.*/
75819 cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
75820
75821- dbfs_atomic_inc(&cnt.num_connect_req);
75822+ dbfs_atomic_inc_unchecked(&cnt.num_connect_req);
75823 cf_sk->layer.receive = caif_sktrecv_cb;
75824 err = caif_connect_client(&cf_sk->conn_req,
75825 &cf_sk->layer, &ifindex, &headroom, &tailroom);
75826@@ -952,7 +953,7 @@ static int caif_release(struct socket *s
75827 spin_unlock(&sk->sk_receive_queue.lock);
75828 sock->sk = NULL;
75829
75830- dbfs_atomic_inc(&cnt.num_disconnect);
75831+ dbfs_atomic_inc_unchecked(&cnt.num_disconnect);
75832
75833 if (cf_sk->debugfs_socket_dir != NULL)
75834 debugfs_remove_recursive(cf_sk->debugfs_socket_dir);
75835diff -urNp linux-2.6.39.1/net/caif/cfctrl.c linux-2.6.39.1/net/caif/cfctrl.c
75836--- linux-2.6.39.1/net/caif/cfctrl.c 2011-05-19 00:06:34.000000000 -0400
75837+++ linux-2.6.39.1/net/caif/cfctrl.c 2011-05-22 19:36:33.000000000 -0400
75838@@ -9,6 +9,7 @@
75839 #include <linux/stddef.h>
75840 #include <linux/spinlock.h>
75841 #include <linux/slab.h>
75842+#include <linux/sched.h>
75843 #include <net/caif/caif_layer.h>
75844 #include <net/caif/cfpkt.h>
75845 #include <net/caif/cfctrl.h>
75846@@ -46,8 +47,8 @@ struct cflayer *cfctrl_create(void)
75847 dev_info.id = 0xff;
75848 memset(this, 0, sizeof(*this));
75849 cfsrvl_init(&this->serv, 0, &dev_info, false);
75850- atomic_set(&this->req_seq_no, 1);
75851- atomic_set(&this->rsp_seq_no, 1);
75852+ atomic_set_unchecked(&this->req_seq_no, 1);
75853+ atomic_set_unchecked(&this->rsp_seq_no, 1);
75854 this->serv.layer.receive = cfctrl_recv;
75855 sprintf(this->serv.layer.name, "ctrl");
75856 this->serv.layer.ctrlcmd = cfctrl_ctrlcmd;
75857@@ -116,8 +117,8 @@ void cfctrl_insert_req(struct cfctrl *ct
75858 struct cfctrl_request_info *req)
75859 {
75860 spin_lock(&ctrl->info_list_lock);
75861- atomic_inc(&ctrl->req_seq_no);
75862- req->sequence_no = atomic_read(&ctrl->req_seq_no);
75863+ atomic_inc_unchecked(&ctrl->req_seq_no);
75864+ req->sequence_no = atomic_read_unchecked(&ctrl->req_seq_no);
75865 list_add_tail(&req->list, &ctrl->list);
75866 spin_unlock(&ctrl->info_list_lock);
75867 }
75868@@ -136,7 +137,7 @@ struct cfctrl_request_info *cfctrl_remov
75869 if (p != first)
75870 pr_warn("Requests are not received in order\n");
75871
75872- atomic_set(&ctrl->rsp_seq_no,
75873+ atomic_set_unchecked(&ctrl->rsp_seq_no,
75874 p->sequence_no);
75875 list_del(&p->list);
75876 goto out;
75877@@ -385,6 +386,7 @@ static int cfctrl_recv(struct cflayer *l
75878 struct cfctrl *cfctrl = container_obj(layer);
75879 struct cfctrl_request_info rsp, *req;
75880
75881+ pax_track_stack();
75882
75883 cfpkt_extr_head(pkt, &cmdrsp, 1);
75884 cmd = cmdrsp & CFCTRL_CMD_MASK;
75885diff -urNp linux-2.6.39.1/net/can/bcm.c linux-2.6.39.1/net/can/bcm.c
75886--- linux-2.6.39.1/net/can/bcm.c 2011-05-19 00:06:34.000000000 -0400
75887+++ linux-2.6.39.1/net/can/bcm.c 2011-05-22 19:41:42.000000000 -0400
75888@@ -165,9 +165,15 @@ static int bcm_proc_show(struct seq_file
75889 struct bcm_sock *bo = bcm_sk(sk);
75890 struct bcm_op *op;
75891
75892+#ifdef CONFIG_GRKERNSEC_HIDESYM
75893+ seq_printf(m, ">>> socket %p", NULL);
75894+ seq_printf(m, " / sk %p", NULL);
75895+ seq_printf(m, " / bo %p", NULL);
75896+#else
75897 seq_printf(m, ">>> socket %p", sk->sk_socket);
75898 seq_printf(m, " / sk %p", sk);
75899 seq_printf(m, " / bo %p", bo);
75900+#endif
75901 seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
75902 seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
75903 seq_printf(m, " <<<\n");
75904diff -urNp linux-2.6.39.1/net/core/datagram.c linux-2.6.39.1/net/core/datagram.c
75905--- linux-2.6.39.1/net/core/datagram.c 2011-05-19 00:06:34.000000000 -0400
75906+++ linux-2.6.39.1/net/core/datagram.c 2011-05-22 19:36:33.000000000 -0400
75907@@ -285,7 +285,7 @@ int skb_kill_datagram(struct sock *sk, s
75908 }
75909
75910 kfree_skb(skb);
75911- atomic_inc(&sk->sk_drops);
75912+ atomic_inc_unchecked(&sk->sk_drops);
75913 sk_mem_reclaim_partial(sk);
75914
75915 return err;
75916diff -urNp linux-2.6.39.1/net/core/dev.c linux-2.6.39.1/net/core/dev.c
75917--- linux-2.6.39.1/net/core/dev.c 2011-06-03 00:04:14.000000000 -0400
75918+++ linux-2.6.39.1/net/core/dev.c 2011-06-03 00:32:08.000000000 -0400
75919@@ -1125,10 +1125,14 @@ void dev_load(struct net *net, const cha
75920 if (no_module && capable(CAP_NET_ADMIN))
75921 no_module = request_module("netdev-%s", name);
75922 if (no_module && capable(CAP_SYS_MODULE)) {
75923+#ifdef CONFIG_GRKERNSEC_MODHARDEN
75924+ ___request_module(true, "grsec_modharden_netdev", "%s", name);
75925+#else
75926 if (!request_module("%s", name))
75927 pr_err("Loading kernel module for a network device "
75928 "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
75929 "instead\n", name);
75930+#endif
75931 }
75932 }
75933 EXPORT_SYMBOL(dev_load);
75934@@ -1957,7 +1961,7 @@ struct dev_gso_cb {
75935
75936 static void dev_gso_skb_destructor(struct sk_buff *skb)
75937 {
75938- struct dev_gso_cb *cb;
75939+ const struct dev_gso_cb *cb;
75940
75941 do {
75942 struct sk_buff *nskb = skb->next;
75943@@ -2901,7 +2905,7 @@ int netif_rx_ni(struct sk_buff *skb)
75944 }
75945 EXPORT_SYMBOL(netif_rx_ni);
75946
75947-static void net_tx_action(struct softirq_action *h)
75948+static void net_tx_action(void)
75949 {
75950 struct softnet_data *sd = &__get_cpu_var(softnet_data);
75951
75952@@ -3765,7 +3769,7 @@ void netif_napi_del(struct napi_struct *
75953 }
75954 EXPORT_SYMBOL(netif_napi_del);
75955
75956-static void net_rx_action(struct softirq_action *h)
75957+static void net_rx_action(void)
75958 {
75959 struct softnet_data *sd = &__get_cpu_var(softnet_data);
75960 unsigned long time_limit = jiffies + 2;
75961diff -urNp linux-2.6.39.1/net/core/flow.c linux-2.6.39.1/net/core/flow.c
75962--- linux-2.6.39.1/net/core/flow.c 2011-05-19 00:06:34.000000000 -0400
75963+++ linux-2.6.39.1/net/core/flow.c 2011-05-22 19:36:34.000000000 -0400
75964@@ -60,7 +60,7 @@ struct flow_cache {
75965 struct timer_list rnd_timer;
75966 };
75967
75968-atomic_t flow_cache_genid = ATOMIC_INIT(0);
75969+atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
75970 EXPORT_SYMBOL(flow_cache_genid);
75971 static struct flow_cache flow_cache_global;
75972 static struct kmem_cache *flow_cachep __read_mostly;
75973@@ -85,7 +85,7 @@ static void flow_cache_new_hashrnd(unsig
75974
75975 static int flow_entry_valid(struct flow_cache_entry *fle)
75976 {
75977- if (atomic_read(&flow_cache_genid) != fle->genid)
75978+ if (atomic_read_unchecked(&flow_cache_genid) != fle->genid)
75979 return 0;
75980 if (fle->object && !fle->object->ops->check(fle->object))
75981 return 0;
75982@@ -253,7 +253,7 @@ flow_cache_lookup(struct net *net, const
75983 hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
75984 fcp->hash_count++;
75985 }
75986- } else if (likely(fle->genid == atomic_read(&flow_cache_genid))) {
75987+ } else if (likely(fle->genid == atomic_read_unchecked(&flow_cache_genid))) {
75988 flo = fle->object;
75989 if (!flo)
75990 goto ret_object;
75991@@ -274,7 +274,7 @@ nocache:
75992 }
75993 flo = resolver(net, key, family, dir, flo, ctx);
75994 if (fle) {
75995- fle->genid = atomic_read(&flow_cache_genid);
75996+ fle->genid = atomic_read_unchecked(&flow_cache_genid);
75997 if (!IS_ERR(flo))
75998 fle->object = flo;
75999 else
76000diff -urNp linux-2.6.39.1/net/core/skbuff.c linux-2.6.39.1/net/core/skbuff.c
76001--- linux-2.6.39.1/net/core/skbuff.c 2011-06-03 00:04:14.000000000 -0400
76002+++ linux-2.6.39.1/net/core/skbuff.c 2011-06-03 00:32:08.000000000 -0400
76003@@ -1542,6 +1542,8 @@ int skb_splice_bits(struct sk_buff *skb,
76004 struct sock *sk = skb->sk;
76005 int ret = 0;
76006
76007+ pax_track_stack();
76008+
76009 if (splice_grow_spd(pipe, &spd))
76010 return -ENOMEM;
76011
76012diff -urNp linux-2.6.39.1/net/core/sock.c linux-2.6.39.1/net/core/sock.c
76013--- linux-2.6.39.1/net/core/sock.c 2011-05-19 00:06:34.000000000 -0400
76014+++ linux-2.6.39.1/net/core/sock.c 2011-05-22 19:36:34.000000000 -0400
76015@@ -291,7 +291,7 @@ int sock_queue_rcv_skb(struct sock *sk,
76016 */
76017 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
76018 (unsigned)sk->sk_rcvbuf) {
76019- atomic_inc(&sk->sk_drops);
76020+ atomic_inc_unchecked(&sk->sk_drops);
76021 return -ENOMEM;
76022 }
76023
76024@@ -300,7 +300,7 @@ int sock_queue_rcv_skb(struct sock *sk,
76025 return err;
76026
76027 if (!sk_rmem_schedule(sk, skb->truesize)) {
76028- atomic_inc(&sk->sk_drops);
76029+ atomic_inc_unchecked(&sk->sk_drops);
76030 return -ENOBUFS;
76031 }
76032
76033@@ -320,7 +320,7 @@ int sock_queue_rcv_skb(struct sock *sk,
76034 skb_dst_force(skb);
76035
76036 spin_lock_irqsave(&list->lock, flags);
76037- skb->dropcount = atomic_read(&sk->sk_drops);
76038+ skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
76039 __skb_queue_tail(list, skb);
76040 spin_unlock_irqrestore(&list->lock, flags);
76041
76042@@ -340,7 +340,7 @@ int sk_receive_skb(struct sock *sk, stru
76043 skb->dev = NULL;
76044
76045 if (sk_rcvqueues_full(sk, skb)) {
76046- atomic_inc(&sk->sk_drops);
76047+ atomic_inc_unchecked(&sk->sk_drops);
76048 goto discard_and_relse;
76049 }
76050 if (nested)
76051@@ -358,7 +358,7 @@ int sk_receive_skb(struct sock *sk, stru
76052 mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
76053 } else if (sk_add_backlog(sk, skb)) {
76054 bh_unlock_sock(sk);
76055- atomic_inc(&sk->sk_drops);
76056+ atomic_inc_unchecked(&sk->sk_drops);
76057 goto discard_and_relse;
76058 }
76059
76060@@ -934,7 +934,7 @@ int sock_getsockopt(struct socket *sock,
76061 return -ENOTCONN;
76062 if (lv < len)
76063 return -EINVAL;
76064- if (copy_to_user(optval, address, len))
76065+ if (len > sizeof(address) || copy_to_user(optval, address, len))
76066 return -EFAULT;
76067 goto lenout;
76068 }
76069@@ -967,7 +967,7 @@ int sock_getsockopt(struct socket *sock,
76070
76071 if (len > lv)
76072 len = lv;
76073- if (copy_to_user(optval, &v, len))
76074+ if (len > sizeof(v) || copy_to_user(optval, &v, len))
76075 return -EFAULT;
76076 lenout:
76077 if (put_user(len, optlen))
76078@@ -2023,7 +2023,7 @@ void sock_init_data(struct socket *sock,
76079 */
76080 smp_wmb();
76081 atomic_set(&sk->sk_refcnt, 1);
76082- atomic_set(&sk->sk_drops, 0);
76083+ atomic_set_unchecked(&sk->sk_drops, 0);
76084 }
76085 EXPORT_SYMBOL(sock_init_data);
76086
76087diff -urNp linux-2.6.39.1/net/decnet/sysctl_net_decnet.c linux-2.6.39.1/net/decnet/sysctl_net_decnet.c
76088--- linux-2.6.39.1/net/decnet/sysctl_net_decnet.c 2011-05-19 00:06:34.000000000 -0400
76089+++ linux-2.6.39.1/net/decnet/sysctl_net_decnet.c 2011-05-22 19:36:34.000000000 -0400
76090@@ -173,7 +173,7 @@ static int dn_node_address_handler(ctl_t
76091
76092 if (len > *lenp) len = *lenp;
76093
76094- if (copy_to_user(buffer, addr, len))
76095+ if (len > sizeof addr || copy_to_user(buffer, addr, len))
76096 return -EFAULT;
76097
76098 *lenp = len;
76099@@ -236,7 +236,7 @@ static int dn_def_dev_handler(ctl_table
76100
76101 if (len > *lenp) len = *lenp;
76102
76103- if (copy_to_user(buffer, devname, len))
76104+ if (len > sizeof devname || copy_to_user(buffer, devname, len))
76105 return -EFAULT;
76106
76107 *lenp = len;
76108diff -urNp linux-2.6.39.1/net/econet/Kconfig linux-2.6.39.1/net/econet/Kconfig
76109--- linux-2.6.39.1/net/econet/Kconfig 2011-05-19 00:06:34.000000000 -0400
76110+++ linux-2.6.39.1/net/econet/Kconfig 2011-05-22 19:41:42.000000000 -0400
76111@@ -4,7 +4,7 @@
76112
76113 config ECONET
76114 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
76115- depends on EXPERIMENTAL && INET
76116+ depends on EXPERIMENTAL && INET && BROKEN
76117 ---help---
76118 Econet is a fairly old and slow networking protocol mainly used by
76119 Acorn computers to access file and print servers. It uses native
76120diff -urNp linux-2.6.39.1/net/ipv4/fib_frontend.c linux-2.6.39.1/net/ipv4/fib_frontend.c
76121--- linux-2.6.39.1/net/ipv4/fib_frontend.c 2011-05-19 00:06:34.000000000 -0400
76122+++ linux-2.6.39.1/net/ipv4/fib_frontend.c 2011-05-22 19:36:34.000000000 -0400
76123@@ -968,12 +968,12 @@ static int fib_inetaddr_event(struct not
76124 #ifdef CONFIG_IP_ROUTE_MULTIPATH
76125 fib_sync_up(dev);
76126 #endif
76127- atomic_inc(&net->ipv4.dev_addr_genid);
76128+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76129 rt_cache_flush(dev_net(dev), -1);
76130 break;
76131 case NETDEV_DOWN:
76132 fib_del_ifaddr(ifa, NULL);
76133- atomic_inc(&net->ipv4.dev_addr_genid);
76134+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76135 if (ifa->ifa_dev->ifa_list == NULL) {
76136 /* Last address was deleted from this interface.
76137 * Disable IP.
76138@@ -1009,7 +1009,7 @@ static int fib_netdev_event(struct notif
76139 #ifdef CONFIG_IP_ROUTE_MULTIPATH
76140 fib_sync_up(dev);
76141 #endif
76142- atomic_inc(&net->ipv4.dev_addr_genid);
76143+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76144 rt_cache_flush(dev_net(dev), -1);
76145 break;
76146 case NETDEV_DOWN:
76147diff -urNp linux-2.6.39.1/net/ipv4/fib_semantics.c linux-2.6.39.1/net/ipv4/fib_semantics.c
76148--- linux-2.6.39.1/net/ipv4/fib_semantics.c 2011-05-19 00:06:34.000000000 -0400
76149+++ linux-2.6.39.1/net/ipv4/fib_semantics.c 2011-05-22 19:36:34.000000000 -0400
76150@@ -701,7 +701,7 @@ __be32 fib_info_update_nh_saddr(struct n
76151 nh->nh_saddr = inet_select_addr(nh->nh_dev,
76152 nh->nh_gw,
76153 nh->nh_parent->fib_scope);
76154- nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid);
76155+ nh->nh_saddr_genid = atomic_read_unchecked(&net->ipv4.dev_addr_genid);
76156
76157 return nh->nh_saddr;
76158 }
76159diff -urNp linux-2.6.39.1/net/ipv4/inet_diag.c linux-2.6.39.1/net/ipv4/inet_diag.c
76160--- linux-2.6.39.1/net/ipv4/inet_diag.c 2011-05-19 00:06:34.000000000 -0400
76161+++ linux-2.6.39.1/net/ipv4/inet_diag.c 2011-05-22 19:41:42.000000000 -0400
76162@@ -114,8 +114,14 @@ static int inet_csk_diag_fill(struct soc
76163 r->idiag_retrans = 0;
76164
76165 r->id.idiag_if = sk->sk_bound_dev_if;
76166+
76167+#ifdef CONFIG_GRKERNSEC_HIDESYM
76168+ r->id.idiag_cookie[0] = 0;
76169+ r->id.idiag_cookie[1] = 0;
76170+#else
76171 r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
76172 r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
76173+#endif
76174
76175 r->id.idiag_sport = inet->inet_sport;
76176 r->id.idiag_dport = inet->inet_dport;
76177@@ -201,8 +207,15 @@ static int inet_twsk_diag_fill(struct in
76178 r->idiag_family = tw->tw_family;
76179 r->idiag_retrans = 0;
76180 r->id.idiag_if = tw->tw_bound_dev_if;
76181+
76182+#ifdef CONFIG_GRKERNSEC_HIDESYM
76183+ r->id.idiag_cookie[0] = 0;
76184+ r->id.idiag_cookie[1] = 0;
76185+#else
76186 r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
76187 r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
76188+#endif
76189+
76190 r->id.idiag_sport = tw->tw_sport;
76191 r->id.idiag_dport = tw->tw_dport;
76192 r->id.idiag_src[0] = tw->tw_rcv_saddr;
76193@@ -285,12 +298,14 @@ static int inet_diag_get_exact(struct sk
76194 if (sk == NULL)
76195 goto unlock;
76196
76197+#ifndef CONFIG_GRKERNSEC_HIDESYM
76198 err = -ESTALE;
76199 if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
76200 req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
76201 ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
76202 (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
76203 goto out;
76204+#endif
76205
76206 err = -ENOMEM;
76207 rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
76208@@ -582,8 +597,14 @@ static int inet_diag_fill_req(struct sk_
76209 r->idiag_retrans = req->retrans;
76210
76211 r->id.idiag_if = sk->sk_bound_dev_if;
76212+
76213+#ifdef CONFIG_GRKERNSEC_HIDESYM
76214+ r->id.idiag_cookie[0] = 0;
76215+ r->id.idiag_cookie[1] = 0;
76216+#else
76217 r->id.idiag_cookie[0] = (u32)(unsigned long)req;
76218 r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
76219+#endif
76220
76221 tmo = req->expires - jiffies;
76222 if (tmo < 0)
76223diff -urNp linux-2.6.39.1/net/ipv4/inet_hashtables.c linux-2.6.39.1/net/ipv4/inet_hashtables.c
76224--- linux-2.6.39.1/net/ipv4/inet_hashtables.c 2011-05-19 00:06:34.000000000 -0400
76225+++ linux-2.6.39.1/net/ipv4/inet_hashtables.c 2011-05-22 19:41:42.000000000 -0400
76226@@ -18,11 +18,14 @@
76227 #include <linux/sched.h>
76228 #include <linux/slab.h>
76229 #include <linux/wait.h>
76230+#include <linux/security.h>
76231
76232 #include <net/inet_connection_sock.h>
76233 #include <net/inet_hashtables.h>
76234 #include <net/ip.h>
76235
76236+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
76237+
76238 /*
76239 * Allocate and initialize a new local port bind bucket.
76240 * The bindhash mutex for snum's hash chain must be held here.
76241@@ -529,6 +532,8 @@ ok:
76242 twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
76243 spin_unlock(&head->lock);
76244
76245+ gr_update_task_in_ip_table(current, inet_sk(sk));
76246+
76247 if (tw) {
76248 inet_twsk_deschedule(tw, death_row);
76249 while (twrefcnt) {
76250diff -urNp linux-2.6.39.1/net/ipv4/inetpeer.c linux-2.6.39.1/net/ipv4/inetpeer.c
76251--- linux-2.6.39.1/net/ipv4/inetpeer.c 2011-05-19 00:06:34.000000000 -0400
76252+++ linux-2.6.39.1/net/ipv4/inetpeer.c 2011-05-22 19:36:34.000000000 -0400
76253@@ -467,6 +467,8 @@ struct inet_peer *inet_getpeer(struct in
76254 unsigned int sequence;
76255 int invalidated;
76256
76257+ pax_track_stack();
76258+
76259 /* Look up for the address quickly, lockless.
76260 * Because of a concurrent writer, we might not find an existing entry.
76261 */
76262@@ -504,8 +506,8 @@ struct inet_peer *inet_getpeer(struct in
76263 if (p) {
76264 p->daddr = *daddr;
76265 atomic_set(&p->refcnt, 1);
76266- atomic_set(&p->rid, 0);
76267- atomic_set(&p->ip_id_count, secure_ip_id(daddr->addr.a4));
76268+ atomic_set_unchecked(&p->rid, 0);
76269+ atomic_set_unchecked(&p->ip_id_count, secure_ip_id(daddr->addr.a4));
76270 p->tcp_ts_stamp = 0;
76271 p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
76272 p->rate_tokens = 0;
76273diff -urNp linux-2.6.39.1/net/ipv4/ip_fragment.c linux-2.6.39.1/net/ipv4/ip_fragment.c
76274--- linux-2.6.39.1/net/ipv4/ip_fragment.c 2011-05-19 00:06:34.000000000 -0400
76275+++ linux-2.6.39.1/net/ipv4/ip_fragment.c 2011-05-22 19:36:34.000000000 -0400
76276@@ -297,7 +297,7 @@ static inline int ip_frag_too_far(struct
76277 return 0;
76278
76279 start = qp->rid;
76280- end = atomic_inc_return(&peer->rid);
76281+ end = atomic_inc_return_unchecked(&peer->rid);
76282 qp->rid = end;
76283
76284 rc = qp->q.fragments && (end - start) > max;
76285diff -urNp linux-2.6.39.1/net/ipv4/ip_sockglue.c linux-2.6.39.1/net/ipv4/ip_sockglue.c
76286--- linux-2.6.39.1/net/ipv4/ip_sockglue.c 2011-05-19 00:06:34.000000000 -0400
76287+++ linux-2.6.39.1/net/ipv4/ip_sockglue.c 2011-05-22 19:36:34.000000000 -0400
76288@@ -1064,6 +1064,8 @@ static int do_ip_getsockopt(struct sock
76289 int val;
76290 int len;
76291
76292+ pax_track_stack();
76293+
76294 if (level != SOL_IP)
76295 return -EOPNOTSUPP;
76296
76297diff -urNp linux-2.6.39.1/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.39.1/net/ipv4/netfilter/nf_nat_snmp_basic.c
76298--- linux-2.6.39.1/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-05-19 00:06:34.000000000 -0400
76299+++ linux-2.6.39.1/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-05-22 19:36:34.000000000 -0400
76300@@ -399,7 +399,7 @@ static unsigned char asn1_octets_decode(
76301
76302 *len = 0;
76303
76304- *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
76305+ *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
76306 if (*octets == NULL) {
76307 if (net_ratelimit())
76308 pr_notice("OOM in bsalg (%d)\n", __LINE__);
76309diff -urNp linux-2.6.39.1/net/ipv4/raw.c linux-2.6.39.1/net/ipv4/raw.c
76310--- linux-2.6.39.1/net/ipv4/raw.c 2011-05-19 00:06:34.000000000 -0400
76311+++ linux-2.6.39.1/net/ipv4/raw.c 2011-05-22 19:41:42.000000000 -0400
76312@@ -302,7 +302,7 @@ static int raw_rcv_skb(struct sock * sk,
76313 int raw_rcv(struct sock *sk, struct sk_buff *skb)
76314 {
76315 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
76316- atomic_inc(&sk->sk_drops);
76317+ atomic_inc_unchecked(&sk->sk_drops);
76318 kfree_skb(skb);
76319 return NET_RX_DROP;
76320 }
76321@@ -730,15 +730,19 @@ static int raw_init(struct sock *sk)
76322
76323 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
76324 {
76325+ struct icmp_filter filter;
76326+
76327 if (optlen > sizeof(struct icmp_filter))
76328 optlen = sizeof(struct icmp_filter);
76329- if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
76330+ if (copy_from_user(&filter, optval, optlen))
76331 return -EFAULT;
76332+ memcpy(&raw_sk(sk)->filter, &filter, sizeof(filter));
76333 return 0;
76334 }
76335
76336 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
76337 {
76338+ struct icmp_filter filter;
76339 int len, ret = -EFAULT;
76340
76341 if (get_user(len, optlen))
76342@@ -749,8 +753,9 @@ static int raw_geticmpfilter(struct sock
76343 if (len > sizeof(struct icmp_filter))
76344 len = sizeof(struct icmp_filter);
76345 ret = -EFAULT;
76346+ memcpy(&filter, &raw_sk(sk)->filter, len);
76347 if (put_user(len, optlen) ||
76348- copy_to_user(optval, &raw_sk(sk)->filter, len))
76349+ copy_to_user(optval, &filter, len))
76350 goto out;
76351 ret = 0;
76352 out: return ret;
76353@@ -978,7 +983,13 @@ static void raw_sock_seq_show(struct seq
76354 sk_wmem_alloc_get(sp),
76355 sk_rmem_alloc_get(sp),
76356 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76357- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
76358+ atomic_read(&sp->sk_refcnt),
76359+#ifdef CONFIG_GRKERNSEC_HIDESYM
76360+ NULL,
76361+#else
76362+ sp,
76363+#endif
76364+ atomic_read_unchecked(&sp->sk_drops));
76365 }
76366
76367 static int raw_seq_show(struct seq_file *seq, void *v)
76368diff -urNp linux-2.6.39.1/net/ipv4/route.c linux-2.6.39.1/net/ipv4/route.c
76369--- linux-2.6.39.1/net/ipv4/route.c 2011-05-19 00:06:34.000000000 -0400
76370+++ linux-2.6.39.1/net/ipv4/route.c 2011-05-22 19:36:34.000000000 -0400
76371@@ -303,7 +303,7 @@ static inline unsigned int rt_hash(__be3
76372
76373 static inline int rt_genid(struct net *net)
76374 {
76375- return atomic_read(&net->ipv4.rt_genid);
76376+ return atomic_read_unchecked(&net->ipv4.rt_genid);
76377 }
76378
76379 #ifdef CONFIG_PROC_FS
76380@@ -831,7 +831,7 @@ static void rt_cache_invalidate(struct n
76381 unsigned char shuffle;
76382
76383 get_random_bytes(&shuffle, sizeof(shuffle));
76384- atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
76385+ atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
76386 }
76387
76388 /*
76389@@ -2835,7 +2835,7 @@ static int rt_fill_info(struct net *net,
76390 rt->peer->pmtu_expires - jiffies : 0;
76391 if (rt->peer) {
76392 inet_peer_refcheck(rt->peer);
76393- id = atomic_read(&rt->peer->ip_id_count) & 0xffff;
76394+ id = atomic_read_unchecked(&rt->peer->ip_id_count) & 0xffff;
76395 if (rt->peer->tcp_ts_stamp) {
76396 ts = rt->peer->tcp_ts;
76397 tsage = get_seconds() - rt->peer->tcp_ts_stamp;
76398diff -urNp linux-2.6.39.1/net/ipv4/tcp.c linux-2.6.39.1/net/ipv4/tcp.c
76399--- linux-2.6.39.1/net/ipv4/tcp.c 2011-05-19 00:06:34.000000000 -0400
76400+++ linux-2.6.39.1/net/ipv4/tcp.c 2011-05-22 19:36:34.000000000 -0400
76401@@ -2121,6 +2121,8 @@ static int do_tcp_setsockopt(struct sock
76402 int val;
76403 int err = 0;
76404
76405+ pax_track_stack();
76406+
76407 /* These are data/string values, all the others are ints */
76408 switch (optname) {
76409 case TCP_CONGESTION: {
76410@@ -2500,6 +2502,8 @@ static int do_tcp_getsockopt(struct sock
76411 struct tcp_sock *tp = tcp_sk(sk);
76412 int val, len;
76413
76414+ pax_track_stack();
76415+
76416 if (get_user(len, optlen))
76417 return -EFAULT;
76418
76419diff -urNp linux-2.6.39.1/net/ipv4/tcp_ipv4.c linux-2.6.39.1/net/ipv4/tcp_ipv4.c
76420--- linux-2.6.39.1/net/ipv4/tcp_ipv4.c 2011-05-19 00:06:34.000000000 -0400
76421+++ linux-2.6.39.1/net/ipv4/tcp_ipv4.c 2011-05-22 19:41:42.000000000 -0400
76422@@ -86,6 +86,9 @@ int sysctl_tcp_tw_reuse __read_mostly;
76423 int sysctl_tcp_low_latency __read_mostly;
76424 EXPORT_SYMBOL(sysctl_tcp_low_latency);
76425
76426+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76427+extern int grsec_enable_blackhole;
76428+#endif
76429
76430 #ifdef CONFIG_TCP_MD5SIG
76431 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
76432@@ -1594,6 +1597,9 @@ int tcp_v4_do_rcv(struct sock *sk, struc
76433 return 0;
76434
76435 reset:
76436+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76437+ if (!grsec_enable_blackhole)
76438+#endif
76439 tcp_v4_send_reset(rsk, skb);
76440 discard:
76441 kfree_skb(skb);
76442@@ -1656,12 +1662,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
76443 TCP_SKB_CB(skb)->sacked = 0;
76444
76445 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
76446- if (!sk)
76447+ if (!sk) {
76448+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76449+ ret = 1;
76450+#endif
76451 goto no_tcp_socket;
76452-
76453+ }
76454 process:
76455- if (sk->sk_state == TCP_TIME_WAIT)
76456+ if (sk->sk_state == TCP_TIME_WAIT) {
76457+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76458+ ret = 2;
76459+#endif
76460 goto do_time_wait;
76461+ }
76462
76463 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
76464 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
76465@@ -1711,6 +1724,10 @@ no_tcp_socket:
76466 bad_packet:
76467 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
76468 } else {
76469+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76470+ if (!grsec_enable_blackhole || (ret == 1 &&
76471+ (skb->dev->flags & IFF_LOOPBACK)))
76472+#endif
76473 tcp_v4_send_reset(NULL, skb);
76474 }
76475
76476@@ -2374,7 +2391,11 @@ static void get_openreq4(struct sock *sk
76477 0, /* non standard timer */
76478 0, /* open_requests have no inode */
76479 atomic_read(&sk->sk_refcnt),
76480+#ifdef CONFIG_GRKERNSEC_HIDESYM
76481+ NULL,
76482+#else
76483 req,
76484+#endif
76485 len);
76486 }
76487
76488@@ -2424,7 +2445,12 @@ static void get_tcp4_sock(struct sock *s
76489 sock_i_uid(sk),
76490 icsk->icsk_probes_out,
76491 sock_i_ino(sk),
76492- atomic_read(&sk->sk_refcnt), sk,
76493+ atomic_read(&sk->sk_refcnt),
76494+#ifdef CONFIG_GRKERNSEC_HIDESYM
76495+ NULL,
76496+#else
76497+ sk,
76498+#endif
76499 jiffies_to_clock_t(icsk->icsk_rto),
76500 jiffies_to_clock_t(icsk->icsk_ack.ato),
76501 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
76502@@ -2452,7 +2478,13 @@ static void get_timewait4_sock(struct in
76503 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p%n",
76504 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
76505 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
76506- atomic_read(&tw->tw_refcnt), tw, len);
76507+ atomic_read(&tw->tw_refcnt),
76508+#ifdef CONFIG_GRKERNSEC_HIDESYM
76509+ NULL,
76510+#else
76511+ tw,
76512+#endif
76513+ len);
76514 }
76515
76516 #define TMPSZ 150
76517diff -urNp linux-2.6.39.1/net/ipv4/tcp_minisocks.c linux-2.6.39.1/net/ipv4/tcp_minisocks.c
76518--- linux-2.6.39.1/net/ipv4/tcp_minisocks.c 2011-05-19 00:06:34.000000000 -0400
76519+++ linux-2.6.39.1/net/ipv4/tcp_minisocks.c 2011-05-22 19:41:42.000000000 -0400
76520@@ -27,6 +27,10 @@
76521 #include <net/inet_common.h>
76522 #include <net/xfrm.h>
76523
76524+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76525+extern int grsec_enable_blackhole;
76526+#endif
76527+
76528 int sysctl_tcp_syncookies __read_mostly = 1;
76529 EXPORT_SYMBOL(sysctl_tcp_syncookies);
76530
76531@@ -745,6 +749,10 @@ listen_overflow:
76532
76533 embryonic_reset:
76534 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
76535+
76536+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76537+ if (!grsec_enable_blackhole)
76538+#endif
76539 if (!(flg & TCP_FLAG_RST))
76540 req->rsk_ops->send_reset(sk, skb);
76541
76542diff -urNp linux-2.6.39.1/net/ipv4/tcp_output.c linux-2.6.39.1/net/ipv4/tcp_output.c
76543--- linux-2.6.39.1/net/ipv4/tcp_output.c 2011-05-19 00:06:34.000000000 -0400
76544+++ linux-2.6.39.1/net/ipv4/tcp_output.c 2011-05-22 19:36:34.000000000 -0400
76545@@ -2421,6 +2421,8 @@ struct sk_buff *tcp_make_synack(struct s
76546 int mss;
76547 int s_data_desired = 0;
76548
76549+ pax_track_stack();
76550+
76551 if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
76552 s_data_desired = cvp->s_data_desired;
76553 skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
76554diff -urNp linux-2.6.39.1/net/ipv4/tcp_probe.c linux-2.6.39.1/net/ipv4/tcp_probe.c
76555--- linux-2.6.39.1/net/ipv4/tcp_probe.c 2011-05-19 00:06:34.000000000 -0400
76556+++ linux-2.6.39.1/net/ipv4/tcp_probe.c 2011-05-22 19:36:34.000000000 -0400
76557@@ -202,7 +202,7 @@ static ssize_t tcpprobe_read(struct file
76558 if (cnt + width >= len)
76559 break;
76560
76561- if (copy_to_user(buf + cnt, tbuf, width))
76562+ if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
76563 return -EFAULT;
76564 cnt += width;
76565 }
76566diff -urNp linux-2.6.39.1/net/ipv4/tcp_timer.c linux-2.6.39.1/net/ipv4/tcp_timer.c
76567--- linux-2.6.39.1/net/ipv4/tcp_timer.c 2011-05-19 00:06:34.000000000 -0400
76568+++ linux-2.6.39.1/net/ipv4/tcp_timer.c 2011-05-22 19:41:42.000000000 -0400
76569@@ -22,6 +22,10 @@
76570 #include <linux/gfp.h>
76571 #include <net/tcp.h>
76572
76573+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76574+extern int grsec_lastack_retries;
76575+#endif
76576+
76577 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
76578 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
76579 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
76580@@ -199,6 +203,13 @@ static int tcp_write_timeout(struct sock
76581 }
76582 }
76583
76584+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76585+ if ((sk->sk_state == TCP_LAST_ACK) &&
76586+ (grsec_lastack_retries > 0) &&
76587+ (grsec_lastack_retries < retry_until))
76588+ retry_until = grsec_lastack_retries;
76589+#endif
76590+
76591 if (retransmits_timed_out(sk, retry_until,
76592 syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
76593 /* Has it gone just too far? */
76594diff -urNp linux-2.6.39.1/net/ipv4/udp.c linux-2.6.39.1/net/ipv4/udp.c
76595--- linux-2.6.39.1/net/ipv4/udp.c 2011-05-19 00:06:34.000000000 -0400
76596+++ linux-2.6.39.1/net/ipv4/udp.c 2011-05-22 19:41:42.000000000 -0400
76597@@ -86,6 +86,7 @@
76598 #include <linux/types.h>
76599 #include <linux/fcntl.h>
76600 #include <linux/module.h>
76601+#include <linux/security.h>
76602 #include <linux/socket.h>
76603 #include <linux/sockios.h>
76604 #include <linux/igmp.h>
76605@@ -107,6 +108,10 @@
76606 #include <net/xfrm.h>
76607 #include "udp_impl.h"
76608
76609+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76610+extern int grsec_enable_blackhole;
76611+#endif
76612+
76613 struct udp_table udp_table __read_mostly;
76614 EXPORT_SYMBOL(udp_table);
76615
76616@@ -564,6 +569,9 @@ found:
76617 return s;
76618 }
76619
76620+extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
76621+extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
76622+
76623 /*
76624 * This routine is called by the ICMP module when it gets some
76625 * sort of error condition. If err < 0 then the socket should
76626@@ -853,9 +861,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
76627 dport = usin->sin_port;
76628 if (dport == 0)
76629 return -EINVAL;
76630+
76631+ err = gr_search_udp_sendmsg(sk, usin);
76632+ if (err)
76633+ return err;
76634 } else {
76635 if (sk->sk_state != TCP_ESTABLISHED)
76636 return -EDESTADDRREQ;
76637+
76638+ err = gr_search_udp_sendmsg(sk, NULL);
76639+ if (err)
76640+ return err;
76641+
76642 daddr = inet->inet_daddr;
76643 dport = inet->inet_dport;
76644 /* Open fast path for connected socket.
76645@@ -1090,7 +1107,7 @@ static unsigned int first_packet_length(
76646 udp_lib_checksum_complete(skb)) {
76647 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
76648 IS_UDPLITE(sk));
76649- atomic_inc(&sk->sk_drops);
76650+ atomic_inc_unchecked(&sk->sk_drops);
76651 __skb_unlink(skb, rcvq);
76652 __skb_queue_tail(&list_kill, skb);
76653 }
76654@@ -1176,6 +1193,10 @@ try_again:
76655 if (!skb)
76656 goto out;
76657
76658+ err = gr_search_udp_recvmsg(sk, skb);
76659+ if (err)
76660+ goto out_free;
76661+
76662 ulen = skb->len - sizeof(struct udphdr);
76663 if (len > ulen)
76664 len = ulen;
76665@@ -1472,7 +1493,7 @@ int udp_queue_rcv_skb(struct sock *sk, s
76666
76667 drop:
76668 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
76669- atomic_inc(&sk->sk_drops);
76670+ atomic_inc_unchecked(&sk->sk_drops);
76671 kfree_skb(skb);
76672 return -1;
76673 }
76674@@ -1491,7 +1512,7 @@ static void flush_stack(struct sock **st
76675 skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
76676
76677 if (!skb1) {
76678- atomic_inc(&sk->sk_drops);
76679+ atomic_inc_unchecked(&sk->sk_drops);
76680 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
76681 IS_UDPLITE(sk));
76682 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
76683@@ -1660,6 +1681,9 @@ int __udp4_lib_rcv(struct sk_buff *skb,
76684 goto csum_error;
76685
76686 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
76687+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76688+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
76689+#endif
76690 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
76691
76692 /*
76693@@ -2087,8 +2111,13 @@ static void udp4_format_sock(struct sock
76694 sk_wmem_alloc_get(sp),
76695 sk_rmem_alloc_get(sp),
76696 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76697- atomic_read(&sp->sk_refcnt), sp,
76698- atomic_read(&sp->sk_drops), len);
76699+ atomic_read(&sp->sk_refcnt),
76700+#ifdef CONFIG_GRKERNSEC_HIDESYM
76701+ NULL,
76702+#else
76703+ sp,
76704+#endif
76705+ atomic_read_unchecked(&sp->sk_drops), len);
76706 }
76707
76708 int udp4_seq_show(struct seq_file *seq, void *v)
76709diff -urNp linux-2.6.39.1/net/ipv6/inet6_connection_sock.c linux-2.6.39.1/net/ipv6/inet6_connection_sock.c
76710--- linux-2.6.39.1/net/ipv6/inet6_connection_sock.c 2011-05-19 00:06:34.000000000 -0400
76711+++ linux-2.6.39.1/net/ipv6/inet6_connection_sock.c 2011-05-22 19:36:34.000000000 -0400
76712@@ -178,7 +178,7 @@ void __inet6_csk_dst_store(struct sock *
76713 #ifdef CONFIG_XFRM
76714 {
76715 struct rt6_info *rt = (struct rt6_info *)dst;
76716- rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
76717+ rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
76718 }
76719 #endif
76720 }
76721@@ -193,7 +193,7 @@ struct dst_entry *__inet6_csk_dst_check(
76722 #ifdef CONFIG_XFRM
76723 if (dst) {
76724 struct rt6_info *rt = (struct rt6_info *)dst;
76725- if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
76726+ if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
76727 __sk_dst_reset(sk);
76728 dst = NULL;
76729 }
76730diff -urNp linux-2.6.39.1/net/ipv6/ipv6_sockglue.c linux-2.6.39.1/net/ipv6/ipv6_sockglue.c
76731--- linux-2.6.39.1/net/ipv6/ipv6_sockglue.c 2011-05-19 00:06:34.000000000 -0400
76732+++ linux-2.6.39.1/net/ipv6/ipv6_sockglue.c 2011-05-22 19:36:34.000000000 -0400
76733@@ -129,6 +129,8 @@ static int do_ipv6_setsockopt(struct soc
76734 int val, valbool;
76735 int retv = -ENOPROTOOPT;
76736
76737+ pax_track_stack();
76738+
76739 if (optval == NULL)
76740 val=0;
76741 else {
76742@@ -919,6 +921,8 @@ static int do_ipv6_getsockopt(struct soc
76743 int len;
76744 int val;
76745
76746+ pax_track_stack();
76747+
76748 if (ip6_mroute_opt(optname))
76749 return ip6_mroute_getsockopt(sk, optname, optval, optlen);
76750
76751diff -urNp linux-2.6.39.1/net/ipv6/raw.c linux-2.6.39.1/net/ipv6/raw.c
76752--- linux-2.6.39.1/net/ipv6/raw.c 2011-05-19 00:06:34.000000000 -0400
76753+++ linux-2.6.39.1/net/ipv6/raw.c 2011-05-22 19:41:42.000000000 -0400
76754@@ -376,7 +376,7 @@ static inline int rawv6_rcv_skb(struct s
76755 {
76756 if ((raw6_sk(sk)->checksum || rcu_dereference_raw(sk->sk_filter)) &&
76757 skb_checksum_complete(skb)) {
76758- atomic_inc(&sk->sk_drops);
76759+ atomic_inc_unchecked(&sk->sk_drops);
76760 kfree_skb(skb);
76761 return NET_RX_DROP;
76762 }
76763@@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk
76764 struct raw6_sock *rp = raw6_sk(sk);
76765
76766 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
76767- atomic_inc(&sk->sk_drops);
76768+ atomic_inc_unchecked(&sk->sk_drops);
76769 kfree_skb(skb);
76770 return NET_RX_DROP;
76771 }
76772@@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk
76773
76774 if (inet->hdrincl) {
76775 if (skb_checksum_complete(skb)) {
76776- atomic_inc(&sk->sk_drops);
76777+ atomic_inc_unchecked(&sk->sk_drops);
76778 kfree_skb(skb);
76779 return NET_RX_DROP;
76780 }
76781@@ -601,7 +601,7 @@ out:
76782 return err;
76783 }
76784
76785-static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
76786+static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
76787 struct flowi6 *fl6, struct dst_entry **dstp,
76788 unsigned int flags)
76789 {
76790@@ -742,6 +742,8 @@ static int rawv6_sendmsg(struct kiocb *i
76791 u16 proto;
76792 int err;
76793
76794+ pax_track_stack();
76795+
76796 /* Rough check on arithmetic overflow,
76797 better check is made in ip6_append_data().
76798 */
76799@@ -909,12 +911,15 @@ do_confirm:
76800 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
76801 char __user *optval, int optlen)
76802 {
76803+ struct icmp6_filter filter;
76804+
76805 switch (optname) {
76806 case ICMPV6_FILTER:
76807 if (optlen > sizeof(struct icmp6_filter))
76808 optlen = sizeof(struct icmp6_filter);
76809- if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
76810+ if (copy_from_user(&filter, optval, optlen))
76811 return -EFAULT;
76812+ memcpy(&raw6_sk(sk)->filter, &filter, optlen);
76813 return 0;
76814 default:
76815 return -ENOPROTOOPT;
76816@@ -926,6 +931,7 @@ static int rawv6_seticmpfilter(struct so
76817 static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
76818 char __user *optval, int __user *optlen)
76819 {
76820+ struct icmp6_filter filter;
76821 int len;
76822
76823 switch (optname) {
76824@@ -938,7 +944,8 @@ static int rawv6_geticmpfilter(struct so
76825 len = sizeof(struct icmp6_filter);
76826 if (put_user(len, optlen))
76827 return -EFAULT;
76828- if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
76829+ memcpy(&filter, &raw6_sk(sk)->filter, len);
76830+ if (copy_to_user(optval, &filter, len))
76831 return -EFAULT;
76832 return 0;
76833 default:
76834@@ -1252,7 +1259,13 @@ static void raw6_sock_seq_show(struct se
76835 0, 0L, 0,
76836 sock_i_uid(sp), 0,
76837 sock_i_ino(sp),
76838- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
76839+ atomic_read(&sp->sk_refcnt),
76840+#ifdef CONFIG_GRKERNSEC_HIDESYM
76841+ NULL,
76842+#else
76843+ sp,
76844+#endif
76845+ atomic_read_unchecked(&sp->sk_drops));
76846 }
76847
76848 static int raw6_seq_show(struct seq_file *seq, void *v)
76849diff -urNp linux-2.6.39.1/net/ipv6/tcp_ipv6.c linux-2.6.39.1/net/ipv6/tcp_ipv6.c
76850--- linux-2.6.39.1/net/ipv6/tcp_ipv6.c 2011-05-19 00:06:34.000000000 -0400
76851+++ linux-2.6.39.1/net/ipv6/tcp_ipv6.c 2011-05-22 19:41:42.000000000 -0400
76852@@ -92,6 +92,10 @@ static struct tcp_md5sig_key *tcp_v6_md5
76853 }
76854 #endif
76855
76856+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76857+extern int grsec_enable_blackhole;
76858+#endif
76859+
76860 static void tcp_v6_hash(struct sock *sk)
76861 {
76862 if (sk->sk_state != TCP_CLOSE) {
76863@@ -1660,6 +1664,9 @@ static int tcp_v6_do_rcv(struct sock *sk
76864 return 0;
76865
76866 reset:
76867+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76868+ if (!grsec_enable_blackhole)
76869+#endif
76870 tcp_v6_send_reset(sk, skb);
76871 discard:
76872 if (opt_skb)
76873@@ -1739,12 +1746,20 @@ static int tcp_v6_rcv(struct sk_buff *sk
76874 TCP_SKB_CB(skb)->sacked = 0;
76875
76876 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
76877- if (!sk)
76878+ if (!sk) {
76879+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76880+ ret = 1;
76881+#endif
76882 goto no_tcp_socket;
76883+ }
76884
76885 process:
76886- if (sk->sk_state == TCP_TIME_WAIT)
76887+ if (sk->sk_state == TCP_TIME_WAIT) {
76888+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76889+ ret = 2;
76890+#endif
76891 goto do_time_wait;
76892+ }
76893
76894 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
76895 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
76896@@ -1792,6 +1807,10 @@ no_tcp_socket:
76897 bad_packet:
76898 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
76899 } else {
76900+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76901+ if (!grsec_enable_blackhole || (ret == 1 &&
76902+ (skb->dev->flags & IFF_LOOPBACK)))
76903+#endif
76904 tcp_v6_send_reset(NULL, skb);
76905 }
76906
76907@@ -2052,7 +2071,13 @@ static void get_openreq6(struct seq_file
76908 uid,
76909 0, /* non standard timer */
76910 0, /* open_requests have no inode */
76911- 0, req);
76912+ 0,
76913+#ifdef CONFIG_GRKERNSEC_HIDESYM
76914+ NULL
76915+#else
76916+ req
76917+#endif
76918+ );
76919 }
76920
76921 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
76922@@ -2102,7 +2127,12 @@ static void get_tcp6_sock(struct seq_fil
76923 sock_i_uid(sp),
76924 icsk->icsk_probes_out,
76925 sock_i_ino(sp),
76926- atomic_read(&sp->sk_refcnt), sp,
76927+ atomic_read(&sp->sk_refcnt),
76928+#ifdef CONFIG_GRKERNSEC_HIDESYM
76929+ NULL,
76930+#else
76931+ sp,
76932+#endif
76933 jiffies_to_clock_t(icsk->icsk_rto),
76934 jiffies_to_clock_t(icsk->icsk_ack.ato),
76935 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
76936@@ -2137,7 +2167,13 @@ static void get_timewait6_sock(struct se
76937 dest->s6_addr32[2], dest->s6_addr32[3], destp,
76938 tw->tw_substate, 0, 0,
76939 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
76940- atomic_read(&tw->tw_refcnt), tw);
76941+ atomic_read(&tw->tw_refcnt),
76942+#ifdef CONFIG_GRKERNSEC_HIDESYM
76943+ NULL
76944+#else
76945+ tw
76946+#endif
76947+ );
76948 }
76949
76950 static int tcp6_seq_show(struct seq_file *seq, void *v)
76951diff -urNp linux-2.6.39.1/net/ipv6/udp.c linux-2.6.39.1/net/ipv6/udp.c
76952--- linux-2.6.39.1/net/ipv6/udp.c 2011-05-19 00:06:34.000000000 -0400
76953+++ linux-2.6.39.1/net/ipv6/udp.c 2011-05-22 19:41:42.000000000 -0400
76954@@ -50,6 +50,10 @@
76955 #include <linux/seq_file.h>
76956 #include "udp_impl.h"
76957
76958+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76959+extern int grsec_enable_blackhole;
76960+#endif
76961+
76962 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
76963 {
76964 const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
76965@@ -545,7 +549,7 @@ int udpv6_queue_rcv_skb(struct sock * sk
76966
76967 return 0;
76968 drop:
76969- atomic_inc(&sk->sk_drops);
76970+ atomic_inc_unchecked(&sk->sk_drops);
76971 drop_no_sk_drops_inc:
76972 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
76973 kfree_skb(skb);
76974@@ -621,7 +625,7 @@ static void flush_stack(struct sock **st
76975 continue;
76976 }
76977 drop:
76978- atomic_inc(&sk->sk_drops);
76979+ atomic_inc_unchecked(&sk->sk_drops);
76980 UDP6_INC_STATS_BH(sock_net(sk),
76981 UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
76982 UDP6_INC_STATS_BH(sock_net(sk),
76983@@ -776,6 +780,9 @@ int __udp6_lib_rcv(struct sk_buff *skb,
76984 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
76985 proto == IPPROTO_UDPLITE);
76986
76987+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76988+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
76989+#endif
76990 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
76991
76992 kfree_skb(skb);
76993@@ -792,7 +799,7 @@ int __udp6_lib_rcv(struct sk_buff *skb,
76994 if (!sock_owned_by_user(sk))
76995 udpv6_queue_rcv_skb(sk, skb);
76996 else if (sk_add_backlog(sk, skb)) {
76997- atomic_inc(&sk->sk_drops);
76998+ atomic_inc_unchecked(&sk->sk_drops);
76999 bh_unlock_sock(sk);
77000 sock_put(sk);
77001 goto discard;
77002@@ -1403,8 +1410,13 @@ static void udp6_sock_seq_show(struct se
77003 0, 0L, 0,
77004 sock_i_uid(sp), 0,
77005 sock_i_ino(sp),
77006- atomic_read(&sp->sk_refcnt), sp,
77007- atomic_read(&sp->sk_drops));
77008+ atomic_read(&sp->sk_refcnt),
77009+#ifdef CONFIG_GRKERNSEC_HIDESYM
77010+ NULL,
77011+#else
77012+ sp,
77013+#endif
77014+ atomic_read_unchecked(&sp->sk_drops));
77015 }
77016
77017 int udp6_seq_show(struct seq_file *seq, void *v)
77018diff -urNp linux-2.6.39.1/net/irda/ircomm/ircomm_tty.c linux-2.6.39.1/net/irda/ircomm/ircomm_tty.c
77019--- linux-2.6.39.1/net/irda/ircomm/ircomm_tty.c 2011-05-19 00:06:34.000000000 -0400
77020+++ linux-2.6.39.1/net/irda/ircomm/ircomm_tty.c 2011-05-22 19:36:34.000000000 -0400
77021@@ -281,16 +281,16 @@ static int ircomm_tty_block_til_ready(st
77022 add_wait_queue(&self->open_wait, &wait);
77023
77024 IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
77025- __FILE__,__LINE__, tty->driver->name, self->open_count );
77026+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
77027
77028 /* As far as I can see, we protect open_count - Jean II */
77029 spin_lock_irqsave(&self->spinlock, flags);
77030 if (!tty_hung_up_p(filp)) {
77031 extra_count = 1;
77032- self->open_count--;
77033+ local_dec(&self->open_count);
77034 }
77035 spin_unlock_irqrestore(&self->spinlock, flags);
77036- self->blocked_open++;
77037+ local_inc(&self->blocked_open);
77038
77039 while (1) {
77040 if (tty->termios->c_cflag & CBAUD) {
77041@@ -330,7 +330,7 @@ static int ircomm_tty_block_til_ready(st
77042 }
77043
77044 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
77045- __FILE__,__LINE__, tty->driver->name, self->open_count );
77046+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
77047
77048 schedule();
77049 }
77050@@ -341,13 +341,13 @@ static int ircomm_tty_block_til_ready(st
77051 if (extra_count) {
77052 /* ++ is not atomic, so this should be protected - Jean II */
77053 spin_lock_irqsave(&self->spinlock, flags);
77054- self->open_count++;
77055+ local_inc(&self->open_count);
77056 spin_unlock_irqrestore(&self->spinlock, flags);
77057 }
77058- self->blocked_open--;
77059+ local_dec(&self->blocked_open);
77060
77061 IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
77062- __FILE__,__LINE__, tty->driver->name, self->open_count);
77063+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
77064
77065 if (!retval)
77066 self->flags |= ASYNC_NORMAL_ACTIVE;
77067@@ -416,14 +416,14 @@ static int ircomm_tty_open(struct tty_st
77068 }
77069 /* ++ is not atomic, so this should be protected - Jean II */
77070 spin_lock_irqsave(&self->spinlock, flags);
77071- self->open_count++;
77072+ local_inc(&self->open_count);
77073
77074 tty->driver_data = self;
77075 self->tty = tty;
77076 spin_unlock_irqrestore(&self->spinlock, flags);
77077
77078 IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
77079- self->line, self->open_count);
77080+ self->line, local_read(&self->open_count));
77081
77082 /* Not really used by us, but lets do it anyway */
77083 self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
77084@@ -509,7 +509,7 @@ static void ircomm_tty_close(struct tty_
77085 return;
77086 }
77087
77088- if ((tty->count == 1) && (self->open_count != 1)) {
77089+ if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
77090 /*
77091 * Uh, oh. tty->count is 1, which means that the tty
77092 * structure will be freed. state->count should always
77093@@ -519,16 +519,16 @@ static void ircomm_tty_close(struct tty_
77094 */
77095 IRDA_DEBUG(0, "%s(), bad serial port count; "
77096 "tty->count is 1, state->count is %d\n", __func__ ,
77097- self->open_count);
77098- self->open_count = 1;
77099+ local_read(&self->open_count));
77100+ local_set(&self->open_count, 1);
77101 }
77102
77103- if (--self->open_count < 0) {
77104+ if (local_dec_return(&self->open_count) < 0) {
77105 IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
77106- __func__, self->line, self->open_count);
77107- self->open_count = 0;
77108+ __func__, self->line, local_read(&self->open_count));
77109+ local_set(&self->open_count, 0);
77110 }
77111- if (self->open_count) {
77112+ if (local_read(&self->open_count)) {
77113 spin_unlock_irqrestore(&self->spinlock, flags);
77114
77115 IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
77116@@ -560,7 +560,7 @@ static void ircomm_tty_close(struct tty_
77117 tty->closing = 0;
77118 self->tty = NULL;
77119
77120- if (self->blocked_open) {
77121+ if (local_read(&self->blocked_open)) {
77122 if (self->close_delay)
77123 schedule_timeout_interruptible(self->close_delay);
77124 wake_up_interruptible(&self->open_wait);
77125@@ -1012,7 +1012,7 @@ static void ircomm_tty_hangup(struct tty
77126 spin_lock_irqsave(&self->spinlock, flags);
77127 self->flags &= ~ASYNC_NORMAL_ACTIVE;
77128 self->tty = NULL;
77129- self->open_count = 0;
77130+ local_set(&self->open_count, 0);
77131 spin_unlock_irqrestore(&self->spinlock, flags);
77132
77133 wake_up_interruptible(&self->open_wait);
77134@@ -1364,7 +1364,7 @@ static void ircomm_tty_line_info(struct
77135 seq_putc(m, '\n');
77136
77137 seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
77138- seq_printf(m, "Open count: %d\n", self->open_count);
77139+ seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
77140 seq_printf(m, "Max data size: %d\n", self->max_data_size);
77141 seq_printf(m, "Max header size: %d\n", self->max_header_size);
77142
77143diff -urNp linux-2.6.39.1/net/iucv/af_iucv.c linux-2.6.39.1/net/iucv/af_iucv.c
77144--- linux-2.6.39.1/net/iucv/af_iucv.c 2011-05-19 00:06:34.000000000 -0400
77145+++ linux-2.6.39.1/net/iucv/af_iucv.c 2011-05-22 19:36:34.000000000 -0400
77146@@ -653,10 +653,10 @@ static int iucv_sock_autobind(struct soc
77147
77148 write_lock_bh(&iucv_sk_list.lock);
77149
77150- sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
77151+ sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
77152 while (__iucv_get_sock_by_name(name)) {
77153 sprintf(name, "%08x",
77154- atomic_inc_return(&iucv_sk_list.autobind_name));
77155+ atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
77156 }
77157
77158 write_unlock_bh(&iucv_sk_list.lock);
77159diff -urNp linux-2.6.39.1/net/key/af_key.c linux-2.6.39.1/net/key/af_key.c
77160--- linux-2.6.39.1/net/key/af_key.c 2011-05-19 00:06:34.000000000 -0400
77161+++ linux-2.6.39.1/net/key/af_key.c 2011-05-22 19:41:42.000000000 -0400
77162@@ -2481,6 +2481,8 @@ static int pfkey_migrate(struct sock *sk
77163 struct xfrm_migrate m[XFRM_MAX_DEPTH];
77164 struct xfrm_kmaddress k;
77165
77166+ pax_track_stack();
77167+
77168 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
77169 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
77170 !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
77171@@ -3016,10 +3018,10 @@ static int pfkey_send_policy_notify(stru
77172 static u32 get_acqseq(void)
77173 {
77174 u32 res;
77175- static atomic_t acqseq;
77176+ static atomic_unchecked_t acqseq;
77177
77178 do {
77179- res = atomic_inc_return(&acqseq);
77180+ res = atomic_inc_return_unchecked(&acqseq);
77181 } while (!res);
77182 return res;
77183 }
77184@@ -3657,7 +3659,11 @@ static int pfkey_seq_show(struct seq_fil
77185 seq_printf(f ,"sk RefCnt Rmem Wmem User Inode\n");
77186 else
77187 seq_printf(f ,"%p %-6d %-6u %-6u %-6u %-6lu\n",
77188+#ifdef CONFIG_GRKERNSEC_HIDESYM
77189+ NULL,
77190+#else
77191 s,
77192+#endif
77193 atomic_read(&s->sk_refcnt),
77194 sk_rmem_alloc_get(s),
77195 sk_wmem_alloc_get(s),
77196diff -urNp linux-2.6.39.1/net/l2tp/l2tp_ip.c linux-2.6.39.1/net/l2tp/l2tp_ip.c
77197--- linux-2.6.39.1/net/l2tp/l2tp_ip.c 2011-05-19 00:06:34.000000000 -0400
77198+++ linux-2.6.39.1/net/l2tp/l2tp_ip.c 2011-05-22 19:36:34.000000000 -0400
77199@@ -625,7 +625,7 @@ static struct inet_protosw l2tp_ip_proto
77200 .no_check = 0,
77201 };
77202
77203-static struct net_protocol l2tp_ip_protocol __read_mostly = {
77204+static const struct net_protocol l2tp_ip_protocol = {
77205 .handler = l2tp_ip_recv,
77206 };
77207
77208diff -urNp linux-2.6.39.1/net/lapb/lapb_iface.c linux-2.6.39.1/net/lapb/lapb_iface.c
77209--- linux-2.6.39.1/net/lapb/lapb_iface.c 2011-05-19 00:06:34.000000000 -0400
77210+++ linux-2.6.39.1/net/lapb/lapb_iface.c 2011-05-22 19:36:34.000000000 -0400
77211@@ -138,8 +138,7 @@ static struct lapb_cb *lapb_create_cb(vo
77212 out:
77213 return lapb;
77214 }
77215-
77216-int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks)
77217+int lapb_register(struct net_device *dev, const struct lapb_register_struct *callbacks)
77218 {
77219 struct lapb_cb *lapb;
77220 int rc = LAPB_BADTOKEN;
77221diff -urNp linux-2.6.39.1/net/mac80211/cfg.c linux-2.6.39.1/net/mac80211/cfg.c
77222--- linux-2.6.39.1/net/mac80211/cfg.c 2011-06-03 00:04:14.000000000 -0400
77223+++ linux-2.6.39.1/net/mac80211/cfg.c 2011-06-03 00:32:08.000000000 -0400
77224@@ -2031,7 +2031,7 @@ static void ieee80211_get_ringparam(stru
77225 drv_get_ringparam(local, tx, tx_max, rx, rx_max);
77226 }
77227
77228-struct cfg80211_ops mac80211_config_ops = {
77229+const struct cfg80211_ops mac80211_config_ops = {
77230 .add_virtual_intf = ieee80211_add_iface,
77231 .del_virtual_intf = ieee80211_del_iface,
77232 .change_virtual_intf = ieee80211_change_iface,
77233diff -urNp linux-2.6.39.1/net/mac80211/cfg.h linux-2.6.39.1/net/mac80211/cfg.h
77234--- linux-2.6.39.1/net/mac80211/cfg.h 2011-05-19 00:06:34.000000000 -0400
77235+++ linux-2.6.39.1/net/mac80211/cfg.h 2011-05-22 19:36:34.000000000 -0400
77236@@ -4,6 +4,6 @@
77237 #ifndef __CFG_H
77238 #define __CFG_H
77239
77240-extern struct cfg80211_ops mac80211_config_ops;
77241+extern const struct cfg80211_ops mac80211_config_ops;
77242
77243 #endif /* __CFG_H */
77244diff -urNp linux-2.6.39.1/net/mac80211/debugfs_sta.c linux-2.6.39.1/net/mac80211/debugfs_sta.c
77245--- linux-2.6.39.1/net/mac80211/debugfs_sta.c 2011-05-19 00:06:34.000000000 -0400
77246+++ linux-2.6.39.1/net/mac80211/debugfs_sta.c 2011-05-22 19:36:34.000000000 -0400
77247@@ -115,6 +115,8 @@ static ssize_t sta_agg_status_read(struc
77248 struct tid_ampdu_rx *tid_rx;
77249 struct tid_ampdu_tx *tid_tx;
77250
77251+ pax_track_stack();
77252+
77253 rcu_read_lock();
77254
77255 p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
77256@@ -215,6 +217,8 @@ static ssize_t sta_ht_capa_read(struct f
77257 struct sta_info *sta = file->private_data;
77258 struct ieee80211_sta_ht_cap *htc = &sta->sta.ht_cap;
77259
77260+ pax_track_stack();
77261+
77262 p += scnprintf(p, sizeof(buf) + buf - p, "ht %ssupported\n",
77263 htc->ht_supported ? "" : "not ");
77264 if (htc->ht_supported) {
77265diff -urNp linux-2.6.39.1/net/mac80211/ieee80211_i.h linux-2.6.39.1/net/mac80211/ieee80211_i.h
77266--- linux-2.6.39.1/net/mac80211/ieee80211_i.h 2011-05-19 00:06:34.000000000 -0400
77267+++ linux-2.6.39.1/net/mac80211/ieee80211_i.h 2011-05-22 19:36:34.000000000 -0400
77268@@ -27,6 +27,7 @@
77269 #include <net/ieee80211_radiotap.h>
77270 #include <net/cfg80211.h>
77271 #include <net/mac80211.h>
77272+#include <asm/local.h>
77273 #include "key.h"
77274 #include "sta_info.h"
77275
77276@@ -714,7 +715,7 @@ struct ieee80211_local {
77277 /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
77278 spinlock_t queue_stop_reason_lock;
77279
77280- int open_count;
77281+ local_t open_count;
77282 int monitors, cooked_mntrs;
77283 /* number of interfaces with corresponding FIF_ flags */
77284 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
77285diff -urNp linux-2.6.39.1/net/mac80211/iface.c linux-2.6.39.1/net/mac80211/iface.c
77286--- linux-2.6.39.1/net/mac80211/iface.c 2011-05-19 00:06:34.000000000 -0400
77287+++ linux-2.6.39.1/net/mac80211/iface.c 2011-05-22 19:36:34.000000000 -0400
77288@@ -211,7 +211,7 @@ static int ieee80211_do_open(struct net_
77289 break;
77290 }
77291
77292- if (local->open_count == 0) {
77293+ if (local_read(&local->open_count) == 0) {
77294 res = drv_start(local);
77295 if (res)
77296 goto err_del_bss;
77297@@ -235,7 +235,7 @@ static int ieee80211_do_open(struct net_
77298 memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
77299
77300 if (!is_valid_ether_addr(dev->dev_addr)) {
77301- if (!local->open_count)
77302+ if (!local_read(&local->open_count))
77303 drv_stop(local);
77304 return -EADDRNOTAVAIL;
77305 }
77306@@ -327,7 +327,7 @@ static int ieee80211_do_open(struct net_
77307 mutex_unlock(&local->mtx);
77308
77309 if (coming_up)
77310- local->open_count++;
77311+ local_inc(&local->open_count);
77312
77313 if (hw_reconf_flags) {
77314 ieee80211_hw_config(local, hw_reconf_flags);
77315@@ -347,7 +347,7 @@ static int ieee80211_do_open(struct net_
77316 err_del_interface:
77317 drv_remove_interface(local, &sdata->vif);
77318 err_stop:
77319- if (!local->open_count)
77320+ if (!local_read(&local->open_count))
77321 drv_stop(local);
77322 err_del_bss:
77323 sdata->bss = NULL;
77324@@ -474,7 +474,7 @@ static void ieee80211_do_stop(struct iee
77325 }
77326
77327 if (going_down)
77328- local->open_count--;
77329+ local_dec(&local->open_count);
77330
77331 switch (sdata->vif.type) {
77332 case NL80211_IFTYPE_AP_VLAN:
77333@@ -533,7 +533,7 @@ static void ieee80211_do_stop(struct iee
77334
77335 ieee80211_recalc_ps(local, -1);
77336
77337- if (local->open_count == 0) {
77338+ if (local_read(&local->open_count) == 0) {
77339 if (local->ops->napi_poll)
77340 napi_disable(&local->napi);
77341 ieee80211_clear_tx_pending(local);
77342diff -urNp linux-2.6.39.1/net/mac80211/main.c linux-2.6.39.1/net/mac80211/main.c
77343--- linux-2.6.39.1/net/mac80211/main.c 2011-05-19 00:06:34.000000000 -0400
77344+++ linux-2.6.39.1/net/mac80211/main.c 2011-05-22 19:36:34.000000000 -0400
77345@@ -215,7 +215,7 @@ int ieee80211_hw_config(struct ieee80211
77346 local->hw.conf.power_level = power;
77347 }
77348
77349- if (changed && local->open_count) {
77350+ if (changed && local_read(&local->open_count)) {
77351 ret = drv_config(local, changed);
77352 /*
77353 * Goal:
77354diff -urNp linux-2.6.39.1/net/mac80211/mlme.c linux-2.6.39.1/net/mac80211/mlme.c
77355--- linux-2.6.39.1/net/mac80211/mlme.c 2011-06-03 00:04:14.000000000 -0400
77356+++ linux-2.6.39.1/net/mac80211/mlme.c 2011-06-03 00:32:08.000000000 -0400
77357@@ -1431,6 +1431,8 @@ static bool ieee80211_assoc_success(stru
77358 bool have_higher_than_11mbit = false;
77359 u16 ap_ht_cap_flags;
77360
77361+ pax_track_stack();
77362+
77363 /* AssocResp and ReassocResp have identical structure */
77364
77365 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
77366diff -urNp linux-2.6.39.1/net/mac80211/pm.c linux-2.6.39.1/net/mac80211/pm.c
77367--- linux-2.6.39.1/net/mac80211/pm.c 2011-05-19 00:06:34.000000000 -0400
77368+++ linux-2.6.39.1/net/mac80211/pm.c 2011-05-22 19:36:34.000000000 -0400
77369@@ -95,7 +95,7 @@ int __ieee80211_suspend(struct ieee80211
77370 }
77371
77372 /* stop hardware - this must stop RX */
77373- if (local->open_count)
77374+ if (local_read(&local->open_count))
77375 ieee80211_stop_device(local);
77376
77377 local->suspended = true;
77378diff -urNp linux-2.6.39.1/net/mac80211/rate.c linux-2.6.39.1/net/mac80211/rate.c
77379--- linux-2.6.39.1/net/mac80211/rate.c 2011-05-19 00:06:34.000000000 -0400
77380+++ linux-2.6.39.1/net/mac80211/rate.c 2011-05-22 19:36:34.000000000 -0400
77381@@ -371,7 +371,7 @@ int ieee80211_init_rate_ctrl_alg(struct
77382
77383 ASSERT_RTNL();
77384
77385- if (local->open_count)
77386+ if (local_read(&local->open_count))
77387 return -EBUSY;
77388
77389 if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
77390diff -urNp linux-2.6.39.1/net/mac80211/rc80211_pid_debugfs.c linux-2.6.39.1/net/mac80211/rc80211_pid_debugfs.c
77391--- linux-2.6.39.1/net/mac80211/rc80211_pid_debugfs.c 2011-05-19 00:06:34.000000000 -0400
77392+++ linux-2.6.39.1/net/mac80211/rc80211_pid_debugfs.c 2011-05-22 19:36:34.000000000 -0400
77393@@ -192,7 +192,7 @@ static ssize_t rate_control_pid_events_r
77394
77395 spin_unlock_irqrestore(&events->lock, status);
77396
77397- if (copy_to_user(buf, pb, p))
77398+ if (p > sizeof(pb) || copy_to_user(buf, pb, p))
77399 return -EFAULT;
77400
77401 return p;
77402diff -urNp linux-2.6.39.1/net/mac80211/util.c linux-2.6.39.1/net/mac80211/util.c
77403--- linux-2.6.39.1/net/mac80211/util.c 2011-05-19 00:06:34.000000000 -0400
77404+++ linux-2.6.39.1/net/mac80211/util.c 2011-05-22 19:36:34.000000000 -0400
77405@@ -1129,7 +1129,7 @@ int ieee80211_reconfig(struct ieee80211_
77406 local->resuming = true;
77407
77408 /* restart hardware */
77409- if (local->open_count) {
77410+ if (local_read(&local->open_count)) {
77411 /*
77412 * Upon resume hardware can sometimes be goofy due to
77413 * various platform / driver / bus issues, so restarting
77414diff -urNp linux-2.6.39.1/net/netfilter/ipvs/ip_vs_conn.c linux-2.6.39.1/net/netfilter/ipvs/ip_vs_conn.c
77415--- linux-2.6.39.1/net/netfilter/ipvs/ip_vs_conn.c 2011-05-19 00:06:34.000000000 -0400
77416+++ linux-2.6.39.1/net/netfilter/ipvs/ip_vs_conn.c 2011-05-22 19:36:34.000000000 -0400
77417@@ -556,7 +556,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s
77418 /* Increase the refcnt counter of the dest */
77419 atomic_inc(&dest->refcnt);
77420
77421- conn_flags = atomic_read(&dest->conn_flags);
77422+ conn_flags = atomic_read_unchecked(&dest->conn_flags);
77423 if (cp->protocol != IPPROTO_UDP)
77424 conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
77425 /* Bind with the destination and its corresponding transmitter */
77426@@ -861,7 +861,7 @@ ip_vs_conn_new(const struct ip_vs_conn_p
77427 atomic_set(&cp->refcnt, 1);
77428
77429 atomic_set(&cp->n_control, 0);
77430- atomic_set(&cp->in_pkts, 0);
77431+ atomic_set_unchecked(&cp->in_pkts, 0);
77432
77433 atomic_inc(&ipvs->conn_count);
77434 if (flags & IP_VS_CONN_F_NO_CPORT)
77435@@ -1141,7 +1141,7 @@ static inline int todrop_entry(struct ip
77436
77437 /* Don't drop the entry if its number of incoming packets is not
77438 located in [0, 8] */
77439- i = atomic_read(&cp->in_pkts);
77440+ i = atomic_read_unchecked(&cp->in_pkts);
77441 if (i > 8 || i < 0) return 0;
77442
77443 if (!todrop_rate[i]) return 0;
77444diff -urNp linux-2.6.39.1/net/netfilter/ipvs/ip_vs_core.c linux-2.6.39.1/net/netfilter/ipvs/ip_vs_core.c
77445--- linux-2.6.39.1/net/netfilter/ipvs/ip_vs_core.c 2011-05-19 00:06:34.000000000 -0400
77446+++ linux-2.6.39.1/net/netfilter/ipvs/ip_vs_core.c 2011-05-22 19:36:34.000000000 -0400
77447@@ -563,7 +563,7 @@ int ip_vs_leave(struct ip_vs_service *sv
77448 ret = cp->packet_xmit(skb, cp, pd->pp);
77449 /* do not touch skb anymore */
77450
77451- atomic_inc(&cp->in_pkts);
77452+ atomic_inc_unchecked(&cp->in_pkts);
77453 ip_vs_conn_put(cp);
77454 return ret;
77455 }
77456@@ -1633,7 +1633,7 @@ ip_vs_in(unsigned int hooknum, struct sk
77457 if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
77458 pkts = sysctl_sync_threshold(ipvs);
77459 else
77460- pkts = atomic_add_return(1, &cp->in_pkts);
77461+ pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
77462
77463 if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
77464 cp->protocol == IPPROTO_SCTP) {
77465diff -urNp linux-2.6.39.1/net/netfilter/ipvs/ip_vs_ctl.c linux-2.6.39.1/net/netfilter/ipvs/ip_vs_ctl.c
77466--- linux-2.6.39.1/net/netfilter/ipvs/ip_vs_ctl.c 2011-05-19 00:06:34.000000000 -0400
77467+++ linux-2.6.39.1/net/netfilter/ipvs/ip_vs_ctl.c 2011-05-22 19:36:34.000000000 -0400
77468@@ -782,7 +782,7 @@ __ip_vs_update_dest(struct ip_vs_service
77469 ip_vs_rs_hash(ipvs, dest);
77470 write_unlock_bh(&ipvs->rs_lock);
77471 }
77472- atomic_set(&dest->conn_flags, conn_flags);
77473+ atomic_set_unchecked(&dest->conn_flags, conn_flags);
77474
77475 /* bind the service */
77476 if (!dest->svc) {
77477@@ -2027,7 +2027,7 @@ static int ip_vs_info_seq_show(struct se
77478 " %-7s %-6d %-10d %-10d\n",
77479 &dest->addr.in6,
77480 ntohs(dest->port),
77481- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
77482+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
77483 atomic_read(&dest->weight),
77484 atomic_read(&dest->activeconns),
77485 atomic_read(&dest->inactconns));
77486@@ -2038,7 +2038,7 @@ static int ip_vs_info_seq_show(struct se
77487 "%-7s %-6d %-10d %-10d\n",
77488 ntohl(dest->addr.ip),
77489 ntohs(dest->port),
77490- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
77491+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
77492 atomic_read(&dest->weight),
77493 atomic_read(&dest->activeconns),
77494 atomic_read(&dest->inactconns));
77495@@ -2287,6 +2287,8 @@ do_ip_vs_set_ctl(struct sock *sk, int cm
77496 struct ip_vs_dest_user *udest_compat;
77497 struct ip_vs_dest_user_kern udest;
77498
77499+ pax_track_stack();
77500+
77501 if (!capable(CAP_NET_ADMIN))
77502 return -EPERM;
77503
77504@@ -2501,7 +2503,7 @@ __ip_vs_get_dest_entries(struct net *net
77505
77506 entry.addr = dest->addr.ip;
77507 entry.port = dest->port;
77508- entry.conn_flags = atomic_read(&dest->conn_flags);
77509+ entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
77510 entry.weight = atomic_read(&dest->weight);
77511 entry.u_threshold = dest->u_threshold;
77512 entry.l_threshold = dest->l_threshold;
77513@@ -3029,7 +3031,7 @@ static int ip_vs_genl_fill_dest(struct s
77514 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
77515
77516 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
77517- atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
77518+ atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
77519 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
77520 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
77521 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
77522diff -urNp linux-2.6.39.1/net/netfilter/ipvs/ip_vs_sync.c linux-2.6.39.1/net/netfilter/ipvs/ip_vs_sync.c
77523--- linux-2.6.39.1/net/netfilter/ipvs/ip_vs_sync.c 2011-05-19 00:06:34.000000000 -0400
77524+++ linux-2.6.39.1/net/netfilter/ipvs/ip_vs_sync.c 2011-05-22 19:36:34.000000000 -0400
77525@@ -648,7 +648,7 @@ control:
77526 * i.e only increment in_pkts for Templates.
77527 */
77528 if (cp->flags & IP_VS_CONN_F_TEMPLATE) {
77529- int pkts = atomic_add_return(1, &cp->in_pkts);
77530+ int pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
77531
77532 if (pkts % sysctl_sync_period(ipvs) != 1)
77533 return;
77534@@ -794,7 +794,7 @@ static void ip_vs_proc_conn(struct net *
77535
77536 if (opt)
77537 memcpy(&cp->in_seq, opt, sizeof(*opt));
77538- atomic_set(&cp->in_pkts, sysctl_sync_threshold(ipvs));
77539+ atomic_set_unchecked(&cp->in_pkts, sysctl_sync_threshold(ipvs));
77540 cp->state = state;
77541 cp->old_state = cp->state;
77542 /*
77543diff -urNp linux-2.6.39.1/net/netfilter/ipvs/ip_vs_xmit.c linux-2.6.39.1/net/netfilter/ipvs/ip_vs_xmit.c
77544--- linux-2.6.39.1/net/netfilter/ipvs/ip_vs_xmit.c 2011-05-19 00:06:34.000000000 -0400
77545+++ linux-2.6.39.1/net/netfilter/ipvs/ip_vs_xmit.c 2011-05-22 19:36:34.000000000 -0400
77546@@ -1127,7 +1127,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, str
77547 else
77548 rc = NF_ACCEPT;
77549 /* do not touch skb anymore */
77550- atomic_inc(&cp->in_pkts);
77551+ atomic_inc_unchecked(&cp->in_pkts);
77552 goto out;
77553 }
77554
77555@@ -1245,7 +1245,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb,
77556 else
77557 rc = NF_ACCEPT;
77558 /* do not touch skb anymore */
77559- atomic_inc(&cp->in_pkts);
77560+ atomic_inc_unchecked(&cp->in_pkts);
77561 goto out;
77562 }
77563
77564diff -urNp linux-2.6.39.1/net/netfilter/Kconfig linux-2.6.39.1/net/netfilter/Kconfig
77565--- linux-2.6.39.1/net/netfilter/Kconfig 2011-05-19 00:06:34.000000000 -0400
77566+++ linux-2.6.39.1/net/netfilter/Kconfig 2011-05-22 19:41:42.000000000 -0400
77567@@ -781,6 +781,16 @@ config NETFILTER_XT_MATCH_ESP
77568
77569 To compile it as a module, choose M here. If unsure, say N.
77570
77571+config NETFILTER_XT_MATCH_GRADM
77572+ tristate '"gradm" match support'
77573+ depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
77574+ depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
77575+ ---help---
77576+ The gradm match allows to match on grsecurity RBAC being enabled.
77577+ It is useful when iptables rules are applied early on bootup to
77578+ prevent connections to the machine (except from a trusted host)
77579+ while the RBAC system is disabled.
77580+
77581 config NETFILTER_XT_MATCH_HASHLIMIT
77582 tristate '"hashlimit" match support'
77583 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
77584diff -urNp linux-2.6.39.1/net/netfilter/Makefile linux-2.6.39.1/net/netfilter/Makefile
77585--- linux-2.6.39.1/net/netfilter/Makefile 2011-05-19 00:06:34.000000000 -0400
77586+++ linux-2.6.39.1/net/netfilter/Makefile 2011-05-22 20:40:16.000000000 -0400
77587@@ -81,6 +81,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) +=
77588 obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o
77589 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
77590 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
77591+obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
77592 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
77593 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
77594 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
77595diff -urNp linux-2.6.39.1/net/netfilter/nfnetlink_log.c linux-2.6.39.1/net/netfilter/nfnetlink_log.c
77596--- linux-2.6.39.1/net/netfilter/nfnetlink_log.c 2011-05-19 00:06:34.000000000 -0400
77597+++ linux-2.6.39.1/net/netfilter/nfnetlink_log.c 2011-05-22 19:36:35.000000000 -0400
77598@@ -70,7 +70,7 @@ struct nfulnl_instance {
77599 };
77600
77601 static DEFINE_SPINLOCK(instances_lock);
77602-static atomic_t global_seq;
77603+static atomic_unchecked_t global_seq;
77604
77605 #define INSTANCE_BUCKETS 16
77606 static struct hlist_head instance_table[INSTANCE_BUCKETS];
77607@@ -506,7 +506,7 @@ __build_packet_message(struct nfulnl_ins
77608 /* global sequence number */
77609 if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
77610 NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
77611- htonl(atomic_inc_return(&global_seq)));
77612+ htonl(atomic_inc_return_unchecked(&global_seq)));
77613
77614 if (data_len) {
77615 struct nlattr *nla;
77616diff -urNp linux-2.6.39.1/net/netfilter/nfnetlink_queue.c linux-2.6.39.1/net/netfilter/nfnetlink_queue.c
77617--- linux-2.6.39.1/net/netfilter/nfnetlink_queue.c 2011-05-19 00:06:34.000000000 -0400
77618+++ linux-2.6.39.1/net/netfilter/nfnetlink_queue.c 2011-05-22 19:36:35.000000000 -0400
77619@@ -58,7 +58,7 @@ struct nfqnl_instance {
77620 */
77621 spinlock_t lock;
77622 unsigned int queue_total;
77623- atomic_t id_sequence; /* 'sequence' of pkt ids */
77624+ atomic_unchecked_t id_sequence; /* 'sequence' of pkt ids */
77625 struct list_head queue_list; /* packets in queue */
77626 };
77627
77628@@ -272,7 +272,7 @@ nfqnl_build_packet_message(struct nfqnl_
77629 nfmsg->version = NFNETLINK_V0;
77630 nfmsg->res_id = htons(queue->queue_num);
77631
77632- entry->id = atomic_inc_return(&queue->id_sequence);
77633+ entry->id = atomic_inc_return_unchecked(&queue->id_sequence);
77634 pmsg.packet_id = htonl(entry->id);
77635 pmsg.hw_protocol = entskb->protocol;
77636 pmsg.hook = entry->hook;
77637@@ -869,7 +869,7 @@ static int seq_show(struct seq_file *s,
77638 inst->peer_pid, inst->queue_total,
77639 inst->copy_mode, inst->copy_range,
77640 inst->queue_dropped, inst->queue_user_dropped,
77641- atomic_read(&inst->id_sequence), 1);
77642+ atomic_read_unchecked(&inst->id_sequence), 1);
77643 }
77644
77645 static const struct seq_operations nfqnl_seq_ops = {
77646diff -urNp linux-2.6.39.1/net/netfilter/xt_gradm.c linux-2.6.39.1/net/netfilter/xt_gradm.c
77647--- linux-2.6.39.1/net/netfilter/xt_gradm.c 1969-12-31 19:00:00.000000000 -0500
77648+++ linux-2.6.39.1/net/netfilter/xt_gradm.c 2011-05-22 19:41:42.000000000 -0400
77649@@ -0,0 +1,51 @@
77650+/*
77651+ * gradm match for netfilter
77652